apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: agentic-os
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "0"
spec:
  description: GitOps project for Agentic OS platform and workloads
  # Lock down to known repos only — never use wildcard in production.
  sourceRepos:
    - "http://192.168.8.248:3000/deepkoluguri/agentic-os.git"
    - "http://192.168.8.248:3000/deepkoluguri/agents-runtime.git"
    - "https://charts.jetstack.io"
    - "https://charts.external-secrets.io"
    - "https://cloudnative-pg.github.io/charts"
    - "https://go.temporal.io/helm-charts"
    - "https://prometheus-community.github.io/helm-charts"
  destinations:
    - namespace: "*"
      server: https://kubernetes.default.svc
  clusterResourceWhitelist:
    # Avoid group/kind "*" alone on some Argo CD 3.x builds (can block webhooks); list common cluster-scoped kinds.
    - group: admissionregistration.k8s.io
      kind: MutatingWebhookConfiguration
    - group: admissionregistration.k8s.io
      kind: ValidatingWebhookConfiguration
    - group: apiextensions.k8s.io
      kind: CustomResourceDefinition
    - group: rbac.authorization.k8s.io
      kind: ClusterRole
    - group: rbac.authorization.k8s.io
      kind: ClusterRoleBinding
    - group: rbac.authorization.k8s.io
      kind: Role
    - group: rbac.authorization.k8s.io
      kind: RoleBinding
    - group: storage.k8s.io
      kind: StorageClass
    - group: scheduling.k8s.io
      kind: PriorityClass
    - group: networking.k8s.io
      kind: IngressClass
    - group: cilium.io
      kind: CiliumClusterwideNetworkPolicy
    - group: external-secrets.io
      kind: ClusterSecretStore
    - group: cert-manager.io
      kind: ClusterIssuer
    - group: cert-manager.io
      kind: ClusterCertificateRequest
  namespaceResourceWhitelist:
    - group: "*"
      kind: "*"