apiVersion: v1
kind: Secret
metadata:
  name: argocd-secret
  labels:
    app.kubernetes.io/name: argocd-secret
    app.kubernetes.io/part-of: argocd
  annotations:
    # Let Sealed Secrets Controller update this Secret whenever the
    # corresponding SealedSecret changes. When we update a SealedSecret,
    # Controller will extract its Secret, but if the old Secret currently
    # live in K8s doesn't have this annotation, Controller will refuse to
    # update it with the new content just unsealed.
    sealedsecrets.bitnami.com/managed: "true"
type: Opaque

# NOTE. Sealed Secrets.
# We use Sealed Secrets to generate the actual Argo CD K8s Secret. This
# is done in `mesh-infra/security/secrets`, but here we need to install
# the initial empty Secret (part of the Argo CD install manifest) with
# an annotation to allow Sealed Secrets to override this secret later.
