apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: nextgen-cert-manager
spec:
  generators:
    - list:
        elements:
          - env: dev-ap-southeast-1-pioneer
            cluster: dev-ap-southeast-1-pioneer
          - env: dev-ali-apse1-wkly-jxhdvz
            cluster: dev-seed-ali-apse1-wkly-jxhdvz
  template:
    metadata:
      name: "{{env}}-nextgen-cert-manager"
    spec:
      project: default
      sources:
        - repoURL: https://charts.jetstack.io
          chart: cert-manager
          targetRevision: 1.14.5
          helm:
            releaseName: cert-manager
            valueFiles:
              - $values/dev/nextgen-regional-control-plane/cert-manager/envs/{{env}}/values.yaml
        - repoURL: https://github.com/tidbcloud/app-delivery.git
          targetRevision: HEAD
          ref: values
      destination:
        namespace: cert-manager
        name: "{{cluster}}"
      syncPolicy:
        automated:
          selfHeal: true
          prune: true
        syncOptions:
          - CreateNamespace=true
        managedNamespaceMetadata:
          labels:
            pod-identity.alibabacloud.com/injection: "on"
        retry:
          limit: 5
          backoff:
            duration: 5s
            factor: 2
            maxDuration: 3m
      ignoreDifferences:
        # the cert-manager webhook on azure always add namespace selectors to cert-manager-webhook,
        # which caused the cert-manager-webhook to be out of sync in argocd.
        # add ignoreDifferences to ignore the webhook mutation.
        - group: admissionregistration.k8s.io
          kind: ValidatingWebhookConfiguration
          name: cert-manager-webhook
          jqPathExpressions:
            - >
              .webhooks[].namespaceSelector.matchExpressions[] | select(.key == "control-plane")

            - >
              .webhooks[].namespaceSelector.matchExpressions[] | select(.key == "kubernetes.azure.com/managedby")