argocd was originally helm-installed by hand before ArgoCD existed to
manage it; client-side 3-way merge apply can't prune fields it never
saw in a last-applied-configuration, so a later chart bump left a stale
args on repo-server's copyutil init container (old shell-string command
lingering alongside the new plain cp command) -> cp got 4 args instead
of 3 -> 'No such file or directory' -> CrashLoopBackOff -> Degraded.
Same bug class as envoy-gateway (020b248). ServerSideApply=true tracks
field ownership properly and prunes the stray field on next sync.
Envoy Gateway's per-route default timeout (15s, unset anywhere in this
cluster) was cutting the connection to argocd-server mid-Sync, surfacing
as 'Gateway Timeout' in the UI — confirmed even a single-resource sync
hit exactly ~15.0s every attempt, ruling out chart size/congestion.
BackendTrafficPolicy on the argocd HTTPRoute raises requestTimeout to 120s.
Convention: only the root app-of-apps (bootstrap) auto-syncs so it picks up
new/changed child Application definitions from Git. Every leaf service app
(metallb, metallb-config, envoy-gateway, envoy-gateway-config, nfs-provisioner)
now requires an explicit manual Sync — matches the existing argocd (self-manage)
and ignis convention.
cluster-bootstrap only brings up the minimal layer (argocd, metallb,
envoy-gateway, storage). App/platform services now live in a separate
cluster-platform repo, applied after this one finishes.
Prior test only checked PVC reaches Bound. Add a pod that writes a
file, then a second pod re-mounting the same PVC to confirm data
survives pod delete/recreate (proves NFS-backed, not emptyDir).
nfs-subdir-external-provisioner chart v4.0.18 has no extraObjects
values key - it was silently ignored, so nfs-retain never actually
existed. Only nfs-delete (native storageClass.* key) is real.
Updated README expected output to match.
Gateway API CRDs (httproutes, envoyproxies) have schemas large enough that
client-side apply's last-applied-configuration annotation exceeds the
262144-byte annotation limit. SSA skips that annotation entirely.
ArgoCD only builds a helm-pull command for oci:// sources when the repo is
registered with enableOCI: true; otherwise it falls back to classic --repo
handling, which errors on an oci:// URL. Registered via configs.repositories
in argocd's own values.yaml (Git-managed), Application source updated to
the bare host/path form ArgoCD expects for OCI repos.
Prevents perpetual OutOfSync on bgppeers.metallb.io and other metallb CRDs caused by apiserver-populated .status fields not present in the Helm chart source.
Drop .env/envsubst/bake-hash-into-values.yaml flow entirely. Chart's
configs.secret block is removed for good, so the rendered manifest
never declares admin.password/admin.passwordMtime. Password hash is
set once directly on the live argocd-secret via kubectl patch, and
survives every self-heal sync since ArgoCD never owns those fields.
- remove server.httproute from argocd values.yaml: helm install failed
since Gateway API CRDs (installed by envoy-gateway, wave 2) don't
exist yet; HTTPRoute is already applied manually in Phase 6
- add bootstrap-app.yaml as the Git-committed root/seed Application,
replacing ad-hoc UI creation (GitOps anti-pattern: apps not stored
in Git can't be recreated)
duynguyen