fix: force ServerSideApply on envoy-gateway Application

Gateway API CRDs (httproutes, envoyproxies) have schemas large enough that
client-side apply's last-applied-configuration annotation exceeds the
262144-byte annotation limit. SSA skips that annotation entirely.

README.md

@@ -52,7 +52,7 @@ helm version
 sudo dnf install -y httpd-tools
 ```
 
-`htpasswd` is used in Phase 3.1 to generate the admin password hash. No `.env` file, no `envsubst` — the password never touches Git.
+`htpasswd` generates the admin password hash used in Phase 3.1.
 
 ---
 
@@ -68,31 +68,23 @@ helm repo add argo https://argoproj.github.io/argo-helm
 helm repo update
 ```
 
-Install ArgoCD:
+Install ArgoCD (`values.yaml` has no `configs.secret` block — chart auto-generates a random admin password):
 
 ```bash
 helm install argocd argo/argo-cd -n argocd --create-namespace -f manifests/argocd/values.yaml
 ```
 
-`values.yaml` deliberately has no `configs.secret` block — the chart auto-generates a random admin password, stored in `argocd-initial-admin-secret`. That's replaced with your own in 3.1.
-
-Wait for ArgoCD to be ready:
+Wait for ready:
 
 ```bash
 kubectl wait --for=condition=available deployment/argocd-server -n argocd --timeout=120s
 ```
 
-Check pods are up:
+(Optional) inspect manually: `kubectl port-forward svc/argocd-server -n argocd 8080:443` → `https://localhost:8080`. Not needed for bootstrap.
 
-```bash
-kubectl get pods -n argocd
-```
+### 3.1 Set admin password on the Secret
 
-> UI login isn't needed for bootstrap (Phase 4 applies the root Application via `kubectl`). Only port-forward if you want to inspect ArgoCD manually: `kubectl port-forward svc/argocd-server -n argocd 8080:443`, then open `https://localhost:8080` with `admin` / your chosen password.
-
-### 3.1 Set your own admin password directly on the Secret
-
-Set it once, straight on `argocd-secret` (the Secret ArgoCD actually reads) — never in `values.yaml`, never committed to Git:
+Patched directly on `argocd-secret`, never in `values.yaml`/Git — keeps `configs.secret` absent so self-heal (wave -1) never touches it, password stays stable forever:
 
 ```bash
 read -s -p "ArgoCD admin password: " PW; echo
@@ -102,21 +94,19 @@ kubectl patch secret argocd-secret -n argocd --type merge -p \
 unset PW HASH
 ```
 
-**Why this stays stable across self-management:** `values.yaml` never declares `configs.secret.argocdServerAdminPassword`, so the Helm chart's rendered manifest never includes `admin.password`/`admin.passwordMtime`. Once ArgoCD self-manages (wave -1, `selfHeal: true`), it only reconciles fields present in its own rendered output — it has no opinion on keys it never declared, so your patched hash survives every sync, forever. If that block is ever added back to `values.yaml`, the next self-heal overwrites it — don't add it.
-
-To rotate later: repeat the same `kubectl patch` with a new hash and a new `admin.passwordMtime` (ArgoCD only accepts the change if the Mtime also changes).
+Rotate: repeat with new hash + new `admin.passwordMtime` (required for ArgoCD to accept the change).
 
 ---
 
 ## Phase 4 — Apply the root bootstrap Application
 
-`bootstrap-app.yaml` (repo root) is the one seed manifest — it lives in Git, not created ad-hoc via UI/CLI. Per GitOps practice, every Application ArgoCD runs must be recreatable from Git; a UI-created app that's stored nowhere can't survive a rebuild. This is the only manifest ever applied by hand — everything downstream (including ArgoCD managing itself, wave -1) is reached by ArgoCD syncing `bootstrap/apps/` from here.
+`bootstrap-app.yaml` (repo root) is the seed manifest, committed to Git — not created via UI/CLI. Only manifest ever applied by hand:
 
 ```bash
 kubectl apply -f bootstrap-app.yaml
 ```
 
-ArgoCD syncs all child Applications in wave order automatically, including self-managing itself via `bootstrap/apps/argocd.yaml` (wave -1).
+ArgoCD syncs all child Applications in wave order automatically, including self-managing itself (`bootstrap/apps/argocd.yaml`, wave -1).
 
 Monitor progress:
 

bootstrap/apps/argocd.yaml

@@ -20,7 +20,3 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: argocd
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true

bootstrap/apps/envoy-gateway.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   project: default
   sources:
-    - repoURL: https://charts.gateway.envoyproxy.io
+    - repoURL: docker.io/envoyproxy
       chart: gateway-helm
       targetRevision: "v1.7.1"
       helm:
@@ -26,3 +26,4 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
+      - ServerSideApply=true

bootstrap/apps/metallb.yaml

@@ -26,3 +26,9 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
+  ignoreDifferences:
+    - group: apiextensions.k8s.io
+      kind: CustomResourceDefinition
+      jsonPointers:
+        - /status
+        - /spec/conversion/webhook/clientConfig/caBundle

manifests/argocd/values.yaml

@@ -18,6 +18,12 @@ global:
 configs:
   params:
     server.insecure: true   # TLS terminated at Envoy Gateway
+  repositories:
+    envoy-gateway-oci:
+      url: docker.io/envoyproxy
+      name: envoy-gateway-oci
+      type: helm
+      enableOCI: "true"
 
 server:
   replicas: 1