From 843a90384a2804237dd7a79b947edd252d60ab9d Mon Sep 17 00:00:00 2001 From: Nick Lathe Date: Fri, 7 Aug 2026 14:14:17 -0700 Subject: [PATCH 1/2] Restore eso drift ignores on standard-envtyps Signed-off-by: Nick Lathe --- apps/infra/standard-envtypes/application.yaml | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/apps/infra/standard-envtypes/application.yaml b/apps/infra/standard-envtypes/application.yaml index 175fd458..c8849b67 100644 --- a/apps/infra/standard-envtypes/application.yaml +++ b/apps/infra/standard-envtypes/application.yaml @@ -9,6 +9,34 @@ metadata: argocd.argoproj.io/sync-wave: "30" spec: project: default + #============================================================================ + # The ESO controller writes defaults onto ExternalSecret objects that our + # manifests do not declare (creationPolicy, deletionPolicy, + # conversionStrategy, decodingStrategy), which Argo otherwise reports as + # permanent drift. + # + # Ignore by field manager rather than by path: this covers every field the + # external-secrets controller owns, including ones added by future ESO + # versions, and stays correct as the shape of the manifest changes (dataFrom + # is now a two-element list; indexed JSON pointers would not survive that). + # + # Added in 1021fba, removed by b60928c ("disable SSA on noisy ESO apps", + # which removed these but left ServerSideApply=true in place). The drift went + # unnoticed until the vendored chart archive was rebuilt, because the stale + # archive still declared the defaulted fields. + # + # NOTE: managedFieldsManagers depends on server-side apply for field + # ownership tracking. If SSA is ever disabled here, switch to jqPathExpressions. + #============================================================================ + ignoreDifferences: + - group: external-secrets.io + kind: ExternalSecret + managedFieldsManagers: + - external-secrets + - group: external-secrets.io + kind: ClusterExternalSecret + managedFieldsManagers: + - external-secrets sources: - repoURL: https://github.com/code-dot-org/k8s-gitops.git targetRevision: main @@ -28,5 +56,8 @@ spec: prune: true selfHeal: true syncOptions: + # Make the sync operation honor ignoreDifferences, not just the diff view, + # so selfHeal does not fight the ESO controller on every reconcile. + - RespectIgnoreDifferences=true - ServerSideApply=true - CreateNamespace=true From 13cdebf55c3c82d38933f855a8935cff89f9ff75 Mon Sep 17 00:00:00 2001 From: Nick Lathe Date: Fri, 7 Aug 2026 14:18:46 -0700 Subject: [PATCH 2/2] Reduce verbosity of comment Signed-off-by: Nick Lathe --- apps/infra/standard-envtypes/application.yaml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/apps/infra/standard-envtypes/application.yaml b/apps/infra/standard-envtypes/application.yaml index c8849b67..7dbffbfa 100644 --- a/apps/infra/standard-envtypes/application.yaml +++ b/apps/infra/standard-envtypes/application.yaml @@ -20,11 +20,6 @@ spec: # versions, and stays correct as the shape of the manifest changes (dataFrom # is now a two-element list; indexed JSON pointers would not survive that). # - # Added in 1021fba, removed by b60928c ("disable SSA on noisy ESO apps", - # which removed these but left ServerSideApply=true in place). The drift went - # unnoticed until the vendored chart archive was rebuilt, because the stale - # archive still declared the defaulted fields. - # # NOTE: managedFieldsManagers depends on server-side apply for field # ownership tracking. If SSA is ever disabled here, switch to jqPathExpressions. #============================================================================