fix for external secret

generic-argo-apps-chart/templates/genericTemplate.yaml

@@ -65,4 +65,16 @@ spec:
       # submitted spec never contains the stale field at all.
       - Replace=true
 {{- end }}
+{{- if $config.serverSideApply }}
+      # Opt-in per appSpec entry. Distinct from `replace` above — this is
+      # for CRDs whose full manifest (schema included) exceeds the 256KiB
+      # limit Kubernetes puts on the last-applied-configuration annotation
+      # a normal client-side apply writes (external-secrets' CRDs, e.g.
+      # ClusterSecretStore, hit this — they embed large OpenAPI schemas to
+      # cover many provider-specific fields). SSA doesn't use that
+      # annotation at all, so there's no size ceiling to hit. Non-
+      # destructive, unlike Replace — safe as a default reach-for for a
+      # "CRD too large" error specifically.
+      - ServerSideApply=true
+{{- end }}
 {{- end }}

values/incubator-infra-k8s-admin-prd-ase1-values.yaml

@@ -81,4 +81,9 @@ appSpec:
     # enabled on the Vault side first).
     namespace: external-secrets
     chartDir: external-secrets
-    valuesDir: external-secrets
+    valuesDir: external-secrets
+    # ClusterSecretStore's CRD (large embedded OpenAPI schema) exceeds the
+    # 256KiB last-applied-configuration annotation limit on a normal
+    # client-side apply. SSA sidesteps it entirely — see the note in
+    # generic-argo-apps-chart's template.
+    serverSideApply: true