fix for external secret

generic-argo-apps-chart/templates/genericTemplate.yaml

@@ -65,4 +65,16 @@ spec:
       # submitted spec never contains the stale field at all.
       - Replace=true
 {{- end }}
+{{- if $config.serverSideApply }}
+      # Opt-in per appSpec entry. Distinct from `replace` above — this is
+      # for CRDs whose full manifest (schema included) exceeds the 256KiB
+      # limit Kubernetes puts on the last-applied-configuration annotation
+      # a normal client-side apply writes (external-secrets' CRDs, e.g.
+      # ClusterSecretStore, hit this — they embed large OpenAPI schemas to
+      # cover many provider-specific fields). SSA doesn't use that
+      # annotation at all, so there's no size ceiling to hit. Non-
+      # destructive, unlike Replace — safe as a default reach-for for a
+      # "CRD too large" error specifically.
+      - ServerSideApply=true
+{{- end }}
 {{- end }}