fix

generic-argo-apps-chart/templates/genericTemplate.yaml

@@ -54,4 +54,13 @@ spec:
   syncPolicy:
     syncOptions:
       - CreateNamespace=true
+{{- if $config.serverSideApply }}
+      # Opt-in per appSpec entry. Needed when adopting a resource that was
+      # created outside Argo and has fields the new manifest changes type
+      # on (e.g. an env var moving from `value` to `valueFrom`) — a plain
+      # strategic-merge patch can add the new field without clearing the
+      # old one, which the API rejects. SSA transfers field ownership
+      # correctly instead.
+      - ServerSideApply=true
+{{- end }}
 {{- end }}

values/incubator-infra-k8s-admin-prd-ase1-values.yaml

@@ -42,3 +42,10 @@ appSpec:
     namespace: gitea
     chartDir: gitea
     valuesDir: gitea
+    # Adoption-only: the live init container still has plaintext `value`
+    # fields for GITEA_ADMIN_USERNAME/PASSWORD from the original imperative
+    # install; our values switch those to `valueFrom: secretKeyRef`. A
+    # normal patch can't clear the old field while adding the new one —
+    # see the note in generic-argo-apps-chart's template. Safe to remove
+    # once the live object no longer carries the old `value` fields.
+    serverSideApply: true