fix

generic-argo-apps-chart/templates/genericTemplate.yaml

@@ -54,13 +54,15 @@ spec:
   syncPolicy:
     syncOptions:
       - CreateNamespace=true
-{{- if $config.serverSideApply }}
+{{- if $config.replace }}
       # Opt-in per appSpec entry. Needed when adopting a resource that was
-      # created outside Argo and has fields the new manifest changes type
+      # created outside Argo (no last-applied-configuration annotation for
-      # on (e.g. an env var moving from `value` to `valueFrom`) — a plain
+      # a normal patch to diff against) and has a field the new manifest
-      # strategic-merge patch can add the new field without clearing the
+      # changes type on (e.g. an env var moving from `value` to
-      # old one, which the API rejects. SSA transfers field ownership
+      # `valueFrom`) — a patch can add the new field without clearing the
-      # correctly instead.
+      # old one, which the API rejects either way, patch or SSA. Replace
-      - ServerSideApply=true
+      # does a full PUT of the whole object instead of a merge, so the
+      # submitted spec never contains the stale field at all.
+      - Replace=true
 {{- end }}
 {{- end }}

values/incubator-infra-k8s-admin-prd-ase1-values.yaml

@@ -44,8 +44,10 @@ appSpec:
     valuesDir: gitea
     # Adoption-only: the live init container still has plaintext `value`
     # fields for GITEA_ADMIN_USERNAME/PASSWORD from the original imperative
-    # install; our values switch those to `valueFrom: secretKeyRef`. A
+    # install; our values switch those to `valueFrom: secretKeyRef`. Patch
-    # normal patch can't clear the old field while adding the new one —
+    # (client-side or server-side) can't clear the old field while adding
-    # see the note in generic-argo-apps-chart's template. Safe to remove
+    # the new one — see the note in generic-argo-apps-chart's template.
-    # once the live object no longer carries the old `value` fields.
+    # Replace does a full PUT instead, so it just works. Safe to remove
-    serverSideApply: true
+    # once the live object no longer carries the old `value` fields —
+    # after that first successful sync, plain patching is fine again.
+    replace: true