Argo CD v3's own CRDs (applications, applicationsets, appprojects) embed
large schemas that exceed the 256KiB last-applied-configuration annotation
a client-side apply writes — the same reason cert-manager and
external-secrets already use this. Without it the upgrade sync fails on
the CRDs rather than on anything in the release.
ServerSideDiff comes with it for the same reason as the other three, and
becomes belt-and-braces once the upgraded Argo CD's schema matches the
cluster.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
contour, cert-manager and external-secrets could not be compared or
synced:
error calculating structured merge diff: error building typed value
from live resource: .status.terminatingReplicas: field not declared
in schema
The ServerSideApply sync option makes Argo CD compute the diff locally
against a Kubernetes schema compiled into its own binary. Argo CD v2.13
is older than this cluster: GKE runs 1.35, and Deployments there carry
status.terminatingReplicas, which went beta and on-by-default in 1.33.
Argo CD's schema has never heard of the field, so the diff aborts before
any sync can happen. Nothing is wrong with the manifests, and only the
three apps using SSA are affected.
ServerSideDiff asks the API server to compute the diff via a dry-run
apply, so the schema in use is the cluster's own. Beta since v2.10 and
supported on the running version.
The generic chart could not express this — Application metadata had no
annotations block at all — so it gains an optional per-entry
compareOptions list rather than the annotation being hardcoded.
This is a workaround for an out-of-date Argo CD, not a fix. The fix is
upgrading to a build whose bundled schema matches the cluster; every
value key this repo relies on already exists in chart 10.8.4 (Argo CD
v3.5.2), so that upgrade is mostly a vendoring exercise plus the 3.0
breaking changes (logs RBAC now enforced, fine-grained RBAC inheritance,
resource tracking moving from labels to annotations).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
Adds nine Applications — external-secrets, harbor, jenkins, postgresql,
redis, victoria-metrics-single, vmagent, node-exporter, grafana — bringing
the cluster to the homelab's full set. Every nameOverride is pinned, which
is load-bearing rather than cosmetic in at least three cases:
external-secrets (its service account name is what vault-backend's
serviceAccountRef and Vault's auth role bind to), victoria-metrics-single
(its Service renders as <release>-server, the address vmagent and Grafana
both hardcode) and harbor (the pipeline refers to its object names).
extra-manifests gains the ClusterIssuer that makes cert-manager useful
here: a CA issuer over the registry-ca Secret, which is created by hand
from terraform output because the CA's private key exists only in
Terraform state and nothing can reconcile it from git.
Two homelab-only things removed rather than left to confuse: the Tailscale
Harbor Ingress, and the homelab cluster's own entry point and values file,
which have no meaning in a GCP-only repo. app-of-secretstores and
app-of-extra-manifests now point at this cluster's Gitea over cluster DNS,
and harbor-robot-dockerconfig is keyed to this cluster's registry hostname
— docker matches stored credentials by exact host, so the homelab's would
have silently pushed unauthenticated.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
Fresh install, unlike the homelab's adoption of a running Vault, so
there is no live state to diff against. nameOverride pins the release to
"vault" in namespace "vault" because Terraform's Workload Identity
binding names that exact pair; a different release name renames the
service account and leaves Vault sealed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
Contour is installed by ArgoCD rather than by hand, which is only
possible because nothing in the bootstrap path needed an ingress:
ArgoCD reaches Gitea over cluster DNS. Its HTTPProxy CRD embeds a large
schema, so the entry uses ServerSideApply for the same reason
cert-manager's does.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
Adds the GCP counterpart of the homelab's cluster entry point, alongside
it rather than replacing it, so the two clusters never share a values
file:
- values/incubator-infra-gke-toolshed-prd-usc1-values.yaml, starting with
only argocd, gitea and cert-manager. Every appSpec entry's nameOverride
equals the Helm release name each is installed under by hand, which is
what makes ArgoCD adopt those releases instead of rendering a second
copy of each.
- incubator/incubator-infra-gke-toolshed-prd-usc1.yaml, the parent
Application, applied once by hand.
- app-of-projects.yaml and the devops AppProject now point at this
cluster's Gitea over cluster DNS, not the homelab's LAN hostname.
Sources are reached at gitea-http.gitea.svc.cluster.local:3000 rather
than through an Ingress: ArgoCD has to read them before Contour exists,
since Contour is itself one of the Applications it installs.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
