Skip to content

feat(cluster): enable ArgoCD Progressive Syncs #55

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nbrieussel merged 2 commits into from
Aug 12, 2026
+22 −24
Merged

feat(cluster): enable ArgoCD Progressive Syncs #55

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
62d3138
chore(openbao): fix stale lock file entry drifted from version.tf
Aug 12, 2026
16765db
feat(cluster): enable ArgoCD ApplicationSet Progressive Syncs
Aug 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 0 additions & 23 deletions 05-secrets/openbao/managed/.terraform.lock.hcl
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

11 changes: 10 additions & 1 deletion 05-secrets/openbao/managed/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,16 @@ resource "vault_kubernetes_auth_backend_role" "snapshot" {
}

# external-secrets/external-secrets — ESO's ClusterSecretStore
# (gitops repo apps/openbao-init/templates/clustersecretstore.yaml).
# (gitops repo services/platform/secrets-sync/config/templates/clustersecretstore.yaml).
# Briefly moved to this root as a kubernetes_manifest resource (2026-08-12),
# reverted same day: co-locating it with this role was tidier in the
# abstract, but needed a new `kubernetes` provider on a root that otherwise
# only talks to Vault, plus a cross-root terraform_remote_state read just
# for kubeconfig — real added complexity for a problem (GitOps wave
# ordering looking confusing) that a same-repo move already fixes just as
# well, with none of that. See the gitops repo commit for the actual fix
# and its own tradeoff note (secrets-sync isn't a perfectly clean home
# either — see that file's comment).
resource "vault_kubernetes_auth_backend_role" "external_secrets" {
backend = vault_auth_backend.kubernetes.path
role_name = "external-secrets"
Expand Down
12 changes: 12 additions & 0 deletions 10-cluster/scaleway/argocd.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,6 +205,18 @@ redis:
memory: 128Mi

applicationSet:
# Beta feature (argo-helm/argo-cd chart): without this flag, the
# argocd.argoproj.io/sync-wave annotation on Applications generated by an
# ApplicationSet does nothing — each generated Application is created and
# auto-synced independently, with no ordering across them. Needed by
# gitops's services-app-scaleway ApplicationSet (bootstrap/templates/scaleway.yaml),
# whose RollingSync strategy groups Velero/external-dns/Dex/Grafana after
# the OpenBao-backed Secrets their own sibling -init/-config apps produce
# — confirmed live 2026-08-11 that plain sync-wave annotations alone did
# not prevent those pods starting before their credentials existed.
extraArgs:
- --enable-progressive-syncs

resources:
requests:
cpu: 10m
Expand Down
Loading