feat(cluster): enable ArgoCD Progressive Syncs - #55
Merged
Conversation
This was referenced Aug 11, 2026
Merged
nbrieussel
changed the title
nbrieussel
changed the title
nbrieussel
marked this pull request as ready for review
August 12, 2026 03:06
nbrieussel
changed the title
nbrieussel
force-pushed
the
feature/argocd-progressive-syncs
branch
from
August 12, 2026 03:25
2fa3058 to
ef0c3ee
Compare
nbrieussel
changed the title
added 2 commits
August 12, 2026 16:22
05-secrets/openbao/managed/.terraform.lock.hcl carried a hashicorp/aws provider entry version.tf's required_providers never actually declared (vault + random only) — found while investigating, then reverting, a detour that would have added a real kubernetes provider to this root for ESO's ClusterSecretStore. Regenerated via mise run lock to match version.tf exactly. main.tf's comment above vault_kubernetes_auth_backend_role.external_secrets now points at the role's actual GitOps-side consumer (services/platform/secrets-sync/config in the gitops repo) instead of the Terraform-managed resource that detour briefly added and removed same day — see gitops PR #24 for where the ClusterSecretStore actually lives.
Turns on --enable-progressive-syncs on the ApplicationSet controller. Confirmed live this doesn't gate first-time creation/sync of Applications an ApplicationSet generates (only staged updates to an already-existing fleet — see gitops PR #24's investigation), so it isn't load-bearing for the scaleway boot-ordering fix that PR ships. Kept enabled anyway: harmless, and useful for a future staged rollout against an already-running fleet.
nbrieussel
force-pushed
the
feature/argocd-progressive-syncs
branch
from
August 12, 2026 14:22
ef0c3ee to
16765db
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two clean commits:
chore(openbao): fix stale lock file entry drifted from version.tf—05-secrets/openbao/managed/.terraform.lock.hclcarried ahashicorp/awsprovider entryversion.tfnever actually declared (vault+randomonly). Found while investigating, then reverting same day, a detour that would have added a realkubernetesprovider to this root so ESO'sClusterSecretStorecould be Terraform-managed here — abandoned in favor of a same-repo GitOps move (see companion gitops PR chore: migrate Helm provider to v3 in bootstrap roots #24: theClusterSecretStorenow lives inservices/platform/secrets-sync/config). This commit is the only surviving trace of that detour: a stale lock entry fixed, and a comment pointed at where the role's real consumer now lives.feat(cluster): enable ArgoCD ApplicationSet Progressive Syncs— turns on--enable-progressive-syncs. Confirmed live this doesn't gate first-time creation/sync of Applications an ApplicationSet generates (only staged updates to an already-existing fleet — see gitops PR chore: migrate Helm provider to v3 in bootstrap roots #24's investigation), so it isn't load-bearing for the scaleway boot-ordering fix that PR ships. Kept enabled anyway: harmless, useful for a future staged rollout against an already-running fleet.A follow-up attempt to also restore ArgoCD's
argoproj.io/Applicationhealth check (to close a related sync-wave gap found on gitops PR #24) surfaced a new, already-documented problem on a live redeploy — pulled off this branch, kept locally uncommitted. Revisit separately.Verification
terraform validatepasses on both05-secrets/openbao/managedand10-cluster/scaleway.bugfix/unify-argocd-sync-graphs) — confirms the ClusterSecretStore's GitOps-side home works end to end, no Terraform-side involvement needed.Test plan
terraform planon05-secrets/openbao/managed— expect no changes (comment + lock file only)kubectl get clustersecretstore openbaoisReadyafter a fresh cluster boot, owned by thesecrets-syncApplication, not by Terraform🤖 Generated with Claude Code
https://claude.ai/code/session_017ZMCuQ5t9hdrmUctLk7hEv