From 49ed09459ffb60d6dbd2a8eda3b2ce992dffdb05 Mon Sep 17 00:00:00 2001 From: SmokyZone Date: Fri, 18 Sep 2026 19:54:33 +0200 Subject: [PATCH] Fix external-secrets CRD sync failure with ServerSideApply secretstores.external-secrets.io / clustersecretstores.external-secrets.io CRDs embed a very large OpenAPI schema. Client-side apply stores the full manifest in the last-applied-configuration annotation, exceeding Kubernetes' 262144 byte annotation limit ("metadata.annotations: Too long"). Enable ServerSideApply for the external-secrets Application to avoid that annotation entirely. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- values.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/values.yaml b/values.yaml index 8b22d90..92911ce 100644 --- a/values.yaml +++ b/values.yaml @@ -53,6 +53,13 @@ applications: selfHeal: true syncOptions: - CreateNamespace=true + # The SecretStore/ClusterSecretStore CRDs embed a very large OpenAPI + # schema; a plain `kubectl apply` stores the full manifest in the + # `kubectl.kubernetes.io/last-applied-configuration` annotation, + # which exceeds Kubernetes' 262144 byte annotation limit and fails + # with "metadata.annotations: Too long". Server-side apply avoids + # writing that annotation entirely. + - ServerSideApply=true # OpenBao secret management backend + its ClusterSecretStore binding for ESO. - name: openbao