Fix external-secrets CRD sync failure with ServerSideApply

secretstores.external-secrets.io / clustersecretstores.external-secrets.io CRDs embed a very large OpenAPI schema. Client-side apply stores the full manifest in the last-applied-configuration annotation, exceeding Kubernetes' 262144 byte annotation limit ("metadata.annotations: Too long"). Enable ServerSideApply for the external-secrets Application to avoid that annotation entirely. Co-authored-by: Copilot <[email protected]>
2026-09-18 19:54:33 +02:00
parent 6827a7b482
commit 49ed09459f
1 changed files with 7 additions and 0 deletions
@@ -53,6 +53,13 @@ applications:
        selfHeal: true
      syncOptions:
        - CreateNamespace=true
+        # The SecretStore/ClusterSecretStore CRDs embed a very large OpenAPI
+        # schema; a plain `kubectl apply` stores the full manifest in the
+        # `kubectl.kubernetes.io/last-applied-configuration` annotation,
+        # which exceeds Kubernetes' 262144 byte annotation limit and fails
+        # with "metadata.annotations: Too long". Server-side apply avoids
+        # writing that annotation entirely.
+        - ServerSideApply=true

  # OpenBao secret management backend + its ClusterSecretStore binding for ESO.
  - name: openbao