Add Stakater Reloader application

Deploys the Reloader chart (2.2.17) into the reloader namespace. Uses the
annotations reload strategy so ArgoCD selfHeal does not revert an injected
env var as drift.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

values.yaml

@@ -77,3 +77,31 @@ applications:
         selfHeal: true
       syncOptions:
         - CreateNamespace=true
+
+  # Stakater Reloader - watches Secrets/ConfigMaps and triggers a rolling restart
+  # of workloads that reference them (e.g. after ESO refreshes a secret from OpenBao).
+  # Opt-in per workload via annotation, e.g. on a Deployment/StatefulSet:
+  #   secret.reloader.stakater.com/reload: "<secret-name>"
+  # or `reloader.stakater.com/auto: "true"` to react to every referenced Secret/ConfigMap.
+  - name: reloader
+    enabled: true
+    source:
+      repoURL: https://stakater.github.io/stakater-charts
+      chart: reloader
+      targetRevision: "2.2.17"
+      helm:
+        values: |
+          reloader:
+            # The default strategy injects an env var into the pod template, which
+            # ArgoCD (selfHeal) would revert as drift. Annotations on the pod template
+            # are extra map keys and are ignored by ArgoCD's diff.
+            reloadStrategy: annotations
+    destination:
+      server: https://kubernetes.default.svc
+      namespace: reloader
+    syncPolicy:
+      automated:
+        prune: true
+        selfHeal: true
+      syncOptions:
+        - CreateNamespace=true