Fix external-secrets CRD sync failure with ServerSideApply

secretstores.external-secrets.io / clustersecretstores.external-secrets.io
CRDs embed a very large OpenAPI schema. Client-side apply stores the full
manifest in the last-applied-configuration annotation, exceeding
Kubernetes' 262144 byte annotation limit
("metadata.annotations: Too long"). Enable ServerSideApply for the
external-secrets Application to avoid that annotation entirely.

Co-authored-by: Copilot <[email protected]>

Chart.yaml

@@ -0,0 +1,17 @@
+apiVersion: v2
+name: apps-in-apps
+description: >
+  App-of-Apps Helm chart bootstrapping ArgoCD Applications for this cluster
+  (e.g. the valheim-gitops game server stack).
+type: application
+version: 0.1.0
+appVersion: "1.0.0"
+home: https://git.smokyzone.de/SmokyZone/apps-in-apps
+sources:
+  - https://git.smokyzone.de/SmokyZone/apps-in-apps
+keywords:
+  - argocd
+  - app-of-apps
+  - gitops
+maintainers:
+  - name: SmokyZone

README.md

@@ -0,0 +1,63 @@
+# apps-in-apps
+
+App-of-Apps Helm chart. Renders `argoproj.io/v1alpha1 Application` resources
+for every entry configured under `applications` in [`values.yaml`](values.yaml),
+including the [`valheim-gitops`](https://git.smokyzone.de/SmokyZone/valheim-gitops)
+stack.
+
+Because this repository *is* a Helm chart, it can be registered in ArgoCD as its
+own Application (Helm source), which then manages all child Applications declared
+in `values.yaml`.
+
+## Bootstrapping
+
+1. Make sure ArgoCD is installed and its API server can reach
+   `git.smokyzone.de` (add repo credentials if the repos are private).
+2. Apply the one-time root Application once:
+
+   ```sh
+   kubectl apply -f bootstrap/root-application.yaml
+   ```
+
+   This registers `apps-in-apps` itself as an ArgoCD Application using this
+   git repo as a Helm chart source, with automated sync/prune/self-heal.
+3. ArgoCD renders `templates/application.yaml`, which creates one child
+   Application per entry in `applications` (currently: `valheim`, pointing at
+   the `valheim-gitops` chart).
+
+## Adding another app
+
+Add an entry to `applications` in `values.yaml`:
+
+```yaml
+applications:
+  - name: my-app
+    enabled: true
+    source:
+      repoURL: https://git.smokyzone.de/SmokyZone/my-app.git
+      targetRevision: main
+      path: .
+    destination:
+      server: https://kubernetes.default.svc
+      namespace: my-app
+    syncPolicy:
+      automated:
+        prune: true
+        selfHeal: true
+      syncOptions:
+        - CreateNamespace=true
+```
+
+Commit and push — ArgoCD picks it up on the next sync.
+
+## Structure
+
+```
+apps-in-apps/
+├── Chart.yaml                     # Helm chart metadata
+├── values.yaml                    # List of managed Applications
+├── templates/
+│   └── application.yaml           # Renders one Application per entry
+└── bootstrap/
+    └── root-application.yaml      # One-time manifest to register this chart in ArgoCD
+```

bootstrap/root-application.yaml

@@ -0,0 +1,27 @@
+# One-time bootstrap manifest.
+#
+# Apply this manually once (kubectl apply -f bootstrap/root-application.yaml)
+# so ArgoCD manages itself as a Helm-based Application. From then on, any
+# entry added to values.yaml -> applications[] is rolled out automatically.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: apps-in-apps
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://git.smokyzone.de/SmokyZone/apps-in-apps.git
+    targetRevision: main
+    path: .
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

templates/application.yaml

@@ -0,0 +1,44 @@
+{{- range .Values.applications }}
+{{- if .enabled }}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: {{ .name }}
+  namespace: {{ $.Values.argocd.namespace }}
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: {{ $.Values.argocd.project }}
+  source:
+    repoURL: {{ .source.repoURL }}
+    targetRevision: {{ .source.targetRevision }}
+    {{- if .source.chart }}
+    chart: {{ .source.chart }}
+    {{- else }}
+    path: {{ .source.path }}
+    {{- end }}
+    {{- if or (and .source.helm .source.helm.parameters) (and .source.helm .source.helm.valueFiles) (and .source.helm .source.helm.values) }}
+    helm:
+      {{- if .source.helm.parameters }}
+      parameters:
+        {{- toYaml .source.helm.parameters | nindent 8 }}
+      {{- end }}
+      {{- if .source.helm.valueFiles }}
+      valueFiles:
+        {{- toYaml .source.helm.valueFiles | nindent 8 }}
+      {{- end }}
+      {{- if .source.helm.values }}
+      values: |
+        {{- .source.helm.values | nindent 8 }}
+      {{- end }}
+    {{- end }}
+  destination:
+    server: {{ .destination.server }}
+    namespace: {{ .destination.namespace }}
+  {{- if .syncPolicy }}
+  syncPolicy:
+    {{- toYaml .syncPolicy | nindent 4 }}
+  {{- end }}
+---
+{{- end }}
+{{- end }}

values.yaml

@@ -0,0 +1,79 @@
+## Default values for the apps-in-apps chart (App-of-Apps pattern).
+
+argocd:
+  # Namespace where ArgoCD (and thus the Application CRs) live.
+  namespace: argocd
+  # AppProject the generated Applications belong to.
+  project: default
+
+# List of child ArgoCD Applications this chart renders.
+# Each entry maps 1:1 to an `argoproj.io/v1alpha1 Application`.
+applications:
+  - name: valheim
+    enabled: true
+    source:
+      repoURL: https://git.smokyzone.de/SmokyZone/valheim-gitops.git
+      targetRevision: main
+      path: .
+      helm:
+        # Extra --set style values merged into the valheim-gitops chart.
+        # Keep secrets out of here - override via a sealed/external secret
+        # or ArgoCD parameter overrides instead.
+        parameters: []
+        # valueFiles:
+        #   - values.yaml
+    destination:
+      # Empty server means "the cluster ArgoCD itself runs in".
+      server: https://kubernetes.default.svc
+      namespace: valheim
+    syncPolicy:
+      automated:
+        prune: true
+        selfHeal: true
+      syncOptions:
+        - CreateNamespace=true
+
+  # External Secrets Operator - installed straight from its official Helm
+  # repo (no git source needed). CRDs are installed by the chart itself.
+  - name: external-secrets
+    enabled: true
+    source:
+      repoURL: https://charts.external-secrets.io
+      chart: external-secrets
+      targetRevision: "2.10.0"
+      helm:
+        values: |
+          installCRDs: true
+    destination:
+      server: https://kubernetes.default.svc
+      namespace: external-secrets
+    syncPolicy:
+      automated:
+        prune: true
+        selfHeal: true
+      syncOptions:
+        - CreateNamespace=true
+        # The SecretStore/ClusterSecretStore CRDs embed a very large OpenAPI
+        # schema; a plain `kubectl apply` stores the full manifest in the
+        # `kubectl.kubernetes.io/last-applied-configuration` annotation,
+        # which exceeds Kubernetes' 262144 byte annotation limit and fails
+        # with "metadata.annotations: Too long". Server-side apply avoids
+        # writing that annotation entirely.
+        - ServerSideApply=true
+
+  # OpenBao secret management backend + its ClusterSecretStore binding for ESO.
+  - name: openbao
+    enabled: true
+    source:
+      repoURL: https://git.smokyzone.de/SmokyZone/openbao.git
+      targetRevision: main
+      path: .
+    destination:
+      server: https://kubernetes.default.svc
+      namespace: openbao
+    syncPolicy:
+      automated:
+        prune: true
+        selfHeal: true
+      syncOptions:
+        - CreateNamespace=true