Fix external-secrets CRD sync failure with ServerSideApply

secretstores.external-secrets.io / clustersecretstores.external-secrets.io CRDs embed a very large OpenAPI schema. Client-side apply stores the full manifest in the last-applied-configuration annotation, exceeding Kubernetes' 262144 byte annotation limit ("metadata.annotations: Too long"). Enable ServerSideApply for the external-secrets Application to avoid that annotation entirely. Co-authored-by: Copilot <[email protected]>
use correct repo for openbao
2026-09-18 19:54:33 +02:00 · 2026-09-18 19:50:06 +02:00
1 changed files with 8 additions and 1 deletions
@@ -53,12 +53,19 @@ applications:
        selfHeal: true
      syncOptions:
        - CreateNamespace=true
+        # The SecretStore/ClusterSecretStore CRDs embed a very large OpenAPI
+        # schema; a plain `kubectl apply` stores the full manifest in the
+        # `kubectl.kubernetes.io/last-applied-configuration` annotation,
+        # which exceeds Kubernetes' 262144 byte annotation limit and fails
+        # with "metadata.annotations: Too long". Server-side apply avoids
+        # writing that annotation entirely.
+        - ServerSideApply=true

  # OpenBao secret management backend + its ClusterSecretStore binding for ESO.
  - name: openbao
    enabled: true
    source:
-      repoURL: https://git.smokyzone.de/SmokyZone/openbao-gitops.git
+      repoURL: https://git.smokyzone.de/SmokyZone/openbao.git
      targetRevision: main
      path: .
    destination: