Merge pull request #747 from mitchross/claude/fix-sync-wave-ordering-015vZLxdaHpaAyBTchJ4nK3n

Claude/fix sync wave ordering 015v z lxda hpa ay b tch j4n k3n

Author: mitchross

BOOTSTRAP.md

@@ -193,20 +193,24 @@ ArgoCD deploys applications in a specific order to avoid race conditions and SSD
 | Wave | Component | Purpose | Why This Order? |
 |------|-----------|---------|-----------------|
 | **0** | **Cilium** | CNI networking | Foundation - everything depends on networking |
-| **1** | **1Password Connect, External Secrets, Longhorn, Garage** | Secret management and storage | 1Password → External Secrets → Longhorn (needs secrets for backups) |
-| **2** | **Infrastructure** | Core services (cert-manager, databases, GPU operators, etc.) | Depends on networking, secrets, and storage being ready |
+| **0** | **1Password Connect** | Secret backend | Required by External Secrets Operator |
+| **0** | **External Secrets Operator** | Secret management CRDs | Longhorn needs ExternalSecret CRD for backup credentials |
+| **1** | **Longhorn** | Storage layer | Needs networking + secret CRDs; other apps need storage |
+| **1** | **Garage** | S3-compatible object storage | Needs storage layer |
+| **2** | **Infrastructure** | Core services (cert-manager, GPU operators, databases, etc.) | Depends on networking and storage being ready |
 | **3** | **Monitoring** | Prometheus, Grafana, alerts | Monitors the infrastructure |
 | **4** | **My-Apps** | User applications | Runs on top of everything else |
 
 **Why Sync Waves Matter:**
 - **Prevents race conditions** - Cilium won't be reinstalled while Longhorn is deploying
-- **Eliminates SSD thrashing** - Longhorn waits for Cilium to be fully healthy
+- **Eliminates SSD thrashing** - Longhorn waits for Cilium + secrets to be fully healthy
 - **Ensures stability** - Each layer is healthy before the next begins
 - **Proper dependencies** - Apps that need PVCs deploy after Longhorn is ready
+- **Secret management** - ExternalSecret CRDs exist before resources try to use them
 
 **What You'll See:**
-1. **Wave 0**: Cilium deploys and becomes healthy
-2. **Wave 1**: 1Password Connect → External Secrets Operator → Longhorn and Garage deploy in parallel
+1. **Wave 0**: Cilium, 1Password Connect, and External Secrets Operator deploy in parallel
+2. **Wave 1**: Longhorn and Garage deploy after networking + secrets are ready
 3. **Wave 2**: Infrastructure components deploy in parallel
 4. **Wave 3**: Monitoring stack deploys
 5. **Wave 4**: Your applications deploy last

infrastructure/controllers/argocd/apps/1passwordconnect.yaml

@@ -4,7 +4,7 @@ metadata:
   name: 1passwordconnect
   namespace: argocd
   annotations:
-    argocd.argoproj.io/sync-wave: "1"
+    argocd.argoproj.io/sync-wave: "0"
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:

infrastructure/controllers/argocd/apps/external-secrets.yaml

@@ -4,7 +4,7 @@ metadata:
   name: external-secrets
   namespace: argocd
   annotations:
-    argocd.argoproj.io/sync-wave: "1"
+    argocd.argoproj.io/sync-wave: "0"
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:

infrastructure/controllers/argocd/apps/infrastructure-appset.yaml

@@ -11,7 +11,7 @@ spec:
       repoURL: https://github.com/mitchross/talos-argocd-proxmox.git
       revision: main
       directories:
-      # Controllers (argocd managed via Helm, cilium has its own app)
+      # Controllers (argocd managed via Helm, cilium/external-secrets/1password have their own apps)
       - path: infrastructure/controllers/cert-manager
       - path: infrastructure/controllers/gpu-priority-classes
       - path: infrastructure/controllers/intel-device-plugins

infrastructure/controllers/argocd/apps/kustomization.yaml

@@ -1,14 +1,15 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- projects.yaml
-# Critical applications with specific sync waves to prevent race conditions
-- cilium-app.yaml # Wave 0 - Networking foundation
-- 1passwordconnect.yaml # Wave 1 - Secret backend (needed by External Secrets)
-- external-secrets.yaml # Wave 1 - Secret management (needed by Longhorn)
-- longhorn-app.yaml # Wave 1 - Storage foundation
-# ApplicationSets for automatic discovery
-- infrastructure-appset.yaml # Wave 2
-- monitoring-appset.yaml # Wave 3
-- my-apps-appset.yaml # Wave 4
-- garage.yaml
+  - projects.yaml
+  # Critical applications with specific sync waves to prevent race conditions
+  # Wave 0: Foundation components (networking + secrets infrastructure)
+  - cilium-app.yaml        # Wave 0 - Networking foundation
+  - 1passwordconnect.yaml  # Wave 0 - Secret backend (required by External Secrets)
+  - external-secrets.yaml  # Wave 0 - External Secrets CRDs (required by Longhorn)
+  - longhorn-app.yaml      # Wave 1 - Storage foundation
+  # ApplicationSets for automatic discovery
+  - infrastructure-appset.yaml  # Wave 2
+  - monitoring-appset.yaml      # Wave 3
+  - my-apps-appset.yaml         # Wave 4
+  - garage.yaml

infrastructure/controllers/argocd/apps/longhorn-app.yaml

@@ -27,7 +27,6 @@ spec:
     - CreateNamespace=true
     - ServerSideApply=true
     - RespectIgnoreDifferences=true
-    - SkipDryRunOnMissingResource=true
     retry:
       limit: 10
       backoff:
@@ -47,5 +46,7 @@ spec:
     - /data
   - group: gateway.networking.k8s.io
     kind: HTTPRoute
-    jqPathExpressions:
-    - .status
+    jsonPointers:
+    - /spec/rules/0/backendRefs/0/group
+    - /spec/rules/0/backendRefs/0/kind
+    - /spec/rules/0/backendRefs/0/weight