From 15f1171ac591f217ac2d064d5ce54651262ba516 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 9 Aug 2026 19:17:08 +1000 Subject: [PATCH] Ignore defaulted StatefulSet volumeClaimTemplates TypeMeta Kubernetes defaults apiVersion=v1 and kind=PersistentVolumeClaim onto every StatefulSet volumeClaimTemplates entry, but neither the raw manifests nor the rendered helm charts emit those fields. Live StatefulSets therefore carry TypeMeta that git lacks, and ArgoCD reports a diff removing it. Because volumeClaimTemplates are immutable on an existing StatefulSet, ArgoCD can never apply the removal, so consul-server, kanidm and nats stay perpetually OutOfSync and can contribute to sync failures. Add a fleet-wide resource.customizations.ignoreDifferences for apps/StatefulSet that ignores the defaulted apiVersion/kind under every volumeClaimTemplates entry. A single global customization covers the affected StatefulSets across both raw manifests (kanidm) and helm renders (consul, nats), and is inert for those whose charts already emit TypeMeta (vault, woodpecker). --- clusters/au-syd1/bootstrap/argocd-cm-patch.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml b/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml index e13e14b..8701640 100644 --- a/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml +++ b/clusters/au-syd1/bootstrap/argocd-cm-patch.yaml @@ -6,6 +6,16 @@ metadata: namespace: argocd data: kustomize.buildOptions: "--enable-helm" + # Kubernetes defaults apiVersion/kind onto every StatefulSet + # volumeClaimTemplates entry, but neither the raw manifests nor the helm + # charts emit them, so live StatefulSets carry TypeMeta that git lacks. + # volumeClaimTemplates are immutable on an existing StatefulSet, so ArgoCD + # can never reconcile the removal and the resource stays perpetually + # OutOfSync. Ignore the defaulted TypeMeta fleet-wide. + resource.customizations.ignoreDifferences.apps_StatefulSet: | + jqPathExpressions: + - '.spec.volumeClaimTemplates[]?.apiVersion' + - '.spec.volumeClaimTemplates[]?.kind' # External URL ArgoCD serves on (TLS terminated at the traefik-internal gateway). url: https://argocd.k8s.syd1.au.unkin.net # OIDC login via Authentik. The client secret is seeded in Vault out of band -- 2.47.3