clusters/au-syd1/bootstrap/argocd-cm-patch.yaml

@@ -6,6 +6,16 @@ metadata:
   namespace: argocd
 data:
   kustomize.buildOptions: "--enable-helm"
+  # Kubernetes defaults apiVersion/kind onto every StatefulSet
+  # volumeClaimTemplates entry, but neither the raw manifests nor the helm
+  # charts emit them, so live StatefulSets carry TypeMeta that git lacks.
+  # volumeClaimTemplates are immutable on an existing StatefulSet, so ArgoCD
+  # can never reconcile the removal and the resource stays perpetually
+  # OutOfSync. Ignore the defaulted TypeMeta fleet-wide.
+  resource.customizations.ignoreDifferences.apps_StatefulSet: |
+    jqPathExpressions:
+      - '.spec.volumeClaimTemplates[]?.apiVersion'
+      - '.spec.volumeClaimTemplates[]?.kind'
   # External URL ArgoCD serves on (TLS terminated at the traefik-internal gateway).
   url: https://argocd.k8s.syd1.au.unkin.net
   # OIDC login via Authentik. The client secret is seeded in Vault out of band