feat: install oversized CRDs from in-cluster hook Jobs #49

Merged

ivuorinen merged 6 commits from feat/crds-via-argocd into main

2026-09-26 12:41:34 +00:00

ivuorinen commented

2026-09-26 12:39:59 +00:00

Owner

No description provided.

ivuorinen added 6 commits

2026-09-26 12:39:59 +00:00

docs: design for applying CRDs through ArgoCD instead of by hand a7af24bc5e

Three charts here have CRDs too large for the 262144-byte
last-applied-configuration annotation that client-side apply always
writes, and 372c452 verified ArgoCD's CRD-apply step ignores both the
ServerSideApply and Replace sync options. So the CRDs are installed by
scripts 11, 15 and 18 — by hand, before a Renovate bump can be merged.

The design moves that work into the cluster: a crds Application of
PreSync hook Jobs at an early sync-wave, each rendering the chart's CRDs
and applying them server-side, which never writes that annotation.

It also pins promtool to the Prometheus the chart actually deploys,
checked in render-applications.sh where the chart is already rendered.

Ships as two pull requests, because merging is what deploys and the Jobs
cannot be observed until the first one lands.

docs: implementation plan for CRDs installed by hook Jobs 2145efd6e6

Ten tasks across two pull requests. The first adds the crds Application
and its hook Jobs while the scripts stay, so the first run is an
idempotent re-apply of CRDs the cluster already has; the second deletes
the scripts once that is proven in-cluster.

Every command in the plan was run before it was written down. That found
three things the design had wrong or unstated: external-secrets gates its
CRDs behind installCRDs so `helm show crds` returns nothing for it, the
Renovate regex ends in a pattern that cannot match an indented pin, and
the cluster is arm64 so the installer image has to be too.

test: check Renovate's own regex matches the pins it targets 8b0c4e8b7e

feat: add a crds Application to install CRDs ArgoCD cannot apply 6daf042835

feat: install the oversized CRDs from hook Jobs, not by hand de8689d7dd

One Job per chart, each rendering that chart's CRDs and applying them
server-side, which never writes the last-applied-configuration annotation
that defeats ArgoCD's own apply for schemas this large.

The two charts that keep CRDs in templates rather than crds/ need
`helm template --set installCRDs=true` filtered through yq; only
kube-prometheus-stack answers `helm show crds`. Verified against each
chart before being written down: external-secrets returns zero bytes for
the show form.

Renovate's custom manager now also reads gitops/apps/crds/, and its regex
tolerates an indented value line — the pins sit inside a YAML args: block,
which the old pattern could not match. The regex-coverage test added
alongside catches both halves: a targeted file whose pins do not match,
and a pin in a file no manager targets at all.

test: read chart pins from the CRD Jobs as well as the scripts

validate / render (pull_request) Successful in 50s

Details

validate / hooks (pull_request) Successful in 1m19s

Details

866c6d5d1d

annotated_pins() read scripts/*.sh only. Deleting the CRD scripts in the
follow-up would have left the chart-versions-agree check passing while
covering nothing — the same shape as the bats hook whose files pattern
never matched its own subjects.

Both suites now read gitops/apps/crds/ too and tolerate an indented value
line. The depName assertion switches to sort -u so the expected set is
identical before and after the scripts go, rather than changing twice.

ivuorinen merged commit 5912861a71 into main

2026-09-26 12:41:34 +00:00

ivuorinen deleted branch feat/crds-via-argocd

2026-09-26 12:41:35 +00:00

ivuorinen referenced this pull request from a commit

2026-09-26 12:41:36 +00:00

feat: install oversized CRDs from in-cluster hook Jobs (#49)

ivuorinen referenced this pull request

2026-09-26 12:52:45 +00:00

fix: the crds Application never actually synced #50

ivuorinen referenced this pull request from a commit

2026-09-26 12:53:47 +00:00