sync-wave 5 on ClusterIssuer + Certificate (CRD ordering)

templates/cluster-issuer.yaml

@@ -1,24 +1,19 @@
 {{- if .Values.tenant.domain }}
-# letsencrypt-prod ClusterIssuer — DNS-01 challenge via Cloudflare.
-# Scoped to the tenant's Cloudflare zone (.Values.tenant.domain) so
-# cert-manager only attempts records in zones the supplied token can
-# touch — wrong-zone tokens fail loudly at issue time rather than
-# silently re-trying forever.
-#
-# The cloudflare-api-token Secret is NOT in this chart. Tower
-# kubectl-applies it into cert-manager ns at Connect time using the
-# tenant's per-tenant Vault credential (v3/tenants/<id>/cloudflare-token).
-# The chart references it by name only.
-#
-# Sync wave: needs to land AFTER cert-manager's CRDs are installed
-# (cert-manager dep installs first); Argo's default ordering by
-# kind handles this.
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
   name: letsencrypt-prod
   labels:
     app.kubernetes.io/managed-by: cluster-platform-v3
+  annotations:
+    # Argo applies resources in ascending sync-wave order. cert-manager
+    # subchart resources land in the default wave (0); we push CR
+    # consumers to wave 5 so the CRDs (Certificate, ClusterIssuer) the
+    # cert-manager Helm subchart installs are present by the time
+    # Argo apply hits these. Without this, Argo discovery fails on
+    # the first sync with "no matches for kind" because Argo applies
+    # the bundle in one pass and CRD discovery is cached.
+    argocd.argoproj.io/sync-wave: "5"
 spec:
   acme:
     email: {{ required "acme.email is required" .Values.acme.email | quote }}