feat(slice 2B.1.1): sync waves — kill the cert-manager-webhook race (chart 0.5.5)

templates/tenants-wildcard-cert.yaml

@@ -74,6 +74,14 @@ metadata:
     # registry) are up, instead of waiting 5–10 min for LE to
     # finish the wildcard issuance.
     argocd.argoproj.io/sync-options: SkipHealthCheck=true
+    # Slice 2B.1.1 — wave 2: apply AFTER the ClusterIssuer
+    # (wave 1) which depends on cert-manager (wave 0 default).
+    # Argo enforces strict wave ordering with health-gating
+    # between waves, so the Certificate never lands before its
+    # ClusterIssuer exists or before cert-manager-webhook is
+    # accepting admission requests. Eliminates the retries=2
+    # exponential-backoff penalty observed on demo-server105.
+    argocd.argoproj.io/sync-wave: "2"
 spec:
   secretName: {{ printf "tenants-wildcard%s-tls" $suffix | quote }}
   issuerRef: