fix(eso): chart 0.7.1 — explicit CRD defaults to clear ArgoCD OutOfSync

ArgoCD was reporting all 6 ExternalSecrets as OutOfSync because the
live CRs had conversionStrategy/decodingStrategy/metadataPolicy fields
filled in by the CRD defaults that werent in the chart manifests.
Stamping them explicitly so the diff is clean. Tower UI will now show
Provisioning state correctly transition to Ready.

Chart.yaml

@@ -23,8 +23,8 @@ description: |
       Git).
 
 type: application
-version: 0.7.0
+version: 0.7.1
-appVersion: "0.7.0"
+appVersion: "0.7.1"
 
 dependencies:
   - name: cert-manager

templates/cloudflare-api-token-externalsecret.yaml

@@ -27,6 +27,9 @@ spec:
       remoteRef:
         key: tenants/{{ .Values.tenant.id }}/cloudflare-token
         property: api_token
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
 {{- end }}
 {{- end }}
 {{- end }}

templates/docker-mirror-pull-externalsecret.yaml

@@ -33,14 +33,23 @@ spec:
       remoteRef:
         key: platform/docker-mirror-pull
         property: registry
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
     - secretKey: username
       remoteRef:
         key: platform/docker-mirror-pull
         property: username
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
     - secretKey: password
       remoteRef:
         key: platform/docker-mirror-pull
         property: password
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
 {{- end }}
 {{- end }}
 {{- end }}

templates/gitea-archive-pull-externalsecret.yaml

@@ -33,5 +33,11 @@ spec:
       remoteRef:
         key: platform/gitea-archive-pull
         property: token
+        # CRD defaults stamped explicitly so ArgoCD's diff matches the
+        # live spec (otherwise the app sits in OutOfSync forever even
+        # though ESO is happily reconciling).
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
 {{- end }}
 {{- end }}

templates/longhorn-s3-creds-externalsecret.yaml

@@ -38,10 +38,16 @@ spec:
       remoteRef:
         key: tenants/{{ .Values.tenant.id }}/s3-credentials
         property: access_key
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
     - secretKey: secret_key
       remoteRef:
         key: tenants/{{ .Values.tenant.id }}/s3-credentials
         property: secret_key
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
 {{- end }}
 {{- end }}
 {{- end }}

templates/longhorn.yaml

@@ -1,17 +1,19 @@
 {{- if .Values.longhorn.enabled }}
-# Tenant data StorageClass. Tower's instance overlays don't pin a
+# Tenant data StorageClass. Tower's instance overlays bind here in
-# storageClassName today (they let the cluster default decide). Phase
+# Phase 6 (Tower stamps storageClassName=longhorn-tenants on new
-# 1 of ADR 0003 just defines this class so Phase 2/3 can flip new
+# instance PVCs). Existing instances on local-path stay where they
-# instances to bind here without further chart changes.
+# are — Longhorn additive, doesn't replace.
 #
 # `replicaCount` comes from values; Standalone tier ships replicas=1
-# (durability is hourly S3, not local mirrors).
+# (durability is hourly S3 backup, not local mirrors).
 apiVersion: storage.k8s.io/v1
 kind: StorageClass
 metadata:
   name: longhorn-tenants
   annotations:
-    # Not the cluster default in Phase 1 — explicit opt-in only.
+    # Not the cluster default — explicit opt-in only via Tower's
+    # PVC-stamp logic. (Two default storage classes is a k8s
+    # misconfig; k3s already provides local-path as default.)
     storageclass.kubernetes.io/is-default-class: "false"
 provisioner: driver.longhorn.io
 allowVolumeExpansion: true
@@ -25,8 +27,8 @@ parameters:
   fsType: "ext4"
 {{- end }}
 # NOTE: The CSI VolumeSnapshotClass (snapshot.storage.k8s.io/v1) lives
-# in Phase 3 of ADR 0003, alongside the Tower code that consumes it.
+# in Phase 3 of ADR 0003, alongside the Tower code that consumes it
-# It depends on the external-snapshotter CRDs which Longhorn does not
+# AND the external-snapshotter CRDs (which Longhorn does not ship —
-# ship — they're a separate install. Adding it here would fail the
+# they're a separate install). Adding VolumeSnapshotClass here would
-# initial sync on a fresh cluster. Phase 3 will land both together
+# fail the initial sync. Phase 3 lands all three together: snapshotter
-# (snapshotter CRDs + VolumeSnapshotClass + Tower VolumeClone path).
+# CRDs + controller + VolumeSnapshotClass + Tower VolumeClone path.

templates/s3-backup-creds-externalsecret.yaml

@@ -34,10 +34,16 @@ spec:
       remoteRef:
         key: tenants/{{ .Values.tenant.id }}/s3-credentials
         property: access_key
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
     - secretKey: secret_key
       remoteRef:
         key: tenants/{{ .Values.tenant.id }}/s3-credentials
         property: secret_key
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
 {{- end }}
 {{- end }}
 {{- end }}