Sync the self-hosting stack

kubernetes/01-secret-job.yaml

@@ -31,12 +31,21 @@ kind: ServiceAccount
 metadata:
   name: jarvis-secret-minter
   namespace: jarvis
+  # The identity the minting Job below authenticates as, one wave ahead of it. Ordinary
+  # resources, not hooks: a hook ServiceAccount would be deleted and recreated on every sync,
+  # invalidating its token for no reason.
+  annotations:
+    argocd.argoproj.io/sync-wave: "-2"
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: jarvis-secret-minter
   namespace: jarvis
+  # The permission that identity carries, in the same wave as the identity itself: a Role that
+  # lands after the Job has already authenticated is a Job that got a 403.
+  annotations:
+    argocd.argoproj.io/sync-wave: "-2"
 rules:
   # `create` AND NOTHING ELSE. No `get`, no `list`, no `update`.
   #
@@ -57,6 +66,9 @@ kind: RoleBinding
 metadata:
   name: jarvis-secret-minter
   namespace: jarvis
+  # And the binding between the two, in the same wave for the same reason.
+  annotations:
+    argocd.argoproj.io/sync-wave: "-2"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -71,6 +83,22 @@ kind: Job
 metadata:
   name: jarvis-mint-secrets
   namespace: jarvis
+  annotations:
+    # A sync hook for the same reason the migration is one — `spec.template` is immutable, so an
+    # ordinary Job whose image digest moved is a sync that fails on "field is immutable" — plus one
+    # of its own: `ttlSecondsAfterFinished` deletes this Job an hour after it succeeds. As an
+    # ordinary tracked resource that is a controller reporting OutOfSync forever, on an object whose
+    # whole purpose is to be gone.
+    #
+    # Running it again is safe BY CONSTRUCTION rather than by care: the identity below can `create`
+    # and nothing else, so a second run cannot overwrite the secret it wrote the first time. It gets
+    # a 409 and treats it as success. That is what makes it safe to hand to a controller that will
+    # reconcile it on a schedule nobody is watching.
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+    # Before the migration (wave 0), because the migration reads DATABASE_URL out of the secrets;
+    # after the ServiceAccount and Role above (wave -2), which this Job authenticates as.
+    argocd.argoproj.io/sync-wave: "-1"
 spec:
   # Re-running is safe (409 → left untouched), so a retry costs nothing. A high limit would only
   # mean a broken RBAC took longer to become visible.