From 872e582ead68cb8ab2865e74d9a9d27747cfba1a Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 01:25:36 +0000
Subject: [PATCH] fix(argocd): order fuzekeys-sealed before platform to resolve
 Missing/OutOfSync

The platform app's PreSync migrate Job hard-depends on ghcr-pull-secret
and fuzekeys-secrets, both provided by the separate fuzekeys-sealed
Application. app-of-apps reconciled both concurrently with no ordering,
so on a cold cluster the platform's PreSync hook raced ahead of the
SealedSecrets materializing -> ImagePullBackOff/CreateContainerConfigError
-> PreSync never completes -> Sync phase never runs -> whole app Missing.

Add argocd.argoproj.io/sync-wave: -1 to fuzekeys-sealed (and explicit 0
on fuzekeys-platform) so Argo waits for the sealed app to go Healthy
before syncing the platform.

Fixes #36

Co-authored-by: Israel Weinberg <99821070+izzywdev@users.noreply.github.com>
---
 deploy/argocd/applications/fuzekeys-platform.yaml |  6 ++++++
 deploy/argocd/applications/fuzekeys-sealed.yaml   | 10 ++++++++++
 2 files changed, 16 insertions(+)

diff --git a/deploy/argocd/applications/fuzekeys-platform.yaml b/deploy/argocd/applications/fuzekeys-platform.yaml
index a837ddb..3a391d3 100644
--- a/deploy/argocd/applications/fuzekeys-platform.yaml
+++ b/deploy/argocd/applications/fuzekeys-platform.yaml
@@ -3,6 +3,12 @@ kind: Application
 metadata:
   name: fuzekeys-platform
   namespace: argocd
+  annotations:
+    # Sync AFTER fuzekeys-sealed (wave -1) so the SealedSecret-provided
+    # `fuzekeys-secrets` + `ghcr-pull-secret` exist before this app's PreSync
+    # migrate Job runs. Explicit default wave for clarity; the load-bearing
+    # ordering is the -1 on fuzekeys-sealed.
+    argocd.argoproj.io/sync-wave: "0"
   finalizers:
     - resources-finalizer.argocd.argoproj.io
 spec:
diff --git a/deploy/argocd/applications/fuzekeys-sealed.yaml b/deploy/argocd/applications/fuzekeys-sealed.yaml
index 2f7f4c1..a95c377 100644
--- a/deploy/argocd/applications/fuzekeys-sealed.yaml
+++ b/deploy/argocd/applications/fuzekeys-sealed.yaml
@@ -3,6 +3,16 @@ kind: Application
 metadata:
   name: fuzekeys-sealed
   namespace: argocd
+  annotations:
+    # Sync BEFORE the platform app (wave 0). The platform's PreSync migrate Job
+    # hard-depends on the Secrets this app provides — `ghcr-pull-secret` (to pull
+    # the private GHCR image) and `fuzekeys-secrets` (envFrom). Without ordering,
+    # app-of-apps reconciles both concurrently; on a cold cluster the platform's
+    # PreSync hook races ahead of these SealedSecrets materializing, the Job wedges
+    # in ImagePullBackOff/CreateContainerConfigError, PreSync never completes, and
+    # the whole platform app stays Missing/OutOfSync. This wave makes Argo wait for
+    # the sealed app to go Healthy first.
+    argocd.argoproj.io/sync-wave: "-1"
 spec:
   # GitOps-applies the SealedSecrets in deploy/argocd/sealed/ so prod secrets are
   # reconciled by Argo (not a one-off kubectl apply) and survive a from-scratch