repo cleanup

cluster/argocd/values.yaml

@@ -33,7 +33,7 @@ server:
     hostname: argocd.local.mk-labs.cloud
     tls: true
     annotations:
-      cert-manager.io/cluster-issuer: letsencrypt-production
+      cert-manager.io/cluster-issuer: letsencrypt-prod
       nginx.ingress.kubernetes.io/ssl-passthrough: "false"
       nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
 
@@ -68,6 +68,17 @@ configs:
       hs.message = "IP pool ready"
       return hs
 
+    # Ignore ESO-injected default fields on ExternalSecret resources.
+    # ESO mutates these fields after sync causing false OutOfSync state.
+    resource.customizations.ignoreDifferences.external-secrets.io_ExternalSecret: |
+      jqPathExpressions:
+        - '.spec.data[]?.remoteRef?.conversionStrategy'
+        - '.spec.data[]?.remoteRef?.decodingStrategy'
+        - '.spec.data[]?.remoteRef?.metadataPolicy'
+        - '.spec.dataFrom[]?.extract?.conversionStrategy'
+        - '.spec.dataFrom[]?.extract?.decodingStrategy'
+        - '.spec.dataFrom[]?.extract?.metadataPolicy'
+  
   # RBAC — admin gets full access, SSO groups mapped after Authentik integration
   rbac:
     policy.default: role:readonly