From fee9965d0a4d8ed05f89ba8f3332f91e1e29b3bd Mon Sep 17 00:00:00 2001
From: Hermes Agent service account
 <hermes@carousel-of-progress.local.mk-labs.cloud>
Date: Thu, 13 Aug 2026 23:42:45 -0500
Subject: [PATCH] fix: OpenViking sync-wave deadlock - move ExternalSecret
 ordering inside Application

Remove resource-level sync-wave annotations that caused ArgoCD deadlock.
The wave 8 annotation was meant for platform-level ordering (apps-of-apps)
but was incorrectly applied to individual resources within the Application.

This caused ArgoCD to apply Deployment (wave 0) before ExternalSecret (wave 8),
resulting in CreateContainerConfigError since the pod needed the secret first.

Changes:
- namespace.yaml: Remove sync-wave annotation, add clarifying comment
- externalsecret.yaml: Change sync-wave from 8 to -1 (must sync before Deployment at wave 0)
- application.yaml: Remove sync-wave annotation, document as platform-level only in comments

This ensures:
1. ExternalSecret syncs first (wave -1)
2. Deployment uses it immediately (implicit wave 0)
3. No deadlock

Task: t_3906c41a
---
 cluster/platform/openviking/application.yaml    | 6 +++++-
 cluster/platform/openviking/externalsecret.yaml | 4 +++-
 cluster/platform/openviking/namespace.yaml      | 4 ++--
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/cluster/platform/openviking/application.yaml b/cluster/platform/openviking/application.yaml
index aa61a52..bba9165 100644
--- a/cluster/platform/openviking/application.yaml
+++ b/cluster/platform/openviking/application.yaml
@@ -13,7 +13,11 @@ metadata:
   name: openviking
   namespace: argocd
   annotations:
-    argocd.argoproj.io/sync-wave: "8"
+    # Wave 8 (platform-level, apps-of-apps view): OpenViking Application syncs after Harbor (Wave 7)
+    # NOTE: This annotation controls the Application's position in the apps-of-apps rollout,
+    # NOT the ordering of resources within the Application. Internal resource ordering is
+    # controlled by sync-wave annotations on individual resources (ExternalSecret, etc.).
+    # argocd.argoproj.io/sync-wave: "8"  # Platform-level docs - NOT needed as annotation
     description: |
       OpenViking Platform Knowledge Infrastructure pilot deployment
       Pilot scope: Two corpora (hermes/ skills library, personal/homelab/)
diff --git a/cluster/platform/openviking/externalsecret.yaml b/cluster/platform/openviking/externalsecret.yaml
index 91be7e8..5afd2ea 100644
--- a/cluster/platform/openviking/externalsecret.yaml
+++ b/cluster/platform/openviking/externalsecret.yaml
@@ -13,7 +13,9 @@ metadata:
   name: openviking-credentials
   namespace: openviking
   annotations:
-    argocd.argoproj.io/sync-wave: "8"
+    # Wave -1: Ensure ExternalSecret syncs BEFORE the Deployment (wave 0)
+    # This guarantees the secret exists before the pod tries to mount it
+    argocd.argoproj.io/sync-wave: "-1"
     description: "Phase 1 secrets for OpenViking deployment"
 spec:
   refreshInterval: "1h"
diff --git a/cluster/platform/openviking/namespace.yaml b/cluster/platform/openviking/namespace.yaml
index 88f443e..090fe8d 100644
--- a/cluster/platform/openviking/namespace.yaml
+++ b/cluster/platform/openviking/namespace.yaml
@@ -3,6 +3,6 @@ kind: Namespace
 metadata:
   name: openviking
   annotations:
-    # Wave 8: OpenViking deployment (after Harbor at Wave 7)
+    # Wave 8 (platform-level): OpenViking deployment (after Harbor at Wave 7)
+    # This is documentation only - sync-wave at Application level, not resource level
     # Depends on: cert-manager, nginx-ingress, External Secrets Operator
-    argocd.argoproj.io/sync-wave: "8"