Exclude the orphaned (vestigial-Flux) wildcard cert from the new ArgoCD source
Date: 2026-06-13 Status: Accepted Decision: hl-0gol Deciders: sean@fzymgc.email
Context
Section titled “Context”The cluster was originally bootstrapped with Flux (GitOps Toolkit), then migrated to ArgoCD; Flux was removed (flux-system ns gone, kustomize.toolkit.fluxcd.io CRDs uninstalled, no flux config in repo). The default wildcard TLS cert wildcard-fzymgc-house-tls (cert-manager Certificate in ns traefik) survived, carrying stale kustomize.toolkit.fluxcd.io labels — a GitOps-UNOWNED orphan that cert-manager keeps renewing. argocd/app-configs/traefik/wildcard-cert.yaml is a dead ArgoCD-side duplicate whose spec matches the live cert. Phase 1 adds a new ArgoCD git source for argocd/app-configs/traefik (to deploy the OTLP-token ExternalSecret).
Decision
Section titled “Decision”Rewrite app-configs/traefik/kustomization.yaml to enumerate ONLY otel-ingest-token.yaml and delete the dead wildcard-cert.yaml. ArgoCD manages only the ExternalSecret; the orphaned cert is left untouched. Adopting the orphan into ArgoCD and removing the remaining vestigial-Flux remnants is deferred to follow-up bead hl-e4ny.
Rationale
Section titled “Rationale”Although there is no live Flux to fight, syncing the matching cert manifest would make ArgoCD ADOPT and reconcile the cluster’s default TLS certificate — the highest-blast-radius object in the cluster — inside an unrelated ingress PR. Explicit resource enumeration is the safest boundary: ArgoCD cannot apply a resource it does not list. Keeping the ingress PR focused (cert adoption + Flux cleanup handled holistically in hl-e4ny) reduces risk.
Alternatives Considered
Section titled “Alternatives Considered”(1) Adopt the cert into ArgoCD now (include the file) — deferred to hl-e4ny: clean SSA adoption is plausible (spec matches) but mixes a fiddly adoption + label-ownership step into an ingress-critical PR. (2) ArgoCD ignoreDifferences on the Certificate — rejected: does not stop a hard-sync apply, leaves the dead file. (3) No git source at all — rejected: the OTLP-token ExternalSecret needs an ArgoCD source.
Consequences
Section titled “Consequences”POSITIVE: no risk of ArgoCD adopting/mutating the default TLS cert mid-PR; repo state reflects reality (dead duplicate removed). NEGATIVE: the orphaned cert remains GitOps-unowned until hl-e4ny; the exclude-not-adopt boundary is implicit in the kustomization whitelist. NEUTRAL: the ExternalSecret delivery (git source on the Application) mirrors the agent-memory multi-source pattern.