From 20dd47790c9d871cadd0dbc29394bc45fcd49950 Mon Sep 17 00:00:00 2001
From: planpal <planpal@local>
Date: Wed, 2 Sep 2026 13:51:31 +0700
Subject: [PATCH] sync-waves: HPA/PDB after Deployments (fix
 scaleTargetRef-not-found)

---
 planpalto-helm/README.md               | 14 +++++++++-----
 planpalto-helm/templates/apps.yaml     |  6 ++++++
 planpalto-helm/templates/ingress.yaml  |  2 +-
 planpalto-helm/templates/seed-job.yaml |  2 +-
 4 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/planpalto-helm/README.md b/planpalto-helm/README.md
index dadf678..052a783 100644
--- a/planpalto-helm/README.md
+++ b/planpalto-helm/README.md
@@ -39,13 +39,17 @@ Objects inside each env are ordered by `argocd.argoproj.io/sync-wave`:
 
 | wave | objects |
 |------|---------|
-| 0 | ClusterSecretStore + ExternalSecrets, redis, nats |
-| 1 | app Deployments + Services + HPA + PDB |
-| 2 | ALB ingress |
-| 3 | seed-admin Job |
+| 0 | ClusterSecretStore + ExternalSecrets, redis, nats, Services |
+| 1 | app Deployments |
+| 2 | HPA + PDB (need their Deployment to exist first) |
+| 3 | ALB ingress |
+| 4 | seed-admin Job |
 
 Argo waits for a wave to be healthy before the next. So secrets and deps land
-before app pods, ingress after pods exist, seed last.
+before app pods, HPAs after the Deployments they target, ingress next, seed last.
+HPA and PDB sit one wave *after* the Deployments on purpose: an HPA applied
+before its target Deployment errors "scaleTargetRef not found" and fails the
+whole sync.
 
 ### Chart source: in-cluster Gitea
 
diff --git a/planpalto-helm/templates/apps.yaml b/planpalto-helm/templates/apps.yaml
index 1355ca9..f640e19 100644
--- a/planpalto-helm/templates/apps.yaml
+++ b/planpalto-helm/templates/apps.yaml
@@ -66,6 +66,10 @@ kind: HorizontalPodAutoscaler
 metadata:
   name: {{ $name }}
   namespace: {{ include "planpal.namespace" $ }}
+  annotations:
+    # wave 2: after the Deployment (wave 1) exists, else the HPA errors
+    # "scaleTargetRef deployment not found" and fails the whole sync.
+    argocd.argoproj.io/sync-wave: "2"
 spec:
   scaleTargetRef: { apiVersion: apps/v1, kind: Deployment, name: {{ $name }} }
   minReplicas: {{ .min }}
@@ -81,6 +85,8 @@ kind: PodDisruptionBudget
 metadata:
   name: {{ $name }}
   namespace: {{ include "planpal.namespace" $ }}
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
 spec:
   maxUnavailable: {{ .maxUnavailable }}
   selector:
diff --git a/planpalto-helm/templates/ingress.yaml b/planpalto-helm/templates/ingress.yaml
index 83554b9..10e2c7d 100644
--- a/planpalto-helm/templates/ingress.yaml
+++ b/planpalto-helm/templates/ingress.yaml
@@ -5,7 +5,7 @@ metadata:
   name: planpal
   namespace: {{ include "planpal.namespace" . }}
   annotations:
-    argocd.argoproj.io/sync-wave: "2"
+    argocd.argoproj.io/sync-wave: "3"
     alb.ingress.kubernetes.io/scheme: internet-facing
     alb.ingress.kubernetes.io/target-type: ip
     alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80},{"HTTPS":443}]'
diff --git a/planpalto-helm/templates/seed-job.yaml b/planpalto-helm/templates/seed-job.yaml
index 0bc1dbf..0262644 100644
--- a/planpalto-helm/templates/seed-job.yaml
+++ b/planpalto-helm/templates/seed-job.yaml
@@ -5,7 +5,7 @@ metadata:
   name: seed-admin
   namespace: {{ include "planpal.namespace" . }}
   annotations:
-    argocd.argoproj.io/sync-wave: "3"
+    argocd.argoproj.io/sync-wave: "4"
     # Argo re-runs a Job by hash; a spec change makes a new Job. Delete the old
     # one before sync if it lingers, or set this to a Sync hook if you want it
     # to run every sync. ponytail: kept as a plain waved object, not a hook.