sync-waves: HPA/PDB after Deployments (fix scaleTargetRef-not-found)

planpalto-helm/README.md

@@ -39,13 +39,17 @@ Objects inside each env are ordered by `argocd.argoproj.io/sync-wave`:
 
 | wave | objects |
 |------|---------|
-| 0 | ClusterSecretStore + ExternalSecrets, redis, nats |
-| 1 | app Deployments + Services + HPA + PDB |
-| 2 | ALB ingress |
-| 3 | seed-admin Job |
+| 0 | ClusterSecretStore + ExternalSecrets, redis, nats, Services |
+| 1 | app Deployments |
+| 2 | HPA + PDB (need their Deployment to exist first) |
+| 3 | ALB ingress |
+| 4 | seed-admin Job |
 
 Argo waits for a wave to be healthy before the next. So secrets and deps land
-before app pods, ingress after pods exist, seed last.
+before app pods, HPAs after the Deployments they target, ingress next, seed last.
+HPA and PDB sit one wave *after* the Deployments on purpose: an HPA applied
+before its target Deployment errors "scaleTargetRef not found" and fails the
+whole sync.
 
 ### Chart source: in-cluster Gitea
 

planpalto-helm/templates/apps.yaml

@@ -66,6 +66,10 @@ kind: HorizontalPodAutoscaler
 metadata:
   name: {{ $name }}
   namespace: {{ include "planpal.namespace" $ }}
+  annotations:
+    # wave 2: after the Deployment (wave 1) exists, else the HPA errors
+    # "scaleTargetRef deployment not found" and fails the whole sync.
+    argocd.argoproj.io/sync-wave: "2"
 spec:
   scaleTargetRef: { apiVersion: apps/v1, kind: Deployment, name: {{ $name }} }
   minReplicas: {{ .min }}
@@ -81,6 +85,8 @@ kind: PodDisruptionBudget
 metadata:
   name: {{ $name }}
   namespace: {{ include "planpal.namespace" $ }}
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
 spec:
   maxUnavailable: {{ .maxUnavailable }}
   selector:

planpalto-helm/templates/ingress.yaml

@@ -5,7 +5,7 @@ metadata:
   name: planpal
   namespace: {{ include "planpal.namespace" . }}
   annotations:
-    argocd.argoproj.io/sync-wave: "2"
+    argocd.argoproj.io/sync-wave: "3"
     alb.ingress.kubernetes.io/scheme: internet-facing
     alb.ingress.kubernetes.io/target-type: ip
     alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80},{"HTTPS":443}]'

planpalto-helm/templates/seed-job.yaml

@@ -5,7 +5,7 @@ metadata:
   name: seed-admin
   namespace: {{ include "planpal.namespace" . }}
   annotations:
-    argocd.argoproj.io/sync-wave: "3"
+    argocd.argoproj.io/sync-wave: "4"
     # Argo re-runs a Job by hash; a spec change makes a new Job. Delete the old
     # one before sync if it lingers, or set this to a Sync hook if you want it
     # to run every sync. ponytail: kept as a plain waved object, not a hook.