fix(longhorn): clear permanent OutOfSync on longhorn-config

StorageClass.parameters is immutable and mkfsParams was added after creation,
so every sync failed. Replace=true recreates it instead of patching. Existing
volumes keep their format; only new ones get mkfsParams.

Longhorn names its own disk key and writes storageReserved into it, so git's
default-disk never matched and selfHeal kept trying to add a second disk on the
same path. Dropped spec.disks from git, added ignoreDifferences.

k8s/argocd/apps/10-storage-observability.yaml

@@ -72,6 +72,14 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: longhorn-system
+  # Longhorn writes disk state back into its own Node CRs — the disk key it
+  # generates, storageReserved, diskType, evictionRequested. Git declares only
+  # allowScheduling; without this the controller's writes read as drift forever.
+  ignoreDifferences:
+    - group: longhorn.io
+      kind: Node
+      jsonPointers:
+        - /spec/disks
   syncPolicy:
     automated:
       prune: true

k8s/infra/longhorn/longhorn-cnpg-storageclass.yaml

@@ -7,6 +7,22 @@ metadata:
   namespace: longhorn-system
   annotations:
     storageclass.kubernetes.io/is-default-class: "false"
+    # StorageClass.parameters is immutable. mkfsParams below was added after
+    # this class already existed, so every sync failed with
+    #   parameters: Invalid value: {...}: field is immutable
+    # and the Application sat OutOfSync permanently — ArgoCD retrying a change
+    # the API server can never accept.
+    #
+    # Replace=true makes ArgoCD delete and recreate instead of patching. Safe
+    # for a StorageClass: it is consulted only at provisioning time, so bound
+    # PVs and their data are untouched. New PVCs briefly fail if one is created
+    # during the window.
+    #
+    # Note what this does NOT do: the nine CNPG volumes already provisioned were
+    # formatted without mkfsParams and keep that format. Only volumes created
+    # after this recreate get it. Existing volumes that need to expand still
+    # need handling separately.
+    argocd.argoproj.io/sync-options: Replace=true,Force=true
 provisioner: driver.longhorn.io
 allowVolumeExpansion: true
 parameters:

k8s/infra/longhorn/longhorn-nodes.yaml

@@ -1,6 +1,16 @@
 # Longhorn Node CRDs for cp-2 and cp-3.
 # These nodes have the control-plane taint, so Longhorn doesn't auto-discover them.
 # Explicit Node CRDs + the taint-toleration setting enable storage across all 3 nodes.
+#
+# `spec.disks` is deliberately absent. Longhorn owns disk identity: it names the
+# entry itself (`default-disk-080400000000`, not `default-disk`) and writes
+# `storageReserved`, `diskType` and `evictionRequested` into it. Declaring a
+# `default-disk` key here never matched the live one, so the Application sat
+# OutOfSync and selfHeal kept trying to add a SECOND disk record pointing at the
+# same /var/lib/longhorn path — which is worse than the drift it was fixing.
+#
+# What these objects are actually for is `allowScheduling: true` on tainted
+# control-plane nodes. That is all they need to declare.
 ---
 apiVersion: longhorn.io/v1beta2
 kind: Node
@@ -10,12 +20,6 @@ metadata:
 spec:
   name: talos-cp-2
   allowScheduling: true
-  disks:
-    default-disk:
-      allowScheduling: true
-      path: /var/lib/longhorn
-      storageReserved: 0
-      tags: []
   tags: []
 ---
 apiVersion: longhorn.io/v1beta2
@@ -26,10 +30,4 @@ metadata:
 spec:
   name: talos-cp-3
   allowScheduling: true
-  disks:
-    default-disk:
-      allowScheduling: true
-      path: /var/lib/longhorn
-      storageReserved: 0
-      tags: []
   tags: []