From f53d54cba9fcbb1ccdb0e63203943ec23663a117 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Wed, 12 Aug 2026 13:28:24 -0700
Subject: [PATCH] =?UTF-8?q?fix(argocd):=20disable=20automated=20sync=20on?=
 =?UTF-8?q?=20cert-manager-issuers=20=E2=80=94=20directory.include=20rende?=
 =?UTF-8?q?rs=20empty,=20automated=20prune=20was=20wiping=20ClusterIssuers?=
 =?UTF-8?q?=20+=20homelab-ca=20ConfigMaps;=20manual=20sync=20until=20rende?=
 =?UTF-8?q?r=20root-caused?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 k8s/argocd/apps/00-substrate.yaml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/k8s/argocd/apps/00-substrate.yaml b/k8s/argocd/apps/00-substrate.yaml
index 3c6ee77..50d742f 100644
--- a/k8s/argocd/apps/00-substrate.yaml
+++ b/k8s/argocd/apps/00-substrate.yaml
@@ -95,9 +95,12 @@ spec:
     server: https://kubernetes.default.svc
     namespace: cert-manager
   syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
+    # automated sync intentionally disabled: ArgoCD directory.include renders
+    # this app's resources as EMPTY (root cause under investigation), so an
+    # automated prune wipes the ClusterIssuers + homelab-ca ConfigMaps. Keep
+    # manual until the render is fixed, then restore prune/selfHeal.
+    syncOptions:
+      - CreateNamespace=true
 ---
 # Consolidated: wildcard-cert + homelab-ingress → ingress-config
 # Manages both the wildcard TLS certificate and all Ingress rules.