From f8136f4e1e2284d90d6041f8ab1338f2f4b8e025 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Wed, 19 Aug 2026 22:43:29 -0700
Subject: [PATCH] fix: ignore Reloader's injected env var on the Forgejo
 Deployment

Argo would otherwise strip STAKATER_* on each sync and fight Reloader for it,
recreating the forge pod every reconcile.
---
 k8s/argocd/apps/30-security.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/k8s/argocd/apps/30-security.yaml b/k8s/argocd/apps/30-security.yaml
index c57fc99..951d6fd 100644
--- a/k8s/argocd/apps/30-security.yaml
+++ b/k8s/argocd/apps/30-security.yaml
@@ -115,6 +115,16 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: cicd
+  # Reloader injects a STAKATER_* env var carrying a hash of the config Secret,
+  # so the pod rolls when that Secret changes. The chart does not render it, so
+  # Argo would strip it on every sync — and with selfHeal on, Argo and Reloader
+  # would fight over the field and Recreate the forge each round.
+  ignoreDifferences:
+    - group: apps
+      kind: Deployment
+      name: forgejo-gitea
+      jqPathExpressions:
+        - '.spec.template.spec.containers[].env[] | select(.name | startswith("STAKATER_"))'
   syncPolicy:
     syncOptions:
       # Adopt the objects the bootstrap Helm release already created rather