Output:
Name:                   external-secrets
Namespace:              external-secrets
CreationTimestamp:      Tue, 16 Jun 2026 23:20:33 +0200
Labels:                 app.kubernetes.io/instance=<redacted>
                        app.kubernetes.io/managed-by=Helm
                        app.kubernetes.io/name=<redacted>
                        app.kubernetes.io/version=v0.10.5
                        helm.sh/chart=<redacted>
Annotations:            argocd.argoproj.io/tracking-id: platform-external-secrets:apps/Deployment:external-secrets/external-secrets
                        deployment.kubernetes.io/revision: 2
Selector:               app.kubernetes.io/instance=external-secrets,app.kubernetes.io/name=<redacted>
Replicas:               1 desired | 1 updated | 1 total | 1 available | 0 unavailable
StrategyType:           RollingUpdate
MinReadySeconds:        0
RollingUpdateStrategy:  25% max unavailable, 25% max surge
Pod Template:
  Labels:           app.kubernetes.io/instance=<redacted>
                    app.kubernetes.io/managed-by=Helm
                    app.kubernetes.io/name=<redacted>
                    app.kubernetes.io/version=v0.10.5
                    helm.sh/chart=<redacted>
  Service Account:  external-secrets
  Containers:
   external-secrets:
    Image:           oci.external-secrets.io/external-secrets/external-secrets:v0.10.5
    Port:            8080/TCP
    Host Port:       0/TCP
    SeccompProfile:  RuntimeDefault
    Args:
      --concurrent=1
      --metrics-addr=:8080
      --loglevel=info
      --zap-time-encoding=epoch
    Environment:  <none>
    Mounts:       <none>
  Volumes:        <none>
Conditions:
  Type           Status  Reason
  ----           ------  ------
  Progressing    True    NewReplicaSetAvailable
  Available      True    MinimumReplicasAvailable
OldReplicaSets:  external-secrets-85ff6cd96 (0/0 replicas created)
NewReplicaSet:   external-secrets-748f44c8b8 (1/1 replicas created)
Events:          <none>

Name:                   external-secrets-webhook
Namespace:              external-secrets
CreationTimestamp:      Tue, 16 Jun 2026 23:20:33 +0200
Labels:                 app.kubernetes.io/instance=<redacted>
                        app.kubernetes.io/managed-by=Helm
                        app.kubernetes.io/name=<redacted>
                        app.kubernetes.io/version=v0.10.5
                        helm.sh/chart=<redacted>
Annotations:            argocd.argoproj.io/tracking-id: platform-external-secrets:apps/Deployment:external-secrets/external-secrets-webhook
                        deployment.kubernetes.io/revision: 2
Selector:               app.kubernetes.io/instance=external-secrets,app.kubernetes.io/name=<redacted>
Replicas:               1 desired | 1 updated | 1 total | 1 available | 0 unavailable
StrategyType:           RollingUpdate
MinReadySeconds:        0
RollingUpdateStrategy:  25% max unavailable, 25% max surge
Pod Template:
  Labels:           app.kubernetes.io/instance=<redacted>
                    app.kubernetes.io/managed-by=Helm
                    app.kubernetes.io/name=<redacted>
                    app.kubernetes.io/version=v0.10.5
                    helm.sh/chart=<redacted>
  Service Account:  external-secrets-webhook
  Containers:
   webhook:
    Image:           oci.external-secrets.io/external-secrets/external-secrets:v0.10.5
    Ports:           8080/TCP, 10250/TCP
    Host Ports:      0/TCP, 0/TCP
    SeccompProfile:  RuntimeDefault
    Args:
      webhook
      --port=10250
      --dns-name=<redacted>
      --cert-dir=/tmp/certs
      --check-interval=5m
      --metrics-addr=:8080
      --healthz-addr=:8081
      --loglevel=info
      --zap-time-encoding=epoch
    Readiness:    http-get http://:8081/readyz delay=20s timeout=1s period=5s #success=1 #failure=3
    Environment:  <none>
    Mounts:
      /tmp/certs from certs (ro)
  Volumes:
   certs:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  external-secrets-webhook
    Optional:    false
Conditions:
  Type           Status  Reason
  ----           ------  ------
  Progressing    True    NewReplicaSetAvailable
  Available      True    MinimumReplicasAvailable
OldReplicaSets:  external-secrets-webhook-bb8f8559 (0/0 replicas created)
NewReplicaSet:   external-secrets-webhook-6d44f5546c (1/1 replicas created)
Events:          <none>

Name:                   external-secrets-cert-controller
Namespace:              external-secrets
CreationTimestamp:      Tue, 16 Jun 2026 23:20:33 +0200
Labels:                 app.kubernetes.io/instance=<redacted>
                        app.kubernetes.io/managed-by=Helm
                        app.kubernetes.io/name=<redacted>
                        app.kubernetes.io/version=v0.10.5
                        helm.sh/chart=<redacted>
Annotations:            argocd.argoproj.io/tracking-id: platform-external-secrets:apps/Deployment:external-secrets/external-secrets-cert-controller
                        deployment.kubernetes.io/revision: 2
Selector:               app.kubernetes.io/instance=external-secrets,app.kubernetes.io/name=<redacted>
Replicas:               1 desired | 1 updated | 1 total | 1 available | 0 unavailable
StrategyType:           RollingUpdate
MinReadySeconds:        0
RollingUpdateStrategy:  25% max unavailable, 25% max surge
Pod Template:
  Labels:           app.kubernetes.io/instance=<redacted>
                    app.kubernetes.io/managed-by=Helm
                    app.kubernetes.io/name=<redacted>
                    app.kubernetes.io/version=v0.10.5
                    helm.sh/chart=<redacted>
  Service Account:  external-secrets-cert-controller
  Containers:
   cert-controller:
    Image:           oci.external-secrets.io/external-secrets/external-secrets:v0.10.5
    Port:            8080/TCP
    Host Port:       0/TCP
    SeccompProfile:  RuntimeDefault
    Args:
      certcontroller
      --crd-requeue-interval=5m
      --service-name=<redacted>
      --service-namespace=<redacted>
      --secret-name=<redacted>
      --secret-namespace=<redacted>
      --metrics-addr=:8080
      --healthz-addr=:8081
      --loglevel=info
      --zap-time-encoding=epoch
      --enable-partial-cache=true
    Readiness:    http-get http://:8081/readyz delay=20s timeout=1s period=5s #success=1 #failure=3
    Environment:  <none>
    Mounts:       <none>
  Volumes:        <none>
Conditions:
  Type           Status  Reason
  ----           ------  ------
  Progressing    True    NewReplicaSetAvailable
  Available      True    MinimumReplicasAvailable
OldReplicaSets:  external-secrets-cert-controller-5cdb9f68d9 (0/0 replicas created)
NewReplicaSet:   external-secrets-cert-controller-546f7fc68f (1/1 replicas created)
Events:          <none>


bash

/bin/bash -lc "ssh -i /home/node/.ssh/kube-bot-it15-ed25519 Misla@192.168.1.121 'wsl.exe -d Ubuntu -- bash -s' <<'REMOTE'
kubectl -n argocd get application platform-external-secrets -o json | python3 - <<'PY'
import sys,json
app=json.load(sys.stdin)
for r in app.get('status',{}).get('resources',[]):
    h=r.get('health') or {}
    status=h.get('status')
    if status and status not in ('Healthy',):
        print(r.get('kind'), r.get('namespace',''), r.get('name'), 'sync='+str(r.get('status')), 'health='+str(status), 'msg='+str(h.get('message','')))
PY
REMOTE"


Output:
Traceback (most recent call last):
  File "<stdin>", line 2, in <module>
  File "/usr/lib/python3.14/json/__init__.py", line 298, in load
    return loads(fp.read(),
        cls=cls, object_hook=object_hook,
        parse_float=parse_float, parse_int=parse_int,
        parse_constant=parse_constant, object_pairs_hook=object_pairs_hook, **kw)
  File "/usr/lib/python3.14/json/__init__.py", line 352, in loads
    return _default_decoder.decode(s)
           ~~~~~~~~~~~~~~~~~~~~~~~^^^
  File "/usr/lib/python3.14/json/decoder.py", line 345, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
               ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.14/json/decoder.py", line 363, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)


/bin/bash -lc "set -euo pipefail
ssh -i /home/node/.ssh/kube-bot-it15-ed25519 Misla@192.168.1.121 'wsl.exe -d Ubuntu -- kubectl -n argocd get application platform-external-secrets -o json' > /home/node/.openclaw/workspace/tmp/platform-external-secrets-app.json
python3 - <<'PY'
import json
app=json.load(open('/home/node/.openclaw/workspace/tmp/platform-external-secrets-app.json'))
print('app health:', app.get('status',{}).get('health',{}))
for r in app.get('status',{}).get('resources',[]):
    h=r.get('health') or {}
    status=h.get('status')
    if status and status not in ('Healthy',):
        print(r.get('kind'), r.get('namespace',''), r.get('name'), 'sync='+str(r.get('status')), 'health='+str(status), 'msg='+str(h.get('message','')))
PY"


Output: app health: {'lastTransitionTime': '2026-06-18T20:23:10Z', 'status': 'Degraded'}


/bin/bash -lc "python3 - <<'PY'
import json
app=json.load(open('/home/node/.openclaw/workspace/tmp/platform-external-secrets-app.json'))
for key in ['conditions','summary','sync','operationState','reconciledAt']:
    print('\\n--',key,'--')
    print(json.dumps(app.get('status',{}).get(key), indent=2)[:5000])
PY"


Output:
-- conditions --
null

-- summary --
{
  "images": [
    "oci.external-secrets.io/external-secrets/external-secrets:v0.10.5"
  ]
}

-- sync --
{
  "comparedTo": {
    "destination": {
      "namespace": "external-secrets",
      "server": "https://192.168.20.40:6443"
    },
    "source": {
      "chart": "external-secrets",
      "helm": {
        "releaseName": "external-secrets",
        "values": "installCRDs: true\n"
      },
      "repoURL": "https://charts.external-secrets.io",
      "targetRevision": "0.10.5"
    }
  },
  "revision": "0.10.5",
  "status": "Synced"
}

-- operationState --
{
  "finishedAt": "2026-06-16T22:01:20Z",
  "message": "successfully synced (all tasks run)",
  "operation": {
    "initiatedBy": {
      "automated": true
    },
    "retry": {
      "limit": 5
    },
    "sync": {
      "autoHealAttemptsCount": 1,
      "resources": [
        {
          "group": "apiextensions.k8s.io",
          "kind": "CustomResourceDefinition",
          "name": "externalsecrets.external-secrets.io"
        },
        {
          "group": "apiextensions.k8s.io",
          "kind": "CustomResourceDefinition",
          "name": "secretstores.external-secrets.io"
        },
        {
          "group": "apiextensions.k8s.io",
          "kind": "CustomResourceDefinition",
          "name": "clustersecretstores.external-secrets.io"
        }
      ],
      "revision": "0.10.5",
      "source": {
        "chart": "external-secrets",
        "helm": {
          "releaseName": "external-secrets",
          "values": "installCRDs: true\n"
        },
        "repoURL": "https://charts.external-secrets.io",
        "targetRevision": "0.10.5"
      },
      "syncOptions": [
        "CreateNamespace=true",
        "ServerSideApply=true"
      ]
    }
  },
  "phase": "Succeeded",
  "startedAt": "2026-06-16T22:01:19Z",
  "syncResult": {
    "resources": [
      {
        "group": "apiextensions.k8s.io",
        "hookPhase": "Running",
        "kind": "CustomResourceDefinition",
        "message": "customresourcedefinition.apiextensions.k8s.io/externalsecrets.external-secrets.io serverside-applied",
        "name": "externalsecrets.external-secrets.io",
        "namespace": "external-secrets",
        "status": "Synced",
        "syncPhase": "Sync",
        "version": "v1"
      },
      {
        "group": "apiextensions.k8s.io",
        "hookPhase": "Running",
        "kind": "CustomResourceDefinition",
        "message": "customresourcedefinition.apiextensions.k8s.io/clustersecretstores.external-secrets.io serverside-applied",
        "name": "clustersecretstores.external-secrets.io",
        "namespace": "external-secrets",
        "status": "Synced",
        "syncPhase": "Sync",
        "version": "v1"
      },
      {
        "group": "apiextensions.k8s.io",
        "hookPhase": "Running",
        "kind": "CustomResourceDefinition",
        "message": "customresourcedefinition.apiextensions.k8s.io/secretstores.external-secrets.io serverside-applied",
        "name": "secretstores.external-secrets.io",
        "namespace": "external-secrets",
        "status": "Synced",
        "syncPhase": "Sync",
        "version": "v1"
      }
    ],
    "revision": "0.10.5",
    "source": {
      "chart": "external-secrets",
      "helm": {
        "releaseName": "external-secrets",
        "values": "installCRDs: true\n"
      },
      "repoURL": "https://charts.external-secrets.io",
      "targetRevision": "0.10.5"
    }
  }
}

-- reconciledAt --
"2026-06-18T20:26:54Z"


/bin/bash -lc "find /home/node/.openclaw/workspace/repos/platform-gitops -type f -maxdepth 5 | sort | xargs grep -n \"platform-external-secrets\\|targetRevision: 0.10.5\\|targetRevision: 0.20.4\\|charts.external-secrets.io\" 2>/dev/null"


Output:
/home/node/.openclaw/workspace/repos/platform-gitops/applications/platform/external-secrets.yaml:4:  name: platform-external-secrets
/home/node/.openclaw/workspace/repos/platform-gitops/applications/platform/external-secrets.yaml:9:    repoURL: https://charts.external-secrets.io
/home/node/.openclaw/workspace/repos/platform-gitops/applications/platform/external-secrets.yaml:11:    targetRevision: 0.10.5
/home/node/.openclaw/workspace/repos/platform-gitops/clusters/it15-mgmt/argocd/projects/platform.yaml:11:    - https://charts.external-secrets.io


/bin/bash -lc "ssh -i /home/node/.ssh/kube-bot-it15-ed25519 Misla@192.168.1.121 'wsl.exe -d Ubuntu -- bash -s' <<'REMOTE'
kubectl -n argocd logs statefulset/argocd-application-controller --tail=300 | grep -i 'platform-external-secrets\\|external-secrets' | tail -n 80 || true
REMOTE"


Output:
{"app-namespace":"argocd","application":"platform-external-secrets","level":"info","msg":"Refreshing app status (hard refresh requested), level (3)","project":"platform","time":"2026-06-18T20:24:28Z"}
{"app-namespace":"argocd","application":"platform-external-secrets","level":"info","msg":"Comparing app state (cluster: https://192.168.20.40:6443, namespace: external-secrets)","project":"platform","time":"2026-06-18T20:24:28Z"}
{"app-namespace":"argocd","application":"platform-external-secrets","build_options_ms":0,"level":"info","manifests_ms":1056,"msg":"GetRepoObjs stats","plugins_ms":0,"project":"platform","repo_ms":0,"time":"2026-06-18T20:24:29Z","time_ms":1056}
{"app-namespace":"argocd","application":"platform-external-secrets","level":"info","msg":"Skipping auto-sync: application status is Synced","project":"platform","time":"2026-06-18T20:24:29Z"}
{"app-namespace":"argocd","application":"platform-external-secrets","level":"info","msg":"Update successful","project":"platform","time":"2026-06-18T20:24:29Z"}
{"app-namespace":"argocd","app_status_update_ms":0,"application":"platform-external-secrets","auto_sync_ms":0,"compare_app_state_ms":1111,"comparison-level":3,"comparison_with_nothing_ms":0,"dedup_ms":0,"dest-name":"","dest-namespace":"external-secrets","dest-server":"https://192.168.20.40:6443","diff_ms":48,"git_ms":1057,"health_ms":3,"level":"info","live_ms":0,"msg":"Reconciliation completed","normalize_application_ms":0,"patch_ms":8,"persist_app_status_ms":8,"process_finalizers_ms":0,"project":"platform","refresh_app_conditions_ms":0,"set_app_managed_resources_ms":22,"setop_ms":0,"settings_ms":0,"sync_ms":0,"time":"2026-06-18T20:24:29Z","time_ms":1142}
{"app-namespace":"argocd","application":"platform-external-secrets","level":"info","msg":"Refreshing app status (comparison expired, requesting refresh. reconciledAt: 2026-06-18 20:24:28 +0000 UTC, expiry: 2m0s), level (2)","project":"platform","time":"2026-06-18T20:26:54Z"}
{"app-namespace":"argocd","application":"platform-external-secrets","level":"info","msg":"Comparing app state (cluster: https://192.168.20.40:6443, namespace: external-secrets)","project":"platform","time":"2026-06-18T20:26:54Z"}
{"app-namespace":"argocd","application":"platform-external-secrets","build_options_ms":0,"level":"info","manifests_ms":17,"msg":"GetRepoObjs stats","plugins_ms":0,"project":"platform","repo_ms":0,"time":"2026-06-18T20:26:54Z","time_ms":17}
{"app-namespace":"argocd","application":"platform-external-secrets","level":"info","msg":"Skipping auto-sync: application status is Synced","project":"platform","time":"2026-06-18T20:26:54Z"}
{"app-namespace":"argocd","application":"platform-external-secrets","level":"info","msg":"Update successful","project":"platform","time":"2026-06-18T20:26:54Z"}
{"app-namespace":"argocd","app_status_update_ms":0,"application":"platform-external-secrets","auto_sync_ms":0,"compare_app_state_ms":73,"comparison-level":2,"comparison_with_nothing_ms":0,"dedup_ms":0,"dest-name":"","dest-namespace":"external-secrets","dest-server":"https://192.168.20.40:6443","diff_ms":50,"git_ms":17,"health_ms":4,"level":"info","live_ms":0,"msg":"Reconciliation completed","normalize_application_ms":0,"patch_ms":10,"persist_app_status_ms":10,"process_finalizers_ms":0,"project":"platform","refresh_app_conditions_ms":0,"set_app_managed_resources_ms":22,"setop_ms":0,"settings_ms":0,"sync_ms":0,"time":"2026-06-18T20:26:54Z","time_ms":107}


/bin/bash -lc "ssh -i /home/node/.ssh/kube-bot-it15-ed25519 kube-bot@192.168.20.40 \"sudo kubectl --kubeconfig=<redacted> get crd | grep -E 'external-secrets|generators' | awk '{print "'$1}'"' | xargs -r sudo kubectl --kubeconfig=<redacted> get crd -o jsonpath='{range .items[*]}{.metadata.name}{\\\" \\\"}{range .status.conditions[*]}{.type}={.status}:{.reason} {end}{\\\"\\\\n\\\"}{end}'\""


/bin/bash -lc 'ssh -i /home/node/.ssh/kube-bot-it15-ed25519 kube-bot@192.168.20.40 "sudo kubectl --kubeconfig=<redacted> get validatingwebhookconfiguration externalsecret-validate secretstore-validate -o yaml"'


/bin/bash -lc "ssh -i /home/node/.ssh/kube-bot-it15-ed25519 Misla@192.168.1.121 'wsl.exe -d Ubuntu -- bash -s' <<'REMOTE'
kubectl -n argocd get cm argocd-cm -o yaml | grep -A80 -E 'resource.customizations|health' || true
REMOTE"


Output:
apiVersion: v1
items:
- apiVersion: admissionregistration.k8s.io/v1
  kind: ValidatingWebhookConfiguration
  metadata:
    annotations:
      argocd.argoproj.io/tracking-id: platform-external-secrets:admissionregistration.k8s.io/ValidatingWebhookConfiguration:external-secrets/externalsecret-validate
    creationTimestamp: "2026-06-16T21:20:33Z"
    generation: 3
    labels:
      external-secrets.io/component: webhook
    name: externalsecret-validate
    resourceVersion: "87326665"
    uid: 8f18f381-c4b7-45a1-87d7-3704bb1c2c95
  webhooks:
  - admissionReviewVersions:
    - v1
    - v1beta1
    clientConfig:
      caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURSakNDQWk2Z0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREEyTVJrd0Z3WURWUVFLRXhCbGVIUmwKY201aGJDMXpaV055WlhSek1Sa3dGd1lEVlFRREV4QmxlSFJsY201aGJDMXpaV055WlhSek1CNFhEVEkyTURZeApOakl3TWpBMU1Wb1hEVE0yTURZeE16SXhNakExTVZvd05qRVpNQmNHQTFVRUNoTVFaWGgwWlhKdVlXd3RjMlZqCmNtVjBjekVaTUJjR0ExVUVBeE1RWlhoMFpYSnVZV3d0YzJWamNtVjBjekNDQVNJd0RRWUpLb1pJaHZjTkFRRUIKQlFBRGdnRVBBRENDQVFvQ2dnRUJBTEtCVmRxTHZ1Y1FmeHZHTmVjUHE3V0dvOHpyZFZUL09BWXdMQkNnS1lYdgpzdTh0OXBIdUM0VjV5QWR0eXgzUXRjSENPUVVGbmcxNTM2MjYvbzZPRE5TcmdLOUJ4ZkpDL0dva1VyN3ppWWRECnFLTWE5WnlIQTJuRE5RcnNuYU0xTWE2WUxsaVVyQnFMWHNwVEJKWjYzNTlYc2dqTkVpTUpvOVVzQjUwRWFhZzEKUlR0K0FTcDA0cm1uZ2ZxUjRVRTdPNEtiMi9CZjBWQUhZNCtTUis4c3lRdjZQeHVKUFJOL1ZZcnBzblp3RTRIVwpNKzNwdlZmWldNRmFmWFgvcXk0c1RuVzFmT3ZpV1JzZnZVWVVicnlvbDlwYXB5K2xnenJkSkdabldrWENxWWNMCld2S3d6ZTc1dVBsWkJMWThNVURZZjBtaFlFajA1QWJvMFJOMnhaMnQxa2tDQXdFQUFhTmZNRjB3RGdZRFZSMFAKQVFIL0JBUURBZ0trTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkNlWkhyZXplOTdOc2VnRgplK2d0ZEg3NEZsaVpNQnNHQTFVZEVRUVVNQktDRUdWNGRHVnlibUZzTFhObFkzSmxkSE13RFFZSktvWklodmNOCkFRRUxCUUFEZ2dFQkFKbnN5RW0veGh4a2RkSkxCSGdwd0tvb0Q0SVE0WkptVkVjSGV0YmxPTitSZGNJU0ZERzMKNVNPL2lOTGFRNlducVovemEzc09TZWx3YS9aZzNWeVBBMFFXOXlWdFJBRDZMSmNGZW1pUUhsSmZYZ0xLdXk3KwowaFBNRFJYcStRNDl2ckduZXhFQWRwdzNudmRmdFB4Ry9nUlQ4SXd2ckI4K2MwWFNNMnljUEdvWjBIa0ZXMFZQCm15Ykpzajl2SkJFNFkyUUZRWEZXWDhyK1ZKZ2h1U2FhSXlhaXZJQ0dmajV4UjJBbFRpcDZSTFlDTjRRS0lFSVEKS01LRU1pZEdvaXZrajlxajkyK1ZraitNdzdPZWF6M01hSEFEamhlSSt0azM4KzY3NU0rOTFuRDR4c0lCVXl0SQptMkxNUm54M3ZWZ2JNeVRaWnpubCtiUThKQ21ISi9nLzJJbz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
      service:
        name: external-secrets-webhook
        namespace: external-secrets
        path: /validate-external-secrets-io-v1beta1-externalsecret
        port: 443
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validate.externalsecret.external-secrets.io
    namespaceSelector: {}
    objectSelector: {}
    rules:
    - apiGroups:
      - external-secrets.io
      apiVersions:
      - v1beta1
      operations:
      - CREATE
      - UPDATE
      - DELETE
      resources:
      - externalsecrets
      scope: Namespaced
    sideEffects: None
    timeoutSeconds: 5
- apiVersion: admissionregistration.k8s.io/v1
  kind: ValidatingWebhookConfiguration
  metadata:
    annotations:
      argocd.argoproj.io/tracking-id: platform-external-secrets:admissionregistration.k8s.io/ValidatingWebhookConfiguration:external-secrets/secretstore-validate
    creationTimestamp: "2026-06-16T21:20:33Z"
    generation: 3
    labels:
      external-secrets.io/component: webhook
    name: secretstore-validate
    resourceVersion: "87326669"
    uid: 18b45f0a-d4a9-4e08-9f5a-d1037101af83
  webhooks:
  - admissionReviewVersions:
    - v1
    - v1beta1
    clientConfig:
      caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURSakNDQWk2Z0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREEyTVJrd0Z3WURWUVFLRXhCbGVIUmwKY201aGJDMXpaV055WlhSek1Sa3dGd1lEVlFRREV4QmxlSFJsY201aGJDMXpaV055WlhSek1CNFhEVEkyTURZeApOakl3TWpBMU1Wb1hEVE0yTURZeE16SXhNakExTVZvd05qRVpNQmNHQTFVRUNoTVFaWGgwWlhKdVlXd3RjMlZqCmNtVjBjekVaTUJjR0ExVUVBeE1RWlhoMFpYSnVZV3d0YzJWamNtVjBjekNDQVNJd0RRWUpLb1pJaHZjTkFRRUIKQlFBRGdnRVBBRENDQVFvQ2dnRUJBTEtCVmRxTHZ1Y1FmeHZHTmVjUHE3V0dvOHpyZFZUL09BWXdMQkNnS1lYdgpzdTh0OXBIdUM0VjV5QWR0eXgzUXRjSENPUVVGbmcxNTM2MjYvbzZPRE5TcmdLOUJ4ZkpDL0dva1VyN3ppWWRECnFLTWE5WnlIQTJuRE5RcnNuYU0xTWE2WUxsaVVyQnFMWHNwVEJKWjYzNTlYc2dqTkVpTUpvOVVzQjUwRWFhZzEKUlR0K0FTcDA0cm1uZ2ZxUjRVRTdPNEtiMi9CZjBWQUhZNCtTUis4c3lRdjZQeHVKUFJOL1ZZcnBzblp3RTRIVwpNKzNwdlZmWldNRmFmWFgvcXk0c1RuVzFmT3ZpV1JzZnZVWVVicnlvbDlwYXB5K2xnenJkSkdabldrWENxWWNMCld2S3d6ZTc1dVBsWkJMWThNVURZZjBtaFlFajA1QWJvMFJOMnhaMnQxa2tDQXdFQUFhTmZNRjB3RGdZRFZSMFAKQVFIL0JBUURBZ0trTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkNlWkhyZXplOTdOc2VnRgplK2d0ZEg3NEZsaVpNQnNHQTFVZEVRUVVNQktDRUdWNGRHVnlibUZzTFhObFkzSmxkSE13RFFZSktvWklodmNOCkFRRUxCUUFEZ2dFQkFKbnN5RW0veGh4a2RkSkxCSGdwd0tvb0Q0SVE0WkptVkVjSGV0YmxPTitSZGNJU0ZERzMKNVNPL2lOTGFRNlducVovemEzc09TZWx3YS9aZzNWeVBBMFFXOXlWdFJBRDZMSmNGZW1pUUhsSmZYZ0xLdXk3KwowaFBNRFJYcStRNDl2ckduZXhFQWRwdzNudmRmdFB4Ry9nUlQ4SXd2ckI4K2MwWFNNMnljUEdvWjBIa0ZXMFZQCm15Ykpzajl2SkJFNFkyUUZRWEZXWDhyK1ZKZ2h1U2FhSXlhaXZJQ0dmajV4UjJBbFRpcDZSTFlDTjRRS0lFSVEKS01LRU1pZEdvaXZrajlxajkyK1ZraitNdzdPZWF6M01hSEFEamhlSSt0azM4KzY3NU0rOTFuRDR4c0lCVXl0SQptMkxNUm54M3ZWZ2JNeVRaWnpubCtiUThKQ21ISi9nLzJJbz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
      service:
        name: external-secrets-webhook
        namespace: external-secrets
        path: /validate-external-secrets-io-v1beta1-secretstore
        port: 443
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validate.secretstore.external-secrets.io
    namespaceSelector: {}
    objectSelector: {}
    rules:
    - apiGroups:
      - external-secrets.io
      apiVersions:
      - v1beta1
      operations:
      - CREATE
      - UPDATE
      - DELETE
      resources:
      - secretstores
      scope: Namespaced
    sideEffects: None
    timeoutSeconds: 5
  - admissionReviewVersions:
    - v1
    - v1beta1
    clientConfig:
      caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURSakNDQWk2Z0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREEyTVJrd0Z3WURWUVFLRXhCbGVIUmwKY201aGJDMXpaV055WlhSek1Sa3dGd1lEVlFRREV4QmxlSFJsY201aGJDMXpaV055WlhSek1CNFhEVEkyTURZeApOakl3TWpBMU1Wb1hEVE0yTURZeE16SXhNakExTVZvd05qRVpNQmNHQTFVRUNoTVFaWGgwWlhKdVlXd3RjMlZqCmNtVjBjekVaTUJjR0ExVUVBeE1RWlhoMFpYSnVZV3d0YzJWamNtVjBjekNDQVNJd0RRWUpLb1pJaHZjTkFRRUIKQlFBRGdnRVBBRENDQVFvQ2dnRUJBTEtCVmRxTHZ1Y1FmeHZHTmVjUHE3V0dvOHpyZFZUL09BWXdMQkNnS1lYdgpzdTh0OXBIdUM0VjV5QWR0eXgzUXRjSENPUVVGbmcxNTM2MjYvbzZPRE5TcmdLOUJ4ZkpDL0dva1VyN3ppWWRECnFLTWE5WnlIQTJuRE5RcnNuYU0xTWE2WUxsaVVyQnFMWHNwVEJKWjYzNTlYc2dqTkVpTUpvOVVzQjUwRWFhZzEKUlR0K0FTcDA0cm1uZ2ZxUjRVRTdPNEtiMi9CZjBWQUhZNCtTUis4c3lRdjZQeHVKUFJOL1ZZcnBzblp3RTRIVwpNKzNwdlZmWldNRmFmWFgvcXk0c1RuVzFmT3ZpV1JzZnZVWVVicnlvbDlwYXB5K2xnenJkSkdabldrWENxWWNMCld2S3d6ZTc1dVBsWkJMWThNVURZZjBtaFlFajA1QWJvMFJOMnhaMnQxa2tDQXdFQUFhTmZNRjB3RGdZRFZSMFAKQVFIL0JBUURBZ0trTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkNlWkhyZXplOTdOc2VnRgplK2d0ZEg3NEZsaVpNQnNHQTFVZEVRUVVNQktDRUdWNGRHVnlibUZzTFhObFkzSmxkSE13RFFZSktvWklodmNOCkFRRUxCUUFEZ2dFQkFKbnN5RW0veGh4a2RkSkxCSGdwd0tvb0Q0SVE0WkptVkVjSGV0YmxPTitSZGNJU0ZERzMKNVNPL2lOTGFRNlducVovemEzc09TZWx3YS9aZzNWeVBBMFFXOXlWdFJBRDZMSmNGZW1pUUhsSmZYZ0xLdXk3KwowaFBNRFJYcStRNDl2ckduZXhFQWRwdzNudmRmdFB4Ry9nUlQ4SXd2ckI4K2MwWFNNMnljUEdvWjBIa0ZXMFZQCm15Ykpzajl2SkJFNFkyUUZRWEZXWDhyK1ZKZ2h1U2FhSXlhaXZJQ0dmajV4UjJBbFRpcDZSTFlDTjRRS0lFSVEKS01LRU1pZEdvaXZrajlxajkyK1ZraitNdzdPZWF6M01hSEFEamhlSSt0azM4KzY3NU0rOTFuRDR4c0lCVXl0SQptMkxNUm54M3ZWZ2JNeVRaWnpubCtiUThKQ21ISi9nLzJJbz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
      service:
        name: external-secrets-webhook
        namespace: external-secrets
        path: /validate-external-secrets-io-v1beta1-clustersecretstore
        port: 443
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validate.clustersecretstore.external-secrets.io
    namespaceSelector: {}
    objectSelector: {}
    rules:
    - apiGroups:
      - external-secrets.io
      apiVersions:
      - v1beta1
      operations:
      - CREATE
      - UPDATE
      - DELETE
      resources:
      - clustersecretstores
      scope: Cluster
    sideEffects: None
    timeoutSeconds: 5
kind: List
metadata:
  resourceVersion: ""


Output:
resource.customizations.ignoreResourceUpdates.ConfigMap: |
    jqPathExpressions:
      # Ignore the cluster-autoscaler status
      - '.metadata.annotations."cluster-autoscaler.kubernetes.io/last-updated"'
      # Ignore the annotation of the legacy Leases election
      - '.metadata.annotations."control-plane.alpha.kubernetes.io/leader"'
  resource.customizations.ignoreResourceUpdates.Endpoints: |
    jsonPointers:
      - /metadata
      - /subsets
  resource.customizations.ignoreResourceUpdates.all: |
    jsonPointers:
      - /status
  resource.customizations.ignoreResourceUpdates.apps_ReplicaSet: |
    jqPathExpressions:
      - '.metadata.annotations."deployment.kubernetes.io/desired-replicas"'
      - '.metadata.annotations."deployment.kubernetes.io/max-replicas"'
      - '.metadata.annotations."rollout.argoproj.io/desired-replicas"'
  resource.customizations.ignoreResourceUpdates.argoproj.io_Application: |
    jqPathExpressions:
      - '.metadata.annotations."notified.notifications.argoproj.io"'
      - '.metadata.annotations."argocd.argoproj.io/refresh"'
      - '.metadata.annotations."argocd.argoproj.io/hydrate"'
      - '.operation'
  resource.customizations.ignoreResourceUpdates.argoproj.io_Rollout: |
    jqPathExpressions:
      - '.metadata.annotations."notified.notifications.argoproj.io"'
  resource.customizations.ignoreResourceUpdates.autoscaling_HorizontalPodAutoscaler: |
    jqPathExpressions:
      - '.metadata.annotations."autoscaling.alpha.kubernetes.io/behavior"'
      - '.metadata.annotations."autoscaling.alpha.kubernetes.io/conditions"'
      - '.metadata.annotations."autoscaling.alpha.kubernetes.io/metrics"'
      - '.metadata.annotations."autoscaling.alpha.kubernetes.io/current-metrics"'
  resource.customizations.ignoreResourceUpdates.discovery.k8s.io_EndpointSlice: |
    jsonPointers:
      - /metadata
      - /endpoints
      - /ports
  resource.exclusions: |
    ### Network resources created by the Kubernetes control plane and excluded to reduce the number of watched events and UI clutter
    - apiGroups:
      - ''
      - discovery.k8s.io
      kinds:
      - Endpoints
      - EndpointSlice
    ### Internal Kubernetes resources excluded reduce the number of watched events
    - apiGroups:
      - coordination.k8s.io
      kinds:
      - Lease
    ### Internal Kubernetes Authz/Authn resources excluded reduce the number of watched events
    - apiGroups:
      - authentication.k8s.io
      - authorization.k8s.io
      kinds:
      - SelfSubjectReview
      - TokenReview
      - LocalSubjectAccessReview
      - SelfSubjectAccessReview
      - SelfSubjectRulesReview
      - SubjectAccessReview
    ### Intermediate Certificate Request excluded reduce the number of watched events
    - apiGroups:
      - certificates.k8s.io
      kinds:
      - CertificateSigningRequest
    - apiGroups:
      - cert-manager.io
      kinds:
      - CertificateRequest
    ### Cilium internal resources excluded reduce the number of watched events and UI Clutter
    - apiGroups:
      - cilium.io
      kinds:
      - CiliumIdentity
      - CiliumEndpoint
      - CiliumEndpointSlice
    ### Kyverno intermediate and reporting resources excluded reduce the number of watched events and improve performance
    - apiGroups:
      - kyverno.io
      - reports.kyverno.io
      - wgpolicyk8s.io
      kinds:
      - PolicyReport
      - ClusterPolicyReport
      - EphemeralReport
      - ClusterEphemeralReport
      - AdmissionReport
      - ClusterAdmissionReport
      - BackgroundScanReport
      - ClusterBackgroundScanReport
      - UpdateRequest
kind: ConfigMap
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","data":{"resource.customizations.ignoreResourceUpdates.ConfigMap":"jqPathExpressions:\n  # Ignore the cluster-autoscaler status\n  - '.metadata.annotations.\"cluster-autoscaler.kubernetes.io/last-updated\"'\n  # Ignore the annotation of the legacy Leases election\n  - '.metadata.annotations.\"control-plane.alpha.kubernetes.io/leader\"'\n","resource.customizations.ignoreResourceUpdates.Endpoints":"jsonPointers:\n  - /metadata\n  - /subsets\n","resource.customizations.ignoreResourceUpdates.all":"jsonPointers:\n  - /status\n","resource.customizations.ignoreResourceUpdates.apps_ReplicaSet":"jqPathExpressions:\n  - '.metadata.annotations.\"deployment.kubernetes.io/desired-replicas\"'\n  - '.metadata.annotations.\"deployment.kubernetes.io/max-replicas\"'\n  - '.metadata.annotations.\"rollout.argoproj.io/desired-replicas\"'\n","resource.customizations.ignoreResourceUpdates.argoproj.io_Application":"jqPathExpressions:\n  - '.metadata.annotations.\"notified.notifications.argoproj.io\"'\n  - '.metadata.annotations.\"argocd.argoproj.io/refresh\"'\n  - '.metadata.annotations.\"argocd.argoproj.io/hydrate\"'\n  - '.operation'\n","resource.customizations.ignoreResourceUpdates.argoproj.io_Rollout":"jqPathExpressions:\n  - '.metadata.annotations.\"notified.notifications.argoproj.io\"'\n","resource.customizations.ignoreResourceUpdates.autoscaling_HorizontalPodAutoscaler":"jqPathExpressions:\n  - '.metadata.annotations.\"autoscaling.alpha.kubernetes.io/behavior\"'\n  - '.metadata.annotations.\"autoscaling.alpha.kubernetes.io/conditions\"'\n  - '.metadata.annotations.\"autoscaling.alpha.kubernetes.io/metrics\"'\n  - '.metadata.annotations.\"autoscaling.alpha.kubernetes.io/current-metrics\"'\n","resource.customizations.ignoreResourceUpdates.discovery.k8s.io_EndpointSlice":"jsonPointers:\n  - /metadata\n  - /endpoints\n  - /ports\n","resource.exclusions":"### Network resources created by the Kubernetes control plane and excluded to reduce the number of watched events and UI clutter\n- apiGroups:\n  - ''\n  - discovery.k8s.io\n  kinds:\n  - Endpoints\n  - EndpointSlice\n### Internal Kubernetes resources excluded reduce the number of watched events\n- apiGroups:\n  - coordination.k8s.io\n  kinds:\n  - Lease\n### Internal Kubernetes Authz/Authn resources excluded reduce the number of watched events\n- apiGroups:\n  - authentication.k8s.io\n  - authorization.k8s.io\n  kinds:\n  - SelfSubjectReview\n  - TokenReview\n  - LocalSubjectAccessReview\n  - SelfSubjectAccessReview\n  - SelfSubjectRulesReview\n  - SubjectAccessReview\n### Intermediate Certificate Request excluded reduce the number of watched events\n- apiGroups:\n  - certificates.k8s.io\n  kinds:\n  - CertificateSigningRequest\n- apiGroups:\n  - cert-manager.io\n  kinds:\n  - CertificateRequest\n### Cilium internal resources excluded reduce the number of watched events and UI Clutter\n- apiGroups:\n  - cilium.io\n  kinds:\n  - CiliumIdentity\n  - CiliumEndpoint\n  - CiliumEndpointSlice\n### Kyverno intermediate and reporting resources excluded reduce the number of watched events and improve performance\n- apiGroups:\n  - kyverno.io\n  - reports.kyverno.io\n  - wgpolicyk8s.io\n  kinds:\n  - PolicyReport\n  - ClusterPolicyReport\n  - EphemeralReport\n  - ClusterEphemeralReport\n  - AdmissionReport\n  - ClusterAdmissionReport\n  - BackgroundScanReport\n  - ClusterBackgroundScanReport\n  - UpdateRequest\n"},"kind":"ConfigMap","metadata":{"labels":{"app.kubernetes.io/name":"argocd-cm","app.kubernetes.io/part-of":"argocd"},"name":"argocd-cm","namespace":"argocd"}}
  creationTimestamp: "2026-06-13T05:58:21Z"
  labels:
    app.kubernetes.io/name: argocd-cm
    app.kubernetes.io/part-of: argocd
  name: argocd-cm
  namespace: argocd
  resourceVersion: "755"
  uid: 7dde9a7c-e155-40e9-9287-fba342970242


Output:
sshkeys.generators.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
generatorstates.generators.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
stssessiontokens.generators.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
mfas.generators.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
grafanas.generators.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
cloudsmithaccesstokens.generators.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
quayaccesstokens.generators.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
clustergenerators.generators.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
uuids.generators.external-secrets.io NamesAccepted=False:ShortNamesConflict Established=True:InitialNamesAccepted
gcraccesstokens.generators.external-secrets.io NamesAccepted=False:ShortNamesConflict Established=True:InitialNamesAccepted
acraccesstokens.generators.external-secrets.io NamesAccepted=False:ShortNamesConflict Established=True:InitialNamesAccepted
githubaccesstokens.generators.external-secrets.io NamesAccepted=False:ShortNamesConflict Established=True:InitialNamesAccepted
webhooks.generators.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
fakes.generators.external-secrets.io NamesAccepted=False:ShortNamesConflict Established=True:InitialNamesAccepted
ecrauthorizationtokens.generators.external-secrets.io NamesAccepted=False:ShortNamesConflict Established=True:InitialNamesAccepted
vaultdynamicsecrets.generators.external-secrets.io NamesAccepted=False:ShortNamesConflict Established=True:InitialNamesAccepted
passwords.generators.external-secrets.io NamesAccepted=False:ShortNamesConflict Established=True:InitialNamesAccepted
pushsecrets.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
clusterexternalsecrets.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
clustersecretstores.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
externalsecrets.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
secretstores.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T22:01:18Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T22:01:18Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T22:01:18Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T22:01:18Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T22:01:18Z" not found


Question: External Secrets Operator CRD ShortNamesConflict NamesAccepted false generators uuids passwords ArgoCD degraded


/bin/bash -lc "sed -n '1,160p' applications/platform/external-secrets.yaml && git status --short"


Output:
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: platform-external-secrets
  namespace: argocd
spec:
  project: platform
  source:
    repoURL: https://charts.external-secrets.io
    chart: external-secrets
    targetRevision: 0.10.5
    helm:
      releaseName: external-secrets
      values: |
        installCRDs: true
  destination:
    server: https://192.168.20.40:6443
    namespace: external-secrets
  syncPolicy:
    automated:
      prune: false
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true


*Kurzfassung:* Erstmal nichts Dringendes. `platform-external-secrets` funktioniert, aber ArgoCD bewertet einige CRDs streng als `Degraded`.

*Was ich gefunden habe:*
• ESO Pods laufen alle sauber:
  • `external-secrets`: `1/1 Running`
  • `external-secrets-webhook`: `1/1 Running`
  • `external-secrets-cert-controller`: `1/1 Running`
• Webhook-Service und CA-Bundles sind vorhanden.
• Unsere `ExternalSecret`-Objekte syncen erfolgreich, z.B. SuiteCRM/Zammad.
• ArgoCD App ist `Synced`, aber `Degraded`.

*Warum Degraded?*
Einige ESO-Generator-CRDs haben:

`NamesAccepted=False:ShortNamesConflict`

aber gleichzeitig:

`Established=True`

Das heißt: Kubernetes hat die CRDs installiert und nutzt sie, aber einige optionale Kurz-Namen kollidieren. ArgoCD nimmt das als Health-Degradation.

*Meine Empfehlung:*
Nicht hektisch anfassen. Funktional ist ESO ok.

Sauberer nächster Schritt wäre später ein geplanter Mini-Task:

1. ESO-Chart-Version prüfen/ggf. aktualisieren.
2. Optional CRDs und Operator in zwei ArgoCD Apps splitten.
3. Danach schauen, ob `ShortNamesConflict` weg ist.
4. Nur wenn es bleibt: gezielte ArgoCD Health-Customization für diese Generator-CRDs.

Ich würde jetzt keinen Blind-Fix machen, weil Secrets gerade produktiv sauber laufen.

was machen wir mit `platform-external-secrets?`

/bin/bash -lc "ssh -i /home/node/.ssh/kube-bot-it15-ed25519 Misla@192.168.1.121 'wsl.exe -d Ubuntu -- bash -s' <<'REMOTE'
kubectl -n argocd get application platform-external-secrets -o yaml
REMOTE"

/bin/bash -lc "ssh -i /home/node/.ssh/kube-bot-it15-ed25519 Misla@192.168.1.121 'wsl.exe -d Ubuntu -- bash -s' <<'REMOTE'
kubectl -n argocd get application platform-external-secrets -o yaml
REMOTE"

/bin/bash -lc 'ssh -i /home/node/.ssh/kube-bot-it15-ed25519 kube-bot@192.168.20.40 "sudo kubectl --kubeconfig=<redacted> -n external-secrets get pods,deploy,svc,events --sort-by=.metadata.creationTimestamp"'

/bin/bash -lc 'ssh -i /home/node/.ssh/kube-bot-it15-ed25519 kube-bot@192.168.20.40 "sudo kubectl --kubeconfig=<redacted> -n external-secrets get pods,deploy,svc,events --sort-by=.metadata.creationTimestamp"'

/bin/bash -lc "sed -n '1,220p' clusters/it15-mgmt/argocd/apps/platform-external-secrets.yaml && find platform/external-secrets -maxdepth 3 -type f -print -exec sed -n '1,220p' {} \\;"

/bin/bash -lc "sed -n '1,220p' clusters/it15-mgmt/argocd/apps/platform-external-secrets.yaml && find platform/external-secrets -maxdepth 3 -type f -print -exec sed -n '1,220p' {} \\;"

sed: can't read clusters/it15-mgmt/argocd/apps/platform-external-secrets.yaml: No such file or directory

error: couldn't find any field with path "{.metadata.creationTimestamp}" in the list of objects

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"argoproj.io/v1alpha1","kind":"Application","metadata":{"annotations":{},"name":"platform-external-secrets","namespace":"argocd"},"spec":{"destination":{"namespace":"external-secrets","server":"https://192.168.20.40:6443"},"project":"platform","source":{"chart":"external-secrets","helm":{"releaseName":"external-secrets","values":"installCRDs: true\n"},"repoURL":"https://charts.external-secrets.io","targetRevision":"0.20.4"},"syncPolicy":{"automated":{"prune":false,"selfHeal":true},"syncOptions":["CreateNamespace=true","ServerSideApply=true"]}}}
  creationTimestamp: "2026-06-16T21:17:15Z"
  generation: 978
  name: platform-external-secrets
  namespace: argocd
  resourceVersion: "161433"
  uid: 8ecf0f5c-0c48-4582-805f-461d97cff571
spec:
  destination:
    namespace: external-secrets
    server: https://192.168.20.40:6443
  project: platform
  source:
    chart: external-secrets
    helm:
      releaseName: external-secrets
      values: |
        installCRDs: true
    repoURL: https://charts.external-secrets.io
    targetRevision: 0.10.5
  syncPolicy:
    automated:
      prune: false
      selfHeal: true
    syncOptions:
    - CreateNamespace=true
    - ServerSideApply=true
status:
  controllerNamespace: argocd
  health:
    lastTransitionTime: "2026-06-18T20:23:10Z"
    status: Degraded
  history:
  - deployStartedAt: "2026-06-16T21:55:53Z"
    deployedAt: "2026-06-16T22:01:19Z"
    id: 0
    initiatedBy:
      automated: true
    revision: 0.10.5
    source:
      chart: external-secrets
      helm:
        releaseName: external-secrets
        values: |
          installCRDs: true
      repoURL: https://charts.external-secrets.io
      targetRevision: 0.10.5
  operationState:
    finishedAt: "2026-06-16T22:01:20Z"
    message: successfully synced (all tasks run)
    operation:
      initiatedBy:
        automated: true
      retry:
        limit: 5
      sync:
        autoHealAttemptsCount: 1
        resources:
        - group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: externalsecrets.external-secrets.io
        - group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: secretstores.external-secrets.io
        - group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: clustersecretstores.external-secrets.io
        revision: 0.10.5
        source:
          chart: external-secrets
          helm:
            releaseName: external-secrets
            values: |
              installCRDs: true
          repoURL: https://charts.external-secrets.io
          targetRevision: 0.10.5
        syncOptions:
        - CreateNamespace=true
        - ServerSideApply=true
    phase: Succeeded
    startedAt: "2026-06-16T22:01:19Z"
    syncResult:
      resources:
      - group: apiextensions.k8s.io
        hookPhase: Running
        kind: CustomResourceDefinition
        message: customresourcedefinition.apiextensions.k8s.io/externalsecrets.external-secrets.io
          serverside-applied
        name: externalsecrets.external-secrets.io
        namespace: external-secrets
        status: Synced
        syncPhase: Sync
        version: v1
      - group: apiextensions.k8s.io
        hookPhase: Running
        kind: CustomResourceDefinition
        message: customresourcedefinition.apiextensions.k8s.io/clustersecretstores.external-secrets.io
          serverside-applied
        name: clustersecretstores.external-secrets.io
        namespace: external-secrets
        status: Synced
        syncPhase: Sync
        version: v1
      - group: apiextensions.k8s.io
        hookPhase: Running
        kind: CustomResourceDefinition
        message: customresourcedefinition.apiextensions.k8s.io/secretstores.external-secrets.io
          serverside-applied
        name: secretstores.external-secrets.io
        namespace: external-secrets
        status: Synced
        syncPhase: Sync
        version: v1
      revision: 0.10.5
      source:
        chart: external-secrets
        helm:
          releaseName: external-secrets
          values: |
            installCRDs: true
        repoURL: https://charts.external-secrets.io
        targetRevision: 0.10.5
  reconciledAt: "2026-06-18T20:26:54Z"
  resourceHealthSource: appTree
  resources:
  - kind: Secret
    name: external-secrets-webhook
    namespace: external-secrets
    status: Synced
    version: v1
  - kind: Service
    name: external-secrets-webhook
    namespace: external-secrets
    status: Synced
    version: v1
  - kind: ServiceAccount
    name: external-secrets
    namespace: external-secrets
    status: Synced
    version: v1
  - kind: ServiceAccount
    name: external-secrets-cert-controller
    namespace: external-secrets
    status: Synced
    version: v1
  - kind: ServiceAccount
    name: external-secrets-webhook
    namespace: external-secrets
    status: Synced
    version: v1
  - group: admissionregistration.k8s.io
    kind: ValidatingWebhookConfiguration
    name: externalsecret-validate
    status: Synced
    version: v1
  - group: admissionregistration.k8s.io
    kind: ValidatingWebhookConfiguration
    name: secretstore-validate
    status: Synced
    version: v1
  - group: apiextensions.k8s.io
    kind: CustomResourceDefinition
    name: acraccesstokens.generators.external-secrets.io
    status: Synced
    version: v1
  - group: apiextensions.k8s.io
    kind: CustomResourceDefinition
    name: clusterexternalsecrets.external-secrets.io
    status: Synced
    version: v1
  - group: apiextensions.k8s.io
    kind: CustomResourceDefinition
    name: clustersecretstores.external-secrets.io
    status: Synced
    version: v1
  - group: apiextensions.k8s.io
    kind: CustomResourceDefinition
    name: ecrauthorizationtokens.generators.external-secrets.io
    status: Synced
    version: v1
  - group: apiextensions.k8s.io
    kind: CustomResourceDefinition
    name: externalsecrets.external-secrets.io
    status: Synced
    version: v1
  - group: apiextensions.k8s.io
    kind: CustomResourceDefinition
    name: fakes.generators.external-secrets.io
    status: Synced
    version: v1
  - group: apiextensions.k8s.io
    kind: CustomResourceDefinition
    name: gcraccesstokens.generators.external-secrets.io
    status: Synced
    version: v1
  - group: apiextensions.k8s.io
    kind: CustomResourceDefinition
    name: githubaccesstokens.generators.external-secrets.io
    status: Synced
    version: v1
  - group: apiextensions.k8s.io
    kind: CustomResourceDefinition
    name: passwords.generators.external-secrets.io
    status: Synced
    version: v1
  - group: apiextensions.k8s.io
    kind: CustomResourceDefinition
    name: pushsecrets.external-secrets.io
    status: Synced
    version: v1
  - group: apiextensions.k8s.io
    kind: CustomResourceDefinition
    name: secretstores.external-secrets.io
    status: Synced
    version: v1
  - group: apiextensions.k8s.io
    kind: CustomResourceDefinition
    name: uuids.generators.external-secrets.io
    status: Synced
    version: v1
  - group: apiextensions.k8s.io
    kind: CustomResourceDefinition
    name: vaultdynamicsecrets.generators.external-secrets.io
    status: Synced
    version: v1
  - group: apiextensions.k8s.io
    kind: CustomResourceDefinition
    name: webhooks.generators.external-secrets.io
    status: Synced
    version: v1
  - group: apps
    kind: Deployment
    name: external-secrets
    namespace: external-secrets
    status: Synced
    version: v1
  - group: apps
    kind: Deployment
    name: external-secrets-cert-controller
    namespace: external-secrets
    status: Synced
    version: v1
  - group: apps
    kind: Deployment
    name: external-secrets-webhook
    namespace: external-secrets
    status: Synced
    version: v1
  - group: rbac.authorization.k8s.io
    kind: ClusterRole
    name: external-secrets-cert-controller
    status: Synced
    version: v1
  - group: rbac.authorization.k8s.io
    kind: ClusterRole
    name: external-secrets-controller
    status: Synced
    version: v1
  - group: rbac.authorization.k8s.io
    kind: ClusterRole
    name: external-secrets-edit
    status: Synced
    version: v1
  - group: rbac.authorization.k8s.io
    kind: ClusterRole
    name: external-secrets-servicebindings
    status: Synced
    version: v1
  - group: rbac.authorization.k8s.io
    kind: ClusterRole
    name: external-secrets-view
    status: Synced
    version: v1
  - group: rbac.authorization.k8s.io
    kind: ClusterRoleBinding
    name: external-secrets-cert-controller
    status: Synced
    version: v1
  - group: rbac.authorization.k8s.io
    kind: ClusterRoleBinding
    name: external-secrets-controller
    status: Synced
    version: v1
  - group: rbac.authorization.k8s.io
    kind: Role
    name: external-secrets-leaderelection
    namespace: external-secrets
    status: Synced
    version: v1
  - group: rbac.authorization.k8s.io
    kind: RoleBinding
    name: external-secrets-leaderelection
    namespace: external-secrets
    status: Synced
    version: v1
  sourceHydrator: {}
  sourceType: Helm
  summary:
    images:
    - oci.external-secrets.io/external-secrets/external-secrets:v0.10.5
  sync:
    comparedTo:
      destination:
        namespace: external-secrets
        server: https://192.168.20.40:6443
      source:
        chart: external-secrets
        helm:
          releaseName: external-secrets
          values: |
            installCRDs: true
        repoURL: https://charts.external-secrets.io
        targetRevision: 0.10.5
    revision: 0.10.5
    status: Synced

/bin/bash -lc "rg -n \"platform-external-secrets|external-secrets\" /home/node/.openclaw/workspace/repos/platform-gitops/clusters /home/node/.openclaw/workspace/repos/platform-gitops/platform -g '*.yaml'"

/bin/bash -lc "rg -n \"platform-external-secrets|external-secrets\" /home/node/.openclaw/workspace/repos/platform-gitops/clusters /home/node/.openclaw/workspace/repos/platform-gitops/platform -g '*.yaml'"

/bin/bash -lc 'ssh -i /home/node/.ssh/kube-bot-it15-ed25519 kube-bot@192.168.20.40 "sudo kubectl --kubeconfig=<redacted> -n external-secrets get pods,deploy,svc,events"'

/bin/bash -lc 'ssh -i /home/node/.ssh/kube-bot-it15-ed25519 kube-bot@192.168.20.40 "sudo kubectl --kubeconfig=<redacted> -n external-secrets get pods,deploy,svc,events"'

/bin/bash -lc 'ssh -i /home/node/.ssh/kube-bot-it15-ed25519 kube-bot@192.168.20.40 "sudo kubectl --kubeconfig=<redacted> -n external-secrets describe deploy external-secrets external-secrets-webhook external-secrets-cert-controller"'

/bin/bash -lc 'ssh -i /home/node/.ssh/kube-bot-it15-ed25519 kube-bot@192.168.20.40 "sudo kubectl --kubeconfig=<redacted> -n external-secrets describe deploy external-secrets external-secrets-webhook external-secrets-cert-controller"'

NAME                                                    READY   STATUS    RESTARTS   AGE
pod/external-secrets-748f44c8b8-65mqg                   1/1     Running   0          46h
pod/external-secrets-webhook-6d44f5546c-mrf6b           1/1     Running   0          46h
pod/external-secrets-cert-controller-546f7fc68f-6jkp6   1/1     Running   0          46h

NAME                                               READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/external-secrets                   1/1     1            1           47h
deployment.apps/external-secrets-webhook           1/1     1            1           47h
deployment.apps/external-secrets-cert-controller   1/1     1            1           47h

NAME                               TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGE
service/external-secrets-webhook   ClusterIP   10.43.238.32   <none>        443/TCP   47h

Name:                   external-secrets
Namespace:              external-secrets
CreationTimestamp:      Tue, 16 Jun 2026 23:20:33 +0200
Labels:                 app.kubernetes.io/instance=<redacted>
                        app.kubernetes.io/managed-by=Helm
                        app.kubernetes.io/name=<redacted>
                        app.kubernetes.io/version=v0.10.5
                        helm.sh/chart=<redacted>
Annotations:            argocd.argoproj.io/tracking-id: platform-external-secrets:apps/Deployment:external-secrets/external-secrets
                        deployment.kubernetes.io/revision: 2
Selector:               app.kubernetes.io/instance=external-secrets,app.kubernetes.io/name=<redacted>
Replicas:               1 desired | 1 updated | 1 total | 1 available | 0 unavailable
StrategyType:           RollingUpdate
MinReadySeconds:        0
RollingUpdateStrategy:  25% max unavailable, 25% max surge
Pod Template:
  Labels:           app.kubernetes.io/instance=<redacted>
                    app.kubernetes.io/managed-by=Helm
                    app.kubernetes.io/name=<redacted>
                    app.kubernetes.io/version=v0.10.5
                    helm.sh/chart=<redacted>
  Service Account:  external-secrets
  Containers:
   external-secrets:
    Image:           oci.external-secrets.io/external-secrets/external-secrets:v0.10.5
    Port:            8080/TCP
    Host Port:       0/TCP
    SeccompProfile:  RuntimeDefault
    Args:
      --concurrent=1
      --metrics-addr=:8080
      --loglevel=info
      --zap-time-encoding=epoch
    Environment:  <none>
    Mounts:       <none>
  Volumes:        <none>
Conditions:
  Type           Status  Reason
  ----           ------  ------
  Progressing    True    NewReplicaSetAvailable
  Available      True    MinimumReplicasAvailable
OldReplicaSets:  external-secrets-85ff6cd96 (0/0 replicas created)
NewReplicaSet:   external-secrets-748f44c8b8 (1/1 replicas created)
Events:          <none>

Name:                   external-secrets-webhook
Namespace:              external-secrets
CreationTimestamp:      Tue, 16 Jun 2026 23:20:33 +0200
Labels:                 app.kubernetes.io/instance=<redacted>
                        app.kubernetes.io/managed-by=Helm
                        app.kubernetes.io/name=<redacted>
                        app.kubernetes.io/version=v0.10.5
                        helm.sh/chart=<redacted>
Annotations:            argocd.argoproj.io/tracking-id: platform-external-secrets:apps/Deployment:external-secrets/external-secrets-webhook
                        deployment.kubernetes.io/revision: 2
Selector:               app.kubernetes.io/instance=external-secrets,app.kubernetes.io/name=<redacted>
Replicas:               1 desired | 1 updated | 1 total | 1 available | 0 unavailable
StrategyType:           RollingUpdate
MinReadySeconds:        0
RollingUpdateStrategy:  25% max unavailable, 25% max surge
Pod Template:
  Labels:           app.kubernetes.io/instance=<redacted>
                    app.kubernetes.io/managed-by=Helm
                    app.kubernetes.io/name=<redacted>
                    app.kubernetes.io/version=v0.10.5
                    helm.sh/chart=<redacted>
  Service Account:  external-secrets-webhook
  Containers:
   webhook:
    Image:           oci.external-secrets.io/external-secrets/external-secrets:v0.10.5
    Ports:           8080/TCP, 10250/TCP
    Host Ports:      0/TCP, 0/TCP
    SeccompProfile:  RuntimeDefault
    Args:
      webhook
      --port=10250
      --dns-name=<redacted>
      --cert-dir=/tmp/certs
      --check-interval=5m
      --metrics-addr=:8080
      --healthz-addr=:8081
      --loglevel=info
      --zap-time-encoding=epoch
    Readiness:    http-get http://:8081/readyz delay=20s timeout=1s period=5s #success=1 #failure=3
    Environment:  <none>
    Mounts:
      /tmp/certs from certs (ro)
  Volumes:
   certs:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  external-secrets-webhook
    Optional:    false
Conditions:
  Type           Status  Reason
  ----           ------  ------
  Progressing    True    NewReplicaSetAvailable
  Available      True    MinimumReplicasAvailable
OldReplicaSets:  external-secrets-webhook-bb8f8559 (0/0 replicas created)
NewReplicaSet:   external-secrets-webhook-6d44f5546c (1/1 replicas created)
Events:          <none>

Name:                   external-secrets-cert-controller
Namespace:              external-secrets
CreationTimestamp:      Tue, 16 Jun 2026 23:20:33 +0200
Labels:                 app.kubernetes.io/instance=<redacted>
                        app.kubernetes.io/managed-by=Helm
                        app.kubernetes.io/name=<redacted>
                        app.kubernetes.io/version=v0.10.5
                        helm.sh/chart=<redacted>
Annotations:            argocd.argoproj.io/tracking-id: platform-external-secrets:apps/Deployment:external-secrets/external-secrets-cert-controller
                        deployment.kubernetes.io/revision: 2
Selector:               app.kubernetes.io/instance=external-secrets,app.kubernetes.io/name=<redacted>
Replicas:               1 desired | 1 updated | 1 total | 1 available | 0 unavailable
StrategyType:           RollingUpdate
MinReadySeconds:        0
RollingUpdateStrategy:  25% max unavailable, 25% max surge
Pod Template:
  Labels:           app.kubernetes.io/instance=<redacted>
                    app.kubernetes.io/managed-by=Helm
                    app.kubernetes.io/name=<redacted>
                    app.kubernetes.io/version=v0.10.5
                    helm.sh/chart=<redacted>
  Service Account:  external-secrets-cert-controller
  Containers:
   cert-controller:
    Image:           oci.external-secrets.io/external-secrets/external-secrets:v0.10.5
    Port:            8080/TCP
    Host Port:       0/TCP
    SeccompProfile:  RuntimeDefault
    Args:
      certcontroller
      --crd-requeue-interval=5m
      --service-name=<redacted>
      --service-namespace=<redacted>
      --secret-name=<redacted>
      --secret-namespace=<redacted>
      --metrics-addr=:8080
      --healthz-addr=:8081
      --loglevel=info
      --zap-time-encoding=epoch
      --enable-partial-cache=true
    Readiness:    http-get http://:8081/readyz delay=20s timeout=1s period=5s #success=1 #failure=3
    Environment:  <none>
    Mounts:       <none>
  Volumes:        <none>
Conditions:
  Type           Status  Reason
  ----           ------  ------
  Progressing    True    NewReplicaSetAvailable
  Available      True    MinimumReplicasAvailable
OldReplicaSets:  external-secrets-cert-controller-5cdb9f68d9 (0/0 replicas created)
NewReplicaSet:   external-secrets-cert-controller-546f7fc68f (1/1 replicas created)
Events:          <none>

/bin/bash -lc "ssh -i /home/node/.ssh/kube-bot-it15-ed25519 Misla@192.168.1.121 'wsl.exe -d Ubuntu -- bash -s' <<'REMOTE'
kubectl -n argocd get application platform-external-secrets -o json | python3 - <<'PY'
import sys,json
app=json.load(sys.stdin)
for r in app.get('status',{}).get('resources',[]):
    h=r.get('health') or {}
    status=h.get('status')
    if status and status not in ('Healthy',):
        print(r.get('kind'), r.get('namespace',''), r.get('name'), 'sync='+str(r.get('status')), 'health='+str(status), 'msg='+str(h.get('message','')))
PY
REMOTE"

Traceback (most recent call last):
  File "<stdin>", line 2, in <module>
  File "/usr/lib/python3.14/json/__init__.py", line 298, in load
    return loads(fp.read(),
        cls=cls, object_hook=object_hook,
        parse_float=parse_float, parse_int=parse_int,
        parse_constant=parse_constant, object_pairs_hook=object_pairs_hook, **kw)
  File "/usr/lib/python3.14/json/__init__.py", line 352, in loads
    return _default_decoder.decode(s)
           ~~~~~~~~~~~~~~~~~~~~~~~^^^
  File "/usr/lib/python3.14/json/decoder.py", line 345, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
               ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.14/json/decoder.py", line 363, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

/bin/bash -lc "set -euo pipefail
ssh -i /home/node/.ssh/kube-bot-it15-ed25519 Misla@192.168.1.121 'wsl.exe -d Ubuntu -- kubectl -n argocd get application platform-external-secrets -o json' > /home/node/.openclaw/workspace/tmp/platform-external-secrets-app.json
python3 - <<'PY'
import json
app=json.load(open('/home/node/.openclaw/workspace/tmp/platform-external-secrets-app.json'))
print('app health:', app.get('status',{}).get('health',{}))
for r in app.get('status',{}).get('resources',[]):
    h=r.get('health') or {}
    status=h.get('status')
    if status and status not in ('Healthy',):
        print(r.get('kind'), r.get('namespace',''), r.get('name'), 'sync='+str(r.get('status')), 'health='+str(status), 'msg='+str(h.get('message','')))
PY"

app health: {'lastTransitionTime': '2026-06-18T20:23:10Z', 'status': 'Degraded'}

/bin/bash -lc "python3 - <<'PY'
import json
app=json.load(open('/home/node/.openclaw/workspace/tmp/platform-external-secrets-app.json'))
for key in ['conditions','summary','sync','operationState','reconciledAt']:
    print('\\n--',key,'--')
    print(json.dumps(app.get('status',{}).get(key), indent=2)[:5000])
PY"

-- conditions --
null

-- summary --
{
  "images": [
    "oci.external-secrets.io/external-secrets/external-secrets:v0.10.5"
  ]
}

-- sync --
{
  "comparedTo": {
    "destination": {
      "namespace": "external-secrets",
      "server": "https://192.168.20.40:6443"
    },
    "source": {
      "chart": "external-secrets",
      "helm": {
        "releaseName": "external-secrets",
        "values": "installCRDs: true\n"
      },
      "repoURL": "https://charts.external-secrets.io",
      "targetRevision": "0.10.5"
    }
  },
  "revision": "0.10.5",
  "status": "Synced"
}

-- operationState --
{
  "finishedAt": "2026-06-16T22:01:20Z",
  "message": "successfully synced (all tasks run)",
  "operation": {
    "initiatedBy": {
      "automated": true
    },
    "retry": {
      "limit": 5
    },
    "sync": {
      "autoHealAttemptsCount": 1,
      "resources": [
        {
          "group": "apiextensions.k8s.io",
          "kind": "CustomResourceDefinition",
          "name": "externalsecrets.external-secrets.io"
        },
        {
          "group": "apiextensions.k8s.io",
          "kind": "CustomResourceDefinition",
          "name": "secretstores.external-secrets.io"
        },
        {
          "group": "apiextensions.k8s.io",
          "kind": "CustomResourceDefinition",
          "name": "clustersecretstores.external-secrets.io"
        }
      ],
      "revision": "0.10.5",
      "source": {
        "chart": "external-secrets",
        "helm": {
          "releaseName": "external-secrets",
          "values": "installCRDs: true\n"
        },
        "repoURL": "https://charts.external-secrets.io",
        "targetRevision": "0.10.5"
      },
      "syncOptions": [
        "CreateNamespace=true",
        "ServerSideApply=true"
      ]
    }
  },
  "phase": "Succeeded",
  "startedAt": "2026-06-16T22:01:19Z",
  "syncResult": {
    "resources": [
      {
        "group": "apiextensions.k8s.io",
        "hookPhase": "Running",
        "kind": "CustomResourceDefinition",
        "message": "customresourcedefinition.apiextensions.k8s.io/externalsecrets.external-secrets.io serverside-applied",
        "name": "externalsecrets.external-secrets.io",
        "namespace": "external-secrets",
        "status": "Synced",
        "syncPhase": "Sync",
        "version": "v1"
      },
      {
        "group": "apiextensions.k8s.io",
        "hookPhase": "Running",
        "kind": "CustomResourceDefinition",
        "message": "customresourcedefinition.apiextensions.k8s.io/clustersecretstores.external-secrets.io serverside-applied",
        "name": "clustersecretstores.external-secrets.io",
        "namespace": "external-secrets",
        "status": "Synced",
        "syncPhase": "Sync",
        "version": "v1"
      },
      {
        "group": "apiextensions.k8s.io",
        "hookPhase": "Running",
        "kind": "CustomResourceDefinition",
        "message": "customresourcedefinition.apiextensions.k8s.io/secretstores.external-secrets.io serverside-applied",
        "name": "secretstores.external-secrets.io",
        "namespace": "external-secrets",
        "status": "Synced",
        "syncPhase": "Sync",
        "version": "v1"
      }
    ],
    "revision": "0.10.5",
    "source": {
      "chart": "external-secrets",
      "helm": {
        "releaseName": "external-secrets",
        "values": "installCRDs: true\n"
      },
      "repoURL": "https://charts.external-secrets.io",
      "targetRevision": "0.10.5"
    }
  }
}

-- reconciledAt --
"2026-06-18T20:26:54Z"

/bin/bash -lc "find /home/node/.openclaw/workspace/repos/platform-gitops -type f -maxdepth 5 | sort | xargs grep -n \"platform-external-secrets\\|targetRevision: 0.10.5\\|targetRevision: 0.20.4\\|charts.external-secrets.io\" 2>/dev/null"

/home/node/.openclaw/workspace/repos/platform-gitops/applications/platform/external-secrets.yaml:4:  name: platform-external-secrets
/home/node/.openclaw/workspace/repos/platform-gitops/applications/platform/external-secrets.yaml:9:    repoURL: https://charts.external-secrets.io
/home/node/.openclaw/workspace/repos/platform-gitops/applications/platform/external-secrets.yaml:11:    targetRevision: 0.10.5
/home/node/.openclaw/workspace/repos/platform-gitops/clusters/it15-mgmt/argocd/projects/platform.yaml:11:    - https://charts.external-secrets.io

/bin/bash -lc "ssh -i /home/node/.ssh/kube-bot-it15-ed25519 Misla@192.168.1.121 'wsl.exe -d Ubuntu -- bash -s' <<'REMOTE'
kubectl -n argocd logs statefulset/argocd-application-controller --tail=300 | grep -i 'platform-external-secrets\\|external-secrets' | tail -n 80 || true
REMOTE"

{"app-namespace":"argocd","application":"platform-external-secrets","level":"info","msg":"Refreshing app status (hard refresh requested), level (3)","project":"platform","time":"2026-06-18T20:24:28Z"}
{"app-namespace":"argocd","application":"platform-external-secrets","level":"info","msg":"Comparing app state (cluster: https://192.168.20.40:6443, namespace: external-secrets)","project":"platform","time":"2026-06-18T20:24:28Z"}
{"app-namespace":"argocd","application":"platform-external-secrets","build_options_ms":0,"level":"info","manifests_ms":1056,"msg":"GetRepoObjs stats","plugins_ms":0,"project":"platform","repo_ms":0,"time":"2026-06-18T20:24:29Z","time_ms":1056}
{"app-namespace":"argocd","application":"platform-external-secrets","level":"info","msg":"Skipping auto-sync: application status is Synced","project":"platform","time":"2026-06-18T20:24:29Z"}
{"app-namespace":"argocd","application":"platform-external-secrets","level":"info","msg":"Update successful","project":"platform","time":"2026-06-18T20:24:29Z"}
{"app-namespace":"argocd","app_status_update_ms":0,"application":"platform-external-secrets","auto_sync_ms":0,"compare_app_state_ms":1111,"comparison-level":3,"comparison_with_nothing_ms":0,"dedup_ms":0,"dest-name":"","dest-namespace":"external-secrets","dest-server":"https://192.168.20.40:6443","diff_ms":48,"git_ms":1057,"health_ms":3,"level":"info","live_ms":0,"msg":"Reconciliation completed","normalize_application_ms":0,"patch_ms":8,"persist_app_status_ms":8,"process_finalizers_ms":0,"project":"platform","refresh_app_conditions_ms":0,"set_app_managed_resources_ms":22,"setop_ms":0,"settings_ms":0,"sync_ms":0,"time":"2026-06-18T20:24:29Z","time_ms":1142}
{"app-namespace":"argocd","application":"platform-external-secrets","level":"info","msg":"Refreshing app status (comparison expired, requesting refresh. reconciledAt: 2026-06-18 20:24:28 +0000 UTC, expiry: 2m0s), level (2)","project":"platform","time":"2026-06-18T20:26:54Z"}
{"app-namespace":"argocd","application":"platform-external-secrets","level":"info","msg":"Comparing app state (cluster: https://192.168.20.40:6443, namespace: external-secrets)","project":"platform","time":"2026-06-18T20:26:54Z"}
{"app-namespace":"argocd","application":"platform-external-secrets","build_options_ms":0,"level":"info","manifests_ms":17,"msg":"GetRepoObjs stats","plugins_ms":0,"project":"platform","repo_ms":0,"time":"2026-06-18T20:26:54Z","time_ms":17}
{"app-namespace":"argocd","application":"platform-external-secrets","level":"info","msg":"Skipping auto-sync: application status is Synced","project":"platform","time":"2026-06-18T20:26:54Z"}
{"app-namespace":"argocd","application":"platform-external-secrets","level":"info","msg":"Update successful","project":"platform","time":"2026-06-18T20:26:54Z"}
{"app-namespace":"argocd","app_status_update_ms":0,"application":"platform-external-secrets","auto_sync_ms":0,"compare_app_state_ms":73,"comparison-level":2,"comparison_with_nothing_ms":0,"dedup_ms":0,"dest-name":"","dest-namespace":"external-secrets","dest-server":"https://192.168.20.40:6443","diff_ms":50,"git_ms":17,"health_ms":4,"level":"info","live_ms":0,"msg":"Reconciliation completed","normalize_application_ms":0,"patch_ms":10,"persist_app_status_ms":10,"process_finalizers_ms":0,"project":"platform","refresh_app_conditions_ms":0,"set_app_managed_resources_ms":22,"setop_ms":0,"settings_ms":0,"sync_ms":0,"time":"2026-06-18T20:26:54Z","time_ms":107}

/bin/bash -lc "ssh -i /home/node/.ssh/kube-bot-it15-ed25519 kube-bot@192.168.20.40 \"sudo kubectl --kubeconfig=<redacted> get crd | grep -E 'external-secrets|generators' | awk '{print "'$1}'"' | xargs -r sudo kubectl --kubeconfig=<redacted> get crd -o jsonpath='{range .items[*]}{.metadata.name}{\\\" \\\"}{range .status.conditions[*]}{.type}={.status}:{.reason} {end}{\\\"\\\\n\\\"}{end}'\""

/bin/bash -lc 'ssh -i /home/node/.ssh/kube-bot-it15-ed25519 kube-bot@192.168.20.40 "sudo kubectl --kubeconfig=<redacted> get validatingwebhookconfiguration externalsecret-validate secretstore-validate -o yaml"'

/bin/bash -lc "ssh -i /home/node/.ssh/kube-bot-it15-ed25519 Misla@192.168.1.121 'wsl.exe -d Ubuntu -- bash -s' <<'REMOTE'
kubectl -n argocd get cm argocd-cm -o yaml | grep -A80 -E 'resource.customizations|health' || true
REMOTE"

apiVersion: v1
items:
- apiVersion: admissionregistration.k8s.io/v1
  kind: ValidatingWebhookConfiguration
  metadata:
    annotations:
      argocd.argoproj.io/tracking-id: platform-external-secrets:admissionregistration.k8s.io/ValidatingWebhookConfiguration:external-secrets/externalsecret-validate
    creationTimestamp: "2026-06-16T21:20:33Z"
    generation: 3
    labels:
      external-secrets.io/component: webhook
    name: externalsecret-validate
    resourceVersion: "87326665"
    uid: 8f18f381-c4b7-45a1-87d7-3704bb1c2c95
  webhooks:
  - admissionReviewVersions:
    - v1
    - v1beta1
    clientConfig:
      caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURSakNDQWk2Z0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREEyTVJrd0Z3WURWUVFLRXhCbGVIUmwKY201aGJDMXpaV055WlhSek1Sa3dGd1lEVlFRREV4QmxlSFJsY201aGJDMXpaV055WlhSek1CNFhEVEkyTURZeApOakl3TWpBMU1Wb1hEVE0yTURZeE16SXhNakExTVZvd05qRVpNQmNHQTFVRUNoTVFaWGgwWlhKdVlXd3RjMlZqCmNtVjBjekVaTUJjR0ExVUVBeE1RWlhoMFpYSnVZV3d0YzJWamNtVjBjekNDQVNJd0RRWUpLb1pJaHZjTkFRRUIKQlFBRGdnRVBBRENDQVFvQ2dnRUJBTEtCVmRxTHZ1Y1FmeHZHTmVjUHE3V0dvOHpyZFZUL09BWXdMQkNnS1lYdgpzdTh0OXBIdUM0VjV5QWR0eXgzUXRjSENPUVVGbmcxNTM2MjYvbzZPRE5TcmdLOUJ4ZkpDL0dva1VyN3ppWWRECnFLTWE5WnlIQTJuRE5RcnNuYU0xTWE2WUxsaVVyQnFMWHNwVEJKWjYzNTlYc2dqTkVpTUpvOVVzQjUwRWFhZzEKUlR0K0FTcDA0cm1uZ2ZxUjRVRTdPNEtiMi9CZjBWQUhZNCtTUis4c3lRdjZQeHVKUFJOL1ZZcnBzblp3RTRIVwpNKzNwdlZmWldNRmFmWFgvcXk0c1RuVzFmT3ZpV1JzZnZVWVVicnlvbDlwYXB5K2xnenJkSkdabldrWENxWWNMCld2S3d6ZTc1dVBsWkJMWThNVURZZjBtaFlFajA1QWJvMFJOMnhaMnQxa2tDQXdFQUFhTmZNRjB3RGdZRFZSMFAKQVFIL0JBUURBZ0trTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkNlWkhyZXplOTdOc2VnRgplK2d0ZEg3NEZsaVpNQnNHQTFVZEVRUVVNQktDRUdWNGRHVnlibUZzTFhObFkzSmxkSE13RFFZSktvWklodmNOCkFRRUxCUUFEZ2dFQkFKbnN5RW0veGh4a2RkSkxCSGdwd0tvb0Q0SVE0WkptVkVjSGV0YmxPTitSZGNJU0ZERzMKNVNPL2lOTGFRNlducVovemEzc09TZWx3YS9aZzNWeVBBMFFXOXlWdFJBRDZMSmNGZW1pUUhsSmZYZ0xLdXk3KwowaFBNRFJYcStRNDl2ckduZXhFQWRwdzNudmRmdFB4Ry9nUlQ4SXd2ckI4K2MwWFNNMnljUEdvWjBIa0ZXMFZQCm15Ykpzajl2SkJFNFkyUUZRWEZXWDhyK1ZKZ2h1U2FhSXlhaXZJQ0dmajV4UjJBbFRpcDZSTFlDTjRRS0lFSVEKS01LRU1pZEdvaXZrajlxajkyK1ZraitNdzdPZWF6M01hSEFEamhlSSt0azM4KzY3NU0rOTFuRDR4c0lCVXl0SQptMkxNUm54M3ZWZ2JNeVRaWnpubCtiUThKQ21ISi9nLzJJbz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
      service:
        name: external-secrets-webhook
        namespace: external-secrets
        path: /validate-external-secrets-io-v1beta1-externalsecret
        port: 443
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validate.externalsecret.external-secrets.io
    namespaceSelector: {}
    objectSelector: {}
    rules:
    - apiGroups:
      - external-secrets.io
      apiVersions:
      - v1beta1
      operations:
      - CREATE
      - UPDATE
      - DELETE
      resources:
      - externalsecrets
      scope: Namespaced
    sideEffects: None
    timeoutSeconds: 5
- apiVersion: admissionregistration.k8s.io/v1
  kind: ValidatingWebhookConfiguration
  metadata:
    annotations:
      argocd.argoproj.io/tracking-id: platform-external-secrets:admissionregistration.k8s.io/ValidatingWebhookConfiguration:external-secrets/secretstore-validate
    creationTimestamp: "2026-06-16T21:20:33Z"
    generation: 3
    labels:
      external-secrets.io/component: webhook
    name: secretstore-validate
    resourceVersion: "87326669"
    uid: 18b45f0a-d4a9-4e08-9f5a-d1037101af83
  webhooks:
  - admissionReviewVersions:
    - v1
    - v1beta1
    clientConfig:
      caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURSakNDQWk2Z0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREEyTVJrd0Z3WURWUVFLRXhCbGVIUmwKY201aGJDMXpaV055WlhSek1Sa3dGd1lEVlFRREV4QmxlSFJsY201aGJDMXpaV055WlhSek1CNFhEVEkyTURZeApOakl3TWpBMU1Wb1hEVE0yTURZeE16SXhNakExTVZvd05qRVpNQmNHQTFVRUNoTVFaWGgwWlhKdVlXd3RjMlZqCmNtVjBjekVaTUJjR0ExVUVBeE1RWlhoMFpYSnVZV3d0YzJWamNtVjBjekNDQVNJd0RRWUpLb1pJaHZjTkFRRUIKQlFBRGdnRVBBRENDQVFvQ2dnRUJBTEtCVmRxTHZ1Y1FmeHZHTmVjUHE3V0dvOHpyZFZUL09BWXdMQkNnS1lYdgpzdTh0OXBIdUM0VjV5QWR0eXgzUXRjSENPUVVGbmcxNTM2MjYvbzZPRE5TcmdLOUJ4ZkpDL0dva1VyN3ppWWRECnFLTWE5WnlIQTJuRE5RcnNuYU0xTWE2WUxsaVVyQnFMWHNwVEJKWjYzNTlYc2dqTkVpTUpvOVVzQjUwRWFhZzEKUlR0K0FTcDA0cm1uZ2ZxUjRVRTdPNEtiMi9CZjBWQUhZNCtTUis4c3lRdjZQeHVKUFJOL1ZZcnBzblp3RTRIVwpNKzNwdlZmWldNRmFmWFgvcXk0c1RuVzFmT3ZpV1JzZnZVWVVicnlvbDlwYXB5K2xnenJkSkdabldrWENxWWNMCld2S3d6ZTc1dVBsWkJMWThNVURZZjBtaFlFajA1QWJvMFJOMnhaMnQxa2tDQXdFQUFhTmZNRjB3RGdZRFZSMFAKQVFIL0JBUURBZ0trTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkNlWkhyZXplOTdOc2VnRgplK2d0ZEg3NEZsaVpNQnNHQTFVZEVRUVVNQktDRUdWNGRHVnlibUZzTFhObFkzSmxkSE13RFFZSktvWklodmNOCkFRRUxCUUFEZ2dFQkFKbnN5RW0veGh4a2RkSkxCSGdwd0tvb0Q0SVE0WkptVkVjSGV0YmxPTitSZGNJU0ZERzMKNVNPL2lOTGFRNlducVovemEzc09TZWx3YS9aZzNWeVBBMFFXOXlWdFJBRDZMSmNGZW1pUUhsSmZYZ0xLdXk3KwowaFBNRFJYcStRNDl2ckduZXhFQWRwdzNudmRmdFB4Ry9nUlQ4SXd2ckI4K2MwWFNNMnljUEdvWjBIa0ZXMFZQCm15Ykpzajl2SkJFNFkyUUZRWEZXWDhyK1ZKZ2h1U2FhSXlhaXZJQ0dmajV4UjJBbFRpcDZSTFlDTjRRS0lFSVEKS01LRU1pZEdvaXZrajlxajkyK1ZraitNdzdPZWF6M01hSEFEamhlSSt0azM4KzY3NU0rOTFuRDR4c0lCVXl0SQptMkxNUm54M3ZWZ2JNeVRaWnpubCtiUThKQ21ISi9nLzJJbz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
      service:
        name: external-secrets-webhook
        namespace: external-secrets
        path: /validate-external-secrets-io-v1beta1-secretstore
        port: 443
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validate.secretstore.external-secrets.io
    namespaceSelector: {}
    objectSelector: {}
    rules:
    - apiGroups:
      - external-secrets.io
      apiVersions:
      - v1beta1
      operations:
      - CREATE
      - UPDATE
      - DELETE
      resources:
      - secretstores
      scope: Namespaced
    sideEffects: None
    timeoutSeconds: 5
  - admissionReviewVersions:
    - v1
    - v1beta1
    clientConfig:
      caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURSakNDQWk2Z0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREEyTVJrd0Z3WURWUVFLRXhCbGVIUmwKY201aGJDMXpaV055WlhSek1Sa3dGd1lEVlFRREV4QmxlSFJsY201aGJDMXpaV055WlhSek1CNFhEVEkyTURZeApOakl3TWpBMU1Wb1hEVE0yTURZeE16SXhNakExTVZvd05qRVpNQmNHQTFVRUNoTVFaWGgwWlhKdVlXd3RjMlZqCmNtVjBjekVaTUJjR0ExVUVBeE1RWlhoMFpYSnVZV3d0YzJWamNtVjBjekNDQVNJd0RRWUpLb1pJaHZjTkFRRUIKQlFBRGdnRVBBRENDQVFvQ2dnRUJBTEtCVmRxTHZ1Y1FmeHZHTmVjUHE3V0dvOHpyZFZUL09BWXdMQkNnS1lYdgpzdTh0OXBIdUM0VjV5QWR0eXgzUXRjSENPUVVGbmcxNTM2MjYvbzZPRE5TcmdLOUJ4ZkpDL0dva1VyN3ppWWRECnFLTWE5WnlIQTJuRE5RcnNuYU0xTWE2WUxsaVVyQnFMWHNwVEJKWjYzNTlYc2dqTkVpTUpvOVVzQjUwRWFhZzEKUlR0K0FTcDA0cm1uZ2ZxUjRVRTdPNEtiMi9CZjBWQUhZNCtTUis4c3lRdjZQeHVKUFJOL1ZZcnBzblp3RTRIVwpNKzNwdlZmWldNRmFmWFgvcXk0c1RuVzFmT3ZpV1JzZnZVWVVicnlvbDlwYXB5K2xnenJkSkdabldrWENxWWNMCld2S3d6ZTc1dVBsWkJMWThNVURZZjBtaFlFajA1QWJvMFJOMnhaMnQxa2tDQXdFQUFhTmZNRjB3RGdZRFZSMFAKQVFIL0JBUURBZ0trTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkNlWkhyZXplOTdOc2VnRgplK2d0ZEg3NEZsaVpNQnNHQTFVZEVRUVVNQktDRUdWNGRHVnlibUZzTFhObFkzSmxkSE13RFFZSktvWklodmNOCkFRRUxCUUFEZ2dFQkFKbnN5RW0veGh4a2RkSkxCSGdwd0tvb0Q0SVE0WkptVkVjSGV0YmxPTitSZGNJU0ZERzMKNVNPL2lOTGFRNlducVovemEzc09TZWx3YS9aZzNWeVBBMFFXOXlWdFJBRDZMSmNGZW1pUUhsSmZYZ0xLdXk3KwowaFBNRFJYcStRNDl2ckduZXhFQWRwdzNudmRmdFB4Ry9nUlQ4SXd2ckI4K2MwWFNNMnljUEdvWjBIa0ZXMFZQCm15Ykpzajl2SkJFNFkyUUZRWEZXWDhyK1ZKZ2h1U2FhSXlhaXZJQ0dmajV4UjJBbFRpcDZSTFlDTjRRS0lFSVEKS01LRU1pZEdvaXZrajlxajkyK1ZraitNdzdPZWF6M01hSEFEamhlSSt0azM4KzY3NU0rOTFuRDR4c0lCVXl0SQptMkxNUm54M3ZWZ2JNeVRaWnpubCtiUThKQ21ISi9nLzJJbz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
      service:
        name: external-secrets-webhook
        namespace: external-secrets
        path: /validate-external-secrets-io-v1beta1-clustersecretstore
        port: 443
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validate.clustersecretstore.external-secrets.io
    namespaceSelector: {}
    objectSelector: {}
    rules:
    - apiGroups:
      - external-secrets.io
      apiVersions:
      - v1beta1
      operations:
      - CREATE
      - UPDATE
      - DELETE
      resources:
      - clustersecretstores
      scope: Cluster
    sideEffects: None
    timeoutSeconds: 5
kind: List
metadata:
  resourceVersion: ""

resource.customizations.ignoreResourceUpdates.ConfigMap: |
    jqPathExpressions:
      # Ignore the cluster-autoscaler status
      - '.metadata.annotations."cluster-autoscaler.kubernetes.io/last-updated"'
      # Ignore the annotation of the legacy Leases election
      - '.metadata.annotations."control-plane.alpha.kubernetes.io/leader"'
  resource.customizations.ignoreResourceUpdates.Endpoints: |
    jsonPointers:
      - /metadata
      - /subsets
  resource.customizations.ignoreResourceUpdates.all: |
    jsonPointers:
      - /status
  resource.customizations.ignoreResourceUpdates.apps_ReplicaSet: |
    jqPathExpressions:
      - '.metadata.annotations."deployment.kubernetes.io/desired-replicas"'
      - '.metadata.annotations."deployment.kubernetes.io/max-replicas"'
      - '.metadata.annotations."rollout.argoproj.io/desired-replicas"'
  resource.customizations.ignoreResourceUpdates.argoproj.io_Application: |
    jqPathExpressions:
      - '.metadata.annotations."notified.notifications.argoproj.io"'
      - '.metadata.annotations."argocd.argoproj.io/refresh"'
      - '.metadata.annotations."argocd.argoproj.io/hydrate"'
      - '.operation'
  resource.customizations.ignoreResourceUpdates.argoproj.io_Rollout: |
    jqPathExpressions:
      - '.metadata.annotations."notified.notifications.argoproj.io"'
  resource.customizations.ignoreResourceUpdates.autoscaling_HorizontalPodAutoscaler: |
    jqPathExpressions:
      - '.metadata.annotations."autoscaling.alpha.kubernetes.io/behavior"'
      - '.metadata.annotations."autoscaling.alpha.kubernetes.io/conditions"'
      - '.metadata.annotations."autoscaling.alpha.kubernetes.io/metrics"'
      - '.metadata.annotations."autoscaling.alpha.kubernetes.io/current-metrics"'
  resource.customizations.ignoreResourceUpdates.discovery.k8s.io_EndpointSlice: |
    jsonPointers:
      - /metadata
      - /endpoints
      - /ports
  resource.exclusions: |
    ### Network resources created by the Kubernetes control plane and excluded to reduce the number of watched events and UI clutter
    - apiGroups:
      - ''
      - discovery.k8s.io
      kinds:
      - Endpoints
      - EndpointSlice
    ### Internal Kubernetes resources excluded reduce the number of watched events
    - apiGroups:
      - coordination.k8s.io
      kinds:
      - Lease
    ### Internal Kubernetes Authz/Authn resources excluded reduce the number of watched events
    - apiGroups:
      - authentication.k8s.io
      - authorization.k8s.io
      kinds:
      - SelfSubjectReview
      - TokenReview
      - LocalSubjectAccessReview
      - SelfSubjectAccessReview
      - SelfSubjectRulesReview
      - SubjectAccessReview
    ### Intermediate Certificate Request excluded reduce the number of watched events
    - apiGroups:
      - certificates.k8s.io
      kinds:
      - CertificateSigningRequest
    - apiGroups:
      - cert-manager.io
      kinds:
      - CertificateRequest
    ### Cilium internal resources excluded reduce the number of watched events and UI Clutter
    - apiGroups:
      - cilium.io
      kinds:
      - CiliumIdentity
      - CiliumEndpoint
      - CiliumEndpointSlice
    ### Kyverno intermediate and reporting resources excluded reduce the number of watched events and improve performance
    - apiGroups:
      - kyverno.io
      - reports.kyverno.io
      - wgpolicyk8s.io
      kinds:
      - PolicyReport
      - ClusterPolicyReport
      - EphemeralReport
      - ClusterEphemeralReport
      - AdmissionReport
      - ClusterAdmissionReport
      - BackgroundScanReport
      - ClusterBackgroundScanReport
      - UpdateRequest
kind: ConfigMap
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","data":{"resource.customizations.ignoreResourceUpdates.ConfigMap":"jqPathExpressions:\n  # Ignore the cluster-autoscaler status\n  - '.metadata.annotations.\"cluster-autoscaler.kubernetes.io/last-updated\"'\n  # Ignore the annotation of the legacy Leases election\n  - '.metadata.annotations.\"control-plane.alpha.kubernetes.io/leader\"'\n","resource.customizations.ignoreResourceUpdates.Endpoints":"jsonPointers:\n  - /metadata\n  - /subsets\n","resource.customizations.ignoreResourceUpdates.all":"jsonPointers:\n  - /status\n","resource.customizations.ignoreResourceUpdates.apps_ReplicaSet":"jqPathExpressions:\n  - '.metadata.annotations.\"deployment.kubernetes.io/desired-replicas\"'\n  - '.metadata.annotations.\"deployment.kubernetes.io/max-replicas\"'\n  - '.metadata.annotations.\"rollout.argoproj.io/desired-replicas\"'\n","resource.customizations.ignoreResourceUpdates.argoproj.io_Application":"jqPathExpressions:\n  - '.metadata.annotations.\"notified.notifications.argoproj.io\"'\n  - '.metadata.annotations.\"argocd.argoproj.io/refresh\"'\n  - '.metadata.annotations.\"argocd.argoproj.io/hydrate\"'\n  - '.operation'\n","resource.customizations.ignoreResourceUpdates.argoproj.io_Rollout":"jqPathExpressions:\n  - '.metadata.annotations.\"notified.notifications.argoproj.io\"'\n","resource.customizations.ignoreResourceUpdates.autoscaling_HorizontalPodAutoscaler":"jqPathExpressions:\n  - '.metadata.annotations.\"autoscaling.alpha.kubernetes.io/behavior\"'\n  - '.metadata.annotations.\"autoscaling.alpha.kubernetes.io/conditions\"'\n  - '.metadata.annotations.\"autoscaling.alpha.kubernetes.io/metrics\"'\n  - '.metadata.annotations.\"autoscaling.alpha.kubernetes.io/current-metrics\"'\n","resource.customizations.ignoreResourceUpdates.discovery.k8s.io_EndpointSlice":"jsonPointers:\n  - /metadata\n  - /endpoints\n  - /ports\n","resource.exclusions":"### Network resources created by the Kubernetes control plane and excluded to reduce the number of watched events and UI clutter\n- apiGroups:\n  - ''\n  - discovery.k8s.io\n  kinds:\n  - Endpoints\n  - EndpointSlice\n### Internal Kubernetes resources excluded reduce the number of watched events\n- apiGroups:\n  - coordination.k8s.io\n  kinds:\n  - Lease\n### Internal Kubernetes Authz/Authn resources excluded reduce the number of watched events\n- apiGroups:\n  - authentication.k8s.io\n  - authorization.k8s.io\n  kinds:\n  - SelfSubjectReview\n  - TokenReview\n  - LocalSubjectAccessReview\n  - SelfSubjectAccessReview\n  - SelfSubjectRulesReview\n  - SubjectAccessReview\n### Intermediate Certificate Request excluded reduce the number of watched events\n- apiGroups:\n  - certificates.k8s.io\n  kinds:\n  - CertificateSigningRequest\n- apiGroups:\n  - cert-manager.io\n  kinds:\n  - CertificateRequest\n### Cilium internal resources excluded reduce the number of watched events and UI Clutter\n- apiGroups:\n  - cilium.io\n  kinds:\n  - CiliumIdentity\n  - CiliumEndpoint\n  - CiliumEndpointSlice\n### Kyverno intermediate and reporting resources excluded reduce the number of watched events and improve performance\n- apiGroups:\n  - kyverno.io\n  - reports.kyverno.io\n  - wgpolicyk8s.io\n  kinds:\n  - PolicyReport\n  - ClusterPolicyReport\n  - EphemeralReport\n  - ClusterEphemeralReport\n  - AdmissionReport\n  - ClusterAdmissionReport\n  - BackgroundScanReport\n  - ClusterBackgroundScanReport\n  - UpdateRequest\n"},"kind":"ConfigMap","metadata":{"labels":{"app.kubernetes.io/name":"argocd-cm","app.kubernetes.io/part-of":"argocd"},"name":"argocd-cm","namespace":"argocd"}}
  creationTimestamp: "2026-06-13T05:58:21Z"
  labels:
    app.kubernetes.io/name: argocd-cm
    app.kubernetes.io/part-of: argocd
  name: argocd-cm
  namespace: argocd
  resourceVersion: "755"
  uid: 7dde9a7c-e155-40e9-9287-fba342970242

sshkeys.generators.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
generatorstates.generators.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
stssessiontokens.generators.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
mfas.generators.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
grafanas.generators.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
cloudsmithaccesstokens.generators.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
quayaccesstokens.generators.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
clustergenerators.generators.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
uuids.generators.external-secrets.io NamesAccepted=False:ShortNamesConflict Established=True:InitialNamesAccepted
gcraccesstokens.generators.external-secrets.io NamesAccepted=False:ShortNamesConflict Established=True:InitialNamesAccepted
acraccesstokens.generators.external-secrets.io NamesAccepted=False:ShortNamesConflict Established=True:InitialNamesAccepted
githubaccesstokens.generators.external-secrets.io NamesAccepted=False:ShortNamesConflict Established=True:InitialNamesAccepted
webhooks.generators.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
fakes.generators.external-secrets.io NamesAccepted=False:ShortNamesConflict Established=True:InitialNamesAccepted
ecrauthorizationtokens.generators.external-secrets.io NamesAccepted=False:ShortNamesConflict Established=True:InitialNamesAccepted
vaultdynamicsecrets.generators.external-secrets.io NamesAccepted=False:ShortNamesConflict Established=True:InitialNamesAccepted
passwords.generators.external-secrets.io NamesAccepted=False:ShortNamesConflict Established=True:InitialNamesAccepted
pushsecrets.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
clusterexternalsecrets.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
clustersecretstores.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
externalsecrets.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
secretstores.external-secrets.io NamesAccepted=True:NoConflicts Established=True:InitialNamesAccepted
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T21:20:32Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T22:01:18Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T22:01:18Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T22:01:18Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T22:01:18Z" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "2026-06-16T22:01:18Z" not found

/bin/bash -lc "sed -n '1,160p' applications/platform/external-secrets.yaml && git status --short"

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: platform-external-secrets
  namespace: argocd
spec:
  project: platform
  source:
    repoURL: https://charts.external-secrets.io
    chart: external-secrets
    targetRevision: 0.10.5
    helm:
      releaseName: external-secrets
      values: |
        installCRDs: true
  destination:
    server: https://192.168.20.40:6443
    namespace: external-secrets
  syncPolicy:
    automated:
      prune: false
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true