fix: convert one-time jobs to Helm hooks to prevent ArgoCD OutOfSync

[pinkneyj]

Why

When the following Jobs complete and are deleted, ArgoCD marks the application as OutOfSync because it expects them to exist as tracked resources:

• cloudzero-backfill
• cloudzero-confload (config-loader-job.yaml)
• cloudzero-helmless
• cloudzero-init-cert

Additionally, the current approach of embedding a checksum/config in job names to trigger re-runs on config changes creates resource churn and leaves stale Job objects in the cluster.

What

Convert the one-time Jobs to Helm hooks by adding the following annotations:

"helm.sh/hook": pre-install,pre-upgrade
"helm.sh/hook-delete-policy": before-hook-creation

This means:

• Helm runs the jobs before install/upgrade but does not track them as managed resources, so ArgoCD no longer flags their deletion as OutOfSync
• before-hook-creation deletes the previous job run before creating a new one, replacing the need for a checksum/config-based name

The CronJob in backfill-job.yaml is left unchanged as it manages its own lifecycle.

Note on previous hook rejection

A comment in backfill-job.yaml notes that Helm hooks were previously rejected due to incompatibility with helm template, ArgoCD, and Flux. This is addressed as follows:

• ArgoCD: Helm hooks are supported when the ArgoCD server is configured with --enable-helm-hooks
• helm template: Hooks are excluded from helm template output by design. Users relying on helm template | kubectl apply will need to handle these jobs separately or use helm install/upgrade directly
• Flux: Flux's Helm controller supports hooks natively from v0.19+

Files changed

• charts/cloudzero-agent/templates/backfill-job.yaml — Job only (not CronJob)
• charts/cloudzero-agent/templates/config-loader-job.yaml
• charts/cloudzero-agent/templates/helmless-job.yaml
• charts/cloudzero-agent/templates/init-cert-job.yaml

How Tested

Validated the following against a live cluster:

• Deleted the hook jobs post-deployment and confirmed ArgoCD remained Synced with no OutOfSync errors
• Triggered a helm upgrade and confirmed hook jobs were recreated as expected via the before-hook-creation delete policy
• Confirmed the cloudzero-backfill CronJob was untouched and continued to run on its configured schedule