fix: convert one-time jobs to Helm hooks to prevent ArgoCD OutOfSync

helm/templates/backfill-job.yaml

@@ -16,31 +16,19 @@
   immediately upon helm install to capture existing resources without waiting
   for the first scheduled run.
 
-  Helm hooks (post-install, hook-delete-policy) were tried, but rejected because
-  they require Helm-specific features that don't work with helm template,
-  kubectl apply, ArgoCD, Flux, or other GitOps tools
+  The one-time Job uses Helm hooks (pre-install, pre-upgrade) so that it is not
+  tracked as a managed resource by ArgoCD or Helm, preventing OutOfSync errors
+  when the job completes and is deleted. The CronJob is left as a standard
+  resource as it manages its own lifecycle.
+
+  Note: ArgoCD must be configured with --enable-helm-hooks for hooks to run.
 
   The implementation uses a range loop with small if/else clauses to maximize
   code reuse while handling the minimal differences between CronJob and Job
   specifications.
 */ -}}
 {{- range $jobType := list "CronJob" "Job" }}
 {{- $jobCategory := ternary "cronjob" "onetime" (eq $jobType "CronJob") }}
-{{- /*
-  Istio mTLS Port Exclusion
-
-  When Istio is detected and cert-manager is not in use, exclude port 443 from
-  Envoy proxying. The backfill job connects to the webhook service on port 443
-  (the service port, which Kubernetes routes to pod port 8443). Without this
-  exclusion, Istio wraps the connection in mTLS, but the webhook uses a
-  self-signed certificate that Istio doesn't recognize, causing TLS failures.
-
-  Port 443 is excluded (not 8443) because Istio's sidecar intercepts outbound
-  traffic based on the destination port the application connects to - the
-  service port, not the pod's target port.
-
-  See helm/docs/istio.md for full documentation.
-*/ -}}
 {{- $istioAnnotations := dict -}}
 {{- if and (include "cloudzero-agent.Values.integrations.istio.enabled" $) (not $.Values.insightsController.tls.useCertManager) -}}
 {{- $istioAnnotations = dict "traffic.sidecar.istio.io/excludeOutboundPorts" "443" -}}
@@ -57,6 +45,7 @@ metadata:
         $.Values.initBackfillJob.annotations
         $.Values.components.webhookServer.annotations
         $.Values.components.webhookServer.backfill.annotations
+        (ternary (dict "helm.sh/hook" "pre-install,pre-upgrade" "helm.sh/hook-delete-policy" "before-hook-creation") (dict) (eq $jobType "Job"))
       )
     ) | nindent 2 }}
   {{- include "cloudzero-agent.generateLabels" (dict

helm/templates/config-loader-job.yaml

@@ -9,6 +9,8 @@ metadata:
         .Values.defaults.annotations
         .Values.components.miscellaneous.configLoader.annotations
         (dict "checksum/values" (include "cloudzero-agent.configurationChecksum" .))
+        (dict "helm.sh/hook" "pre-install,pre-upgrade")
+        (dict "helm.sh/hook-delete-policy" "before-hook-creation")
       )
     ) | nindent 2 }}
   {{- include "cloudzero-agent.generateLabels" (dict

helm/templates/helmless-job.yaml

@@ -8,6 +8,8 @@ metadata:
       "annotations" (list
         .Values.defaults.annotations
         .Values.components.miscellaneous.helmless.annotations
+        (dict "helm.sh/hook" "pre-install,pre-upgrade")
+        (dict "helm.sh/hook-delete-policy" "before-hook-creation")
       )
     ) | nindent 2 }}
   {{- include "cloudzero-agent.generateLabels" (dict

helm/templates/init-cert-job.yaml

@@ -11,8 +11,10 @@ metadata:
         .Values.defaults.annotations
         .Values.initCertJob.annotations
         .Values.components.miscellaneous.initCert.annotations
+        (dict "helm.sh/hook" "pre-install,pre-upgrade")
+        (dict "helm.sh/hook-delete-policy" "before-hook-creation")
       )
-    ) | nindent 2 }}
+  ) | nindent 2 }}
   {{- include "cloudzero-agent.generateLabels" (dict
       "root" .
       "name" "init-cert"