New Pods failed with CreateContainerConfigError while old ones kept running. A key renamed in the cloud secret store made External Secrets rewrite the Kubernetes Secret without DATABASE_URL. We show how to find the missing key fast and how to fail before rollout next time.
After adding one environment variable in values-prod.yaml, production pods lost six others defined in the chart's defaults, including the database host. Helm deep-merges maps but replaces lists entirely. How we spotted it with helm template diffs and restructured values so overrides merge.
Helm 4 is the first major Helm release in six years. We moved forty charts and three deployment pipelines from Helm 3. Notes on what changed for us in practice: server-side apply and field ownership, the new kstatus-based waiting, the plugin system, CLI changes, and the test plan that caught problems before production.
We went from one cluster to nine and our Argo CD setup stopped scaling: hundreds of hand-written Application manifests and one controller everyone depended on. How app of apps and ApplicationSet compare, hub-and-spoke versus an Argo CD per cluster, and the layout we settled on.
GitOps says everything lives in Git, and secrets are the exception that breaks the rule. This guide compares encrypting secrets in Git with SOPS or Sealed Secrets against referencing them from a secret manager with External Secrets Operator or the CSI driver, including rotation and bootstrap.
We lowered a rate limit in a ConfigMap, Argo CD reported Synced, and the service kept using the old limit for two days. Environment variables from ConfigMaps are read once at container start, and our file mount used subPath, which never updates. A checksum annotation fixed rollouts.
A release added a column and our new Pods went Ready and served traffic before the migration Job had even connected to the database. Argo CD applies everything in one wave together. We moved the migration into a PreSync hook, ordered dependencies with sync waves, and show a runnable repro.
Half our Argo CD applications showed OutOfSync seconds after every successful sync, and auto-sync kept fighting the HPA over replica counts. The live objects had fields set by controllers and webhooks that Git never mentioned. Targeted ignoreDifferences and server-side diff fixed it.