From 0197e2ab423777409f9f5e86572e0efcd35a6964 Mon Sep 17 00:00:00 2001
From: Ian Keane <ian@keane.sh>
Date: Wed, 19 Aug 2026 10:54:03 -0400
Subject: [PATCH] ESO fix?

---
 charts/external-secrets/Chart.yaml            |  2 +-
 .../templates/cluster-secret-store.yaml       | 16 +++++++----
 charts/external-secrets/values.yaml           |  2 --
 manifests/cluster/external-secrets.yaml       | 28 ++++++++++++++++++-
 4 files changed, 38 insertions(+), 10 deletions(-)

diff --git a/charts/external-secrets/Chart.yaml b/charts/external-secrets/Chart.yaml
index 571ba43..e1fd94e 100644
--- a/charts/external-secrets/Chart.yaml
+++ b/charts/external-secrets/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v2
 name: external-secrets-config
-description: ClusterSecretStore and supporting resources for ESO
+description: ClusterSecretStore for AWS Secrets Manager via EC2 instance role
 type: application
 version: 0.1.0
diff --git a/charts/external-secrets/templates/cluster-secret-store.yaml b/charts/external-secrets/templates/cluster-secret-store.yaml
index 9b1f77f..332b96d 100644
--- a/charts/external-secrets/templates/cluster-secret-store.yaml
+++ b/charts/external-secrets/templates/cluster-secret-store.yaml
@@ -1,14 +1,18 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: selfsigned
+  namespace: external-secrets
+spec:
+  selfSigned: {}
+---
 apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
 metadata:
   name: aws-secrets-manager
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
 spec:
   provider:
     aws:
       service: SecretsManager
-      region: {{ .Values.awsRegion }}
-      auth:
-        # Uses EC2 instance role via IMDS (instance metadata service)
-        # No credentials needed - the node role has secretsmanager:GetSecretValue
+      region: us-east-1
+      # No auth block - uses EC2 instance role via AWS SDK default credential chain (IMDS)
diff --git a/charts/external-secrets/values.yaml b/charts/external-secrets/values.yaml
index 9199b0b..9a30b93 100644
--- a/charts/external-secrets/values.yaml
+++ b/charts/external-secrets/values.yaml
@@ -1,5 +1,3 @@
-# External Secrets Operator helm values
-# Uses EC2 instance role for AWS auth - no credentials needed
 installCRDs: true
 
 certController:
diff --git a/manifests/cluster/external-secrets.yaml b/manifests/cluster/external-secrets.yaml
index d8e3c28..b4bc2e4 100644
--- a/manifests/cluster/external-secrets.yaml
+++ b/manifests/cluster/external-secrets.yaml
@@ -14,7 +14,6 @@ spec:
       targetRevision: "*"
       helm:
         valueFiles:
-          - $values/values.yaml
           - $values/charts/external-secrets/values.yaml
   destination:
     server: https://kubernetes.default.svc
@@ -26,3 +25,30 @@ spec:
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-secrets-config
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
+    targetRevision: HEAD
+    path: charts/external-secrets
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-secrets
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+      retry:
+        limit: 10
+        backoff:
+          duration: 30s
+          maxDuration: 5m
+          factor: 2
+    syncOptions:
+      - CreateNamespace=true