ESO fix?

charts/external-secrets/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
 name: external-secrets-config
-description: ClusterSecretStore and supporting resources for ESO
+description: ClusterSecretStore for AWS Secrets Manager via EC2 instance role
 type: application
 version: 0.1.0

charts/external-secrets/templates/cluster-secret-store.yaml

@@ -1,14 +1,18 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: selfsigned
+  namespace: external-secrets
+spec:
+  selfSigned: {}
+---
 apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
 metadata:
   name: aws-secrets-manager
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
 spec:
   provider:
     aws:
       service: SecretsManager
-      region: {{ .Values.awsRegion }}
+      region: us-east-1
-      auth:
+      # No auth block - uses EC2 instance role via AWS SDK default credential chain (IMDS)
-        # Uses EC2 instance role via IMDS (instance metadata service)
-        # No credentials needed - the node role has secretsmanager:GetSecretValue

charts/external-secrets/values.yaml

@@ -1,5 +1,3 @@
-# External Secrets Operator helm values
-# Uses EC2 instance role for AWS auth - no credentials needed
 installCRDs: true
 
 certController:

manifests/cluster/external-secrets.yaml

@@ -14,7 +14,6 @@ spec:
       targetRevision: "*"
       helm:
         valueFiles:
-          - $values/values.yaml
           - $values/charts/external-secrets/values.yaml
   destination:
     server: https://kubernetes.default.svc
@@ -26,3 +25,30 @@ spec:
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-secrets-config
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
+    targetRevision: HEAD
+    path: charts/external-secrets
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-secrets
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+      retry:
+        limit: 10
+        backoff:
+          duration: 30s
+          maxDuration: 5m
+          factor: 2
+    syncOptions:
+      - CreateNamespace=true