Simplify ESO chart organization

charts/external-secrets/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
 name: external-secrets-config
-description: ClusterSecretStore for AWS Secrets Manager via EC2 instance role
+description: ClusterSecretStore and supporting resources for ESO
 type: application
 version: 0.1.0

charts/external-secrets/templates/cluster-secret-store.yaml

@@ -2,6 +2,8 @@ apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
 metadata:
   name: aws-secrets-manager
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
 spec:
   provider:
     aws:

charts/external-secrets/values.yaml

@@ -1,7 +1,5 @@
 # External Secrets Operator helm values
 # Uses EC2 instance role for AWS auth - no credentials needed
-# cert-manager handles webhook TLS with a self-signed issuer (internal cluster DNS,
-# not publicly routable - Let's Encrypt cannot issue for these names)
 installCRDs: true
 
 certController:

manifests/cluster/external-secrets.yaml

@@ -14,6 +14,7 @@ spec:
       targetRevision: "*"
       helm:
         valueFiles:
+          - $values/values.yaml
           - $values/charts/external-secrets/values.yaml
   destination:
     server: https://kubernetes.default.svc
@@ -25,31 +26,3 @@ spec:
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
----
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: external-secrets-config
-  namespace: argocd
-spec:
-  project: default
-  sources:
-    - repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
-      targetRevision: HEAD
-      ref: values
-    - repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
-      targetRevision: HEAD
-      path: charts/external-secrets
-      helm:
-        valueFiles:
-          - $values/values.yaml
-        releaseName: external-secrets-config
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: external-secrets
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true