From c5d28ee3b5f14c87c29375be94f72b4f3eb10a76 Mon Sep 17 00:00:00 2001
From: "noussair.hamrit" <noussair.hamrit@helmholz.de>
Date: Wed, 23 Sep 2026 18:04:40 +0200
Subject: [PATCH] add PreSync hook + sync-wave for fully automated on first
 sync

---
 manifests/02-configmap.yaml     | 3 +++
 manifests/05-migration-job.yaml | 1 +
 manifests/secrets.example.yaml  | 9 +++++++++
 3 files changed, 13 insertions(+)

diff --git a/manifests/02-configmap.yaml b/manifests/02-configmap.yaml
index 57f1b96..ab51ee7 100644
--- a/manifests/02-configmap.yaml
+++ b/manifests/02-configmap.yaml
@@ -3,6 +3,9 @@ kind: ConfigMap
 metadata:
   name: nextgen-be-config
   namespace: nextgen-be
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/sync-wave: "-1"  
 data:
   RADIUS_SERVER_IP: "freeradius.freeradius.svc.cluster.local"
   RADIUS_TIMEOUT_SECONDS: "2"
diff --git a/manifests/05-migration-job.yaml b/manifests/05-migration-job.yaml
index d246b1a..b49e4ff 100644
--- a/manifests/05-migration-job.yaml
+++ b/manifests/05-migration-job.yaml
@@ -6,6 +6,7 @@ metadata:
   annotations:
     # ArgoCD: run this before the Deployment is synced, on every sync where it changed
     argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/sync-wave: "0"
     argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
 spec:
   backoffLimit: 2
diff --git a/manifests/secrets.example.yaml b/manifests/secrets.example.yaml
index e2dbcb9..bfe2c8e 100644
--- a/manifests/secrets.example.yaml
+++ b/manifests/secrets.example.yaml
@@ -9,6 +9,9 @@ kind: Secret
 metadata:
   name: nextgen-be-db
   namespace: nextgen-be
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/sync-wave: "-2"
 type: Opaque
 stringData:
   # Get this value with:
@@ -20,6 +23,9 @@ kind: Secret
 metadata:
   name: nextgen-be-jwt
   namespace: nextgen-be
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/sync-wave: "-2"
 type: Opaque
 stringData:
   # Generate with: openssl rand -hex 32
@@ -30,6 +36,9 @@ kind: Secret
 metadata:
   name: nextgen-be-radius
   namespace: nextgen-be
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/sync-wave: "-2"
 type: Opaque
 stringData:
   # Must match the shared secret configured on the FreeRADIUS side