Harden Argo reconciliation on Kubernetes 1.36

.gitignore

@@ -1,3 +1,7 @@
 
 # bootstrap secret values — delivered via Omni, never committed
 omni/secrets.env
+
+# A literal $HOME can be created by misconfigured CLI environments; it may
+# contain local credentials and must never be staged.
+/$HOME/

appset.yaml

@@ -82,3 +82,6 @@ spec:
           selfHeal: true
         syncOptions:
           - CreateNamespace=true
+          # Allow a CRD-owning chart to establish its custom resource type when
+          # API discovery lags a cold-cluster bootstrap.
+          - SkipDryRunOnMissingResource=true

bootstrap/argocd-cm.yaml

@@ -10,10 +10,59 @@ metadata:
     app.kubernetes.io/name: argocd-cm
     app.kubernetes.io/part-of: argocd
 data:
+  # Argo CD 3 defaults to annotation tracking. Keep the established label
+  # tracking during this upgrade so existing resources are not orphaned.
+  application.resourceTrackingMethod: label
   resource.exclusions: |
+    # Keep Argo CD 3's default high-churn exclusions while preserving the
+    # pre-existing CiliumIdentity exclusion.
+    - apiGroups:
+        - ''
+        - discovery.k8s.io
+      kinds:
+        - Endpoints
+        - EndpointSlice
+    - apiGroups:
+        - coordination.k8s.io
+      kinds:
+        - Lease
+    - apiGroups:
+        - authentication.k8s.io
+        - authorization.k8s.io
+      kinds:
+        - SelfSubjectReview
+        - TokenReview
+        - LocalSubjectAccessReview
+        - SelfSubjectAccessReview
+        - SelfSubjectRulesReview
+        - SubjectAccessReview
+    - apiGroups:
+        - certificates.k8s.io
+      kinds:
+        - CertificateSigningRequest
+    - apiGroups:
+        - cert-manager.io
+      kinds:
+        - CertificateRequest
     - apiGroups:
         - cilium.io
       kinds:
         - CiliumIdentity
+        - CiliumEndpoint
+        - CiliumEndpointSlice
+    - apiGroups:
+        - kyverno.io
+        - reports.kyverno.io
+        - wgpolicyk8s.io
+      kinds:
+        - PolicyReport
+        - ClusterPolicyReport
+        - EphemeralReport
+        - ClusterEphemeralReport
+        - AdmissionReport
+        - ClusterAdmissionReport
+        - BackgroundScanReport
+        - ClusterBackgroundScanReport
+        - UpdateRequest
       clusters:
         - "*"