GitLab cross-site replication Phase 2a (corrected): ignoreDifferences approach

The CONFIG_TEMPLATE_DIRECTORY redirect from the previous commit doesn't
work - confirmed live that extraVolumes is a dead values key for the
Praefect subchart specifically (its statefulset.yaml never calls the
gitlab.extraVolumes helper in its volumes: list, only volumeMounts
calls the corresponding helper - a real chart limitation, not a config
mistake). A dangling volumeMount with no matching volume would have
failed to schedule.

Real fix: ignoreDifferences on ConfigMap gitlab-praefect's data field
(argocd-apps/apps/gitlab.yaml) lets Helm create the object normally
while ArgoCD stops reconciling its content afterward - the actual
config gets kubectl-patched onto the live object directly.
praefect-ha-configmap.yaml is now a git-tracked reference/documentation
copy (deployed under its own harmless name) rather than something
Helm/ArgoCD wires in on its own.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/gitlab/manifests/praefect-ha-configmap.yaml

@@ -1,4 +1,4 @@
-# GitLab cross-site replication Phase 2a (see
+# GitLab cross-site replication (see
 # /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - the chart has
 # no support for registering an externally-hosted Gitaly node into an
 # existing Praefect virtual storage (confirmed live: no
@@ -6,24 +6,34 @@
 # gitalyReplicas just counts StatefulSet ordinals). Overriding Praefect's
 # rendered config.toml is the only way to add one.
 #
-# The chart's own gitlab-praefect ConfigMap (auto-rendered from
-# global.praefect.virtualStorages) is mounted at /etc/gitaly/templates,
-# which CONFIG_TEMPLATE_DIRECTORY already points at - can't just add data
-# to that SAME ConfigMap (ArgoCD/Helm fully owns and would revert it),
-# and can't mount a second volume at the SAME path/name (Kubernetes
-# rejects duplicate volume names). So this ConfigMap mounts at a
-# DIFFERENT path (values.yaml's gitlab.praefect.extraVolumes), and
-# CONFIG_TEMPLATE_DIRECTORY gets overridden via extraEnv to point at it
-# instead - env var duplicate-key "last wins" IS legitimate documented
-# Kubernetes behavior for a container's env: list, unlike volumes.
+# A values-only CONFIG_TEMPLATE_DIRECTORY redirect (extraEnv +
+# extraVolumes/extraVolumeMounts) was tried first and confirmed NOT to
+# work: charts/gitlab/charts/praefect/templates/statefulset.yaml's own
+# volumes: list never calls the gitlab.extraVolumes helper (only
+# volumeMounts does) - a chart limitation specific to this subchart, no
+# values-only fix exists.
 #
-# Phase 2a content is intentionally byte-identical to the chart's own
-# current rendering (confirmed live via `kubectl -n gitlab get cm
-# gitlab-praefect -o jsonpath='{.data.config\.toml\.tpl}'`) - this
-# commit only proves the override mechanism itself doesn't break
-# anything, before Phase 2b switches addressing to floating hostnames
-# and adds the VPS as a 4th node (no reason to change addressing scheme
-# before there's an actual cross-site node that needs it).
+# THIS ConfigMap (praefect-ha-config) is deployed as a harmless,
+# otherwise-unused object - it exists purely as a git-tracked reference
+# copy of the content that actually matters. The REAL live config lives
+# on the chart's own gitlab-praefect ConfigMap, which
+# argocd-apps/apps/gitlab.yaml's ignoreDifferences now exempts from
+# ArgoCD's normal drift-reconciliation (its `data` field specifically) -
+# apply this file's content to it directly:
+#   kubectl -n gitlab patch configmap gitlab-praefect --type merge \
+#     -p "{\"data\":{\"config.toml.tpl\":\"$(kubectl -n gitlab get cm \
+#     praefect-ha-config -o jsonpath='{.data.config\.toml\.tpl}' | \
+#     python3 -c 'import sys,json; print(json.dumps(sys.stdin.read())[1:-1])')\"}}"
+# (or simpler: kubectl -n gitlab get cm praefect-ha-config -o
+# jsonpath='{.data}' | kubectl -n gitlab patch cm gitlab-praefect --type
+# merge -p "{\"data\":$(cat -)}")
+#
+# Content below is intentionally byte-identical to the chart's own
+# current rendering for the first pass (confirmed live via `kubectl -n
+# gitlab get cm gitlab-praefect -o jsonpath='{.data.config\.toml\.tpl}'`)
+# - proves the ignoreDifferences + manual-patch mechanism itself doesn't
+# break anything, before a follow-up switches addressing to floating
+# hostnames and adds the VPS as a 4th node.
 apiVersion: v1
 kind: ConfigMap
 metadata: