ArgoCD Sync Waves — resources per wave, per service¶
Exactly which resources ArgoCD creates, and in what order, for each ASK service. Generated by rendering
each chart (helm template with the mod-auh1-dev-ask values) and reading the
argocd.argoproj.io/sync-wave and hook annotations — so it reflects what actually deploys.
How to read this¶
ArgoCD applies resources in phases, and within a phase in wave order (low → high):
- PreSync — runs before the main apply. Used here for DB bootstrap (create the role/DB before the
app needs it) and Zitadel setup. Helm
pre-install/pre-upgradehooks become PreSync; theirhelm.sh/hook-weightbecomes the wave. - Sync — the main apply. Negative waves run first (e.g. wave
-2ConfigMaps before wave0). Typical pattern: config/SA/Service (wave 0) → datastore + migration (wave 1) → app Deployments (wave 2). - PostSync — after everything is healthy (none of our services use it yet).
- Delete-only —
post-delete/pre-deletehooks; run on uninstall, not normal sync.
Reproduce
helm template <rel> . -f environments/values-mod-auh1-dev-ask.yaml | grep -B2 sync-wave
(or the parser in /tmp/wave2.py used to build this page). Re-run after chart changes.
assistant-service¶
| Phase | Wave | Kind | Resource name | Purpose |
|---|---|---|---|---|
| PreSync | −2 | ConfigMap | assistant-service-postgres-connection |
DB connection info for the init Job |
| PreSync | −2 | ConfigMap | assistant-service-postgres-init-script |
SQL to create the DB/role |
| PreSync | −1 | Job | assistant-service-postgres-role-init |
creates the role/DB on core-pg |
| Sync | 0 | ConfigMap | assistant-service-config-toml |
Dynaconf app config |
| Sync | 0 | ConfigMap | assistant-service-mcp-gateway |
MCP gateway config |
| Sync | 0 | ExternalSecret | assistant-service-external-secret |
Vault → assistant-service-secret |
| Sync | 0 | ServiceAccount | assistant-service |
pod identity |
| Sync | 0 | Service | assistant-service |
main API (ClusterIP) |
| Sync | 0 | Service | assistant-service-intelligence |
RAG/intelligence |
| Sync | 0 | Service | assistant-service-tooling |
ToolBus |
| Sync | 0 | Ingress | assistant-service |
external route /ask71/v2/astsvc |
| Sync | 0 | PodDisruptionBudget | assistant-service, -intelligence, -tooling |
availability (3 PDBs) |
| Sync | 0 | Deployment | assistant-service-generic-worker |
Hatchet worker |
| Sync | 1 | StatefulSet | assistant-service-redis-master |
Redis (cache/pubsub) |
| Sync | 1 | ConfigMap/Service/SA/PDB/NetworkPolicy | assistant-service-redis-* |
Redis support objects |
| Sync | 1 | Job | assistant-service-migration |
alembic upgrade head |
| Sync | 2 | Deployment | assistant-service |
main API |
| Sync | 2 | Deployment | assistant-service-intelligence |
RAG/intelligence |
| Sync | 2 | Deployment | assistant-service-tooling |
ToolBus |
| Sync | 2 | HorizontalPodAutoscaler | assistant-service, -intelligence, -tooling |
autoscaling (3 HPAs) |
knowledge-management-service (KMS)¶
| Phase | Wave | Kind | Resource name | Purpose |
|---|---|---|---|---|
| PreSync | −2 | ConfigMap | knowledge-management-service-postgres-connection |
DB connection for init Job |
| PreSync | −2 | ConfigMap | knowledge-management-service-postgres-init-script |
SQL to create DB/role |
| PreSync | −1 | Job | knowledge-management-service-postgres-role-init |
role/DB on knowledge-pg |
| Sync | 0 | ConfigMap | knowledge-management-service-config-toml |
Dynaconf app config |
| Sync | 0 | ConfigMap | weaviate-config |
Weaviate config |
| Sync | 0 | ExternalSecret | knowledge-management-service-external-secret |
Vault → …-secret |
| Sync | 0 | Secret | weaviate-cluster-api-basic-auth |
Weaviate cluster auth |
| Sync | 0 | ServiceAccount | knowledge-management-service, -weaviate |
pod identities |
| Sync | 0 | Service | knowledge-management-service |
KMS API |
| Sync | 0 | Service | weaviate, weaviate-grpc, weaviate-headless |
vector DB endpoints |
| Sync | 0 | StatefulSet | weaviate |
vector database |
| Sync | 1 | Job | knowledge-management-service-migration |
alembic upgrade head |
| Sync | 2 | Deployment | knowledge-management-service |
FastAPI API |
| Sync | 2 | Deployment | knowledge-management-service-ingestion-worker |
batch ingestion |
| Sync | 2 | Deployment | knowledge-management-service-generic-worker |
metrics/connector sync |
| Sync | 2 | Deployment | knowledge-management-service-live-ingestion-worker |
streaming ingestion |
core-service¶
| Phase | Wave | Kind | Resource name | Purpose |
|---|---|---|---|---|
| PreSync | −2 | ConfigMap | core-service-postgres-connection / -init-script |
core DB connection + SQL |
| PreSync | −2 | ConfigMap | core-service-zitadel-zitadel-postgres-connection / -init-script |
Zitadel DB connection + SQL |
| PreSync | −1 | Job | core-service-postgres-role-init |
core role/DB |
| PreSync | −1 | Job | core-service-zitadel-zitadel-postgres-role-init |
Zitadel role/DB |
| PreSync | 0 | ConfigMap | core-service-zitadel-config-yaml / -login-config-dotenv |
Zitadel + login config |
| PreSync | 0 | ServiceAccount | core-service-zitadel, -login |
Zitadel pod identities |
| PreSync | 0 | Role / RoleBinding | core-service-zitadel |
Zitadel RBAC (for setup job) |
| PreSync | 1 | Job | core-service-zitadel-init |
Zitadel DB init |
| PreSync | 2 | Job | core-service-zitadel-setup |
Zitadel instance/org setup |
| Sync | 0 | ConfigMap | core-service-config-toml |
Dynaconf app config |
| Sync | 0 | ConfigMap | core-service-model-config |
model catalog (models.yml) |
| Sync | 0 | ServiceAccount | core-service |
pod identity |
| Sync | 0 | Service | core-service, -zitadel, -zitadel-login |
API + Zitadel + login |
| Sync | 0 | Deployment | core-service-zitadel |
Zitadel IAM server |
| Sync | 0 | Deployment | core-service-zitadel-login |
Zitadel login UI |
| Sync | 0 | Ingress | core-service, -zitadel, -zitadel-login |
external routes |
| Sync | 4 | Job | core-service-migrations |
alembic upgrade head |
| Sync | 5 | Deployment | core-service |
core API |
| Sync | 6 | HorizontalPodAutoscaler | core-service |
autoscaling |
| Delete-only | −1 | Job | core-service-zitadel-cleanup |
post-delete hook — uninstall only |
frontend (ASK Web UI)¶
| Phase | Wave | Kind | Resource name | Purpose |
|---|---|---|---|---|
| Sync | 0 | ServiceAccount | frontend |
pod identity |
| Sync | 0 | ExternalSecret | frontend-external-secret |
Vault → frontend-secret (AUTH_SECRET, BILLING_API_KEY) |
| Sync | 0 | Service | frontend |
ClusterIP (80 → 3000) |
| Sync | 0 | Ingress | frontend |
ask.mod.auh1.dev.dir |
| Sync | 0 | Deployment | frontend |
Next.js SSR app |
(The frontend is a single Deployment — no DB bootstrap, migration, or sub-charts, so everything lands in wave 0.)
Cross-service pattern¶
| Wave bucket | Purpose | Who has it |
|---|---|---|
| PreSync (−2 → −1) | DB connection ConfigMaps → role-init Job (create DB/role on the CNPG cluster before the app) | assistant, KMS, core |
| PreSync (0 → 2) | Zitadel RBAC/config → init → setup | core only |
| Sync 0 | config, secret (ExternalSecret), SA, Service, Ingress | all |
| Sync 1 | datastore (Redis STS / Weaviate already at 0) + migration Job | assistant, KMS |
| Sync 2 (core: 5) | app Deployments + HPA | all backends |
Why this order matters: the role-init Job (PreSync) must finish before the migration Job (Sync 1),
which must finish before the app Deployments (Sync 2) — otherwise the app starts against a DB with no
schema. The ExternalSecret lands at wave 0 so the secret exists before the Deployments mount it (which
is why the ESO Vault policy must already be in place — a 403 there means the secret never materialises
and wave 2 CrashLoops). See Onboard a Service.