fix(JDWLABS-463): replace truenas-csi controller Deployment so Recreate strategy can sync

[jdwillmsen]

Problem

platform-truenas-csi is stuck OutOfSync:

Deployment.apps "truenas-csi-controller" is invalid: spec.strategy.rollingUpdate: Forbidden: may not be specified when strategy `type` is 'Recreate' (retried 5 times)

The chart template is already correct — helm template with the tenant values renders only strategy: {type: Recreate}. The root cause is on the cluster side: the Deployment was first created before the chart declared a strategy, so the API server defaulted strategy.rollingUpdate with no field manager (managedFields for argocd-controller has no f:strategy entry). The Application syncs with ServerSideApply=true, and SSA only removes fields the applier previously owned, so the unowned rollingUpdate block survives the merge alongside the new type: Recreate and the API server rejects the result.

Fix

Annotate the controller Deployment with argocd.argoproj.io/sync-options: Replace=true in helm-charts/truenas-csi/templates/controller.yaml. A replace submits the whole spec, so no stale server default survives. Recreate is kept as-is: the controller runs a single replica with leader election off, and Recreate is what prevents an old and a new pod from provisioning concurrently during a rollout.

Evidence

Before (read-only):

$ kubectl -n argocd get app platform-truenas-csi -o jsonpath='{.status.sync.status}'
OutOfSync
$ kubectl -n truenas-csi get deploy truenas-csi-controller -o jsonpath='{.spec.strategy}'
{"rollingUpdate":{"maxSurge":"25%","maxUnavailable":"25%"},"type":"RollingUpdate"}

Reproduced and verified with server-side dry runs against the rendered Deployment (nothing persisted):

$ kubectl apply --server-side --field-manager=argocd-controller --dry-run=server -f deploy.yaml
The Deployment "truenas-csi-controller" is invalid: spec.strategy.rollingUpdate: Forbidden: may not be specified when strategy `type` is 'Recreate'
$ kubectl replace --dry-run=server -f deploy.yaml
deployment.apps/truenas-csi-controller replaced (server dry run)

Chart validation: helm lint passes; helm template + kubeconform on the rendered output: 10 resources, 10 valid.

After merge, confirm with kubectl -n argocd get app platform-truenas-csi -o jsonpath='{.status.sync.status}' → Synced, and that the live Deployment strategy is {"type":"Recreate"}.

🤖 Generated with Claude Code

https://claude.ai/code/session_01B6FWEmAs2beQvKnX4LwWN2