A pmm-client sidecar on ProxySQL pods: secrets from Azure Key Vault via an init container, a stable registration name so rollouts don't litter the PMM inventory, and the four things that broke on the way (pmm-admin 3 flags, envsubst, a CA-less image, auto-sync).
Adding one cluster to a round-robin sharded Argo CD left two other clusters owned by no controller replica. 313 Applications froze at their last-known Synced/Healthy status for 57 hours, and CI kept reporting success. Here is how we found it, what the upstream cause turned out to be, and the one-line fix I sent to argo-cd.
After a five-year pause the blog has moved from WordPress.com to Hugo, hosted on Cloudflare Pages with the source on GitHub. All 140 posts, URLs, images and comments came along. Here is what changed and what is coming.