fix zitadel deployment phases

deployment/zitadel/cert-job.yaml

@@ -3,6 +3,7 @@ kind: ServiceAccount
 metadata:
   name: zitadel-cert-creator
   annotations: 
+    argocd.argoproj.io/hook: Sync
     argocd.argoproj.io/sync-wave: "2"
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -19,6 +20,7 @@ kind: RoleBinding
 metadata:
   name: zitadel-cert-creator
   annotations: 
+    argocd.argoproj.io/hook: Sync
     argocd.argoproj.io/sync-wave: "2"
 subjects:
   - kind: ServiceAccount
@@ -33,6 +35,7 @@ kind: Job
 metadata:
   name: create-zitadel-cert
   annotations: 
+    argocd.argoproj.io/hook: Sync
     argocd.argoproj.io/sync-wave: "2"
 spec:
   template:

deployment/zitadel/cockroach-values.yaml

@@ -1,3 +1,5 @@
 tls:
   enabled: true
-  
+  
+annotations:
+  argocd.argoproj.io/hook: Sync

deployment/zitadel/kustomization.yaml

@@ -32,6 +32,13 @@ patches:
       - op: add
         path: /metadata/annotations/argocd.argoproj.io~1sync-wave
         value: 3
+  - target:
+      name: zitadel-setup
+      kind: Job
+    patch: |
+      - op: add
+        path: /metadata/annotations/argocd.argoproj.io~1hook
+        value: Sync
   - target:
       name: zitadel-init
       kind: Job
@@ -39,3 +46,10 @@ patches:
       - op: add
         path: /metadata/annotations/argocd.argoproj.io~1sync-wave
         value: 3
+  - target:
+      name: zitadel-init
+      kind: Job
+    patch: |
+      - op: add
+        path: /metadata/annotations/argocd.argoproj.io~1hook
+        value: Sync

deployment/zitadel/secrets.yaml

@@ -3,7 +3,7 @@ kind: Secret
 metadata:
   name: zitadel-masterkey
   annotations:
-    argocd.argoproj.io/sync-wave: "2"
+    argocd.argoproj.io/hook: PreSync
   labels:
     secret-generator.cs.sap.com/enabled: "true"
 stringData: 
@@ -14,7 +14,7 @@ kind: Secret
 metadata:
   name: cockroach-auth
   annotations:
-    argocd.argoproj.io/sync-wave: "2"
+    argocd.argoproj.io/hook: PreSync
   labels:
     secret-generator.cs.sap.com/enabled: "true"
 stringData:

deployment/zitadel/values.yaml

@@ -18,8 +18,11 @@ zitadel:
   dbSslCaCrtSecret: db-cockroachdb-ca-secret
   dbSslAdminCrtSecret: db-cockroachdb-client-secret
   dbSslUserCrtSecret: db-cockroachdb-zitadel-secret
+
 annotations: 
   argocd.argoproj.io/sync-wave: "3"
+  argocd.argoproj.io/hook: Sync
+
 env:
   - name: ZITADEL_DATABASE_COCKROACH_USER_PASSWORD
     valueFrom: