Switch all ExternalSecrets to creationPolicy: Owner

ESO now has full ownership of these secrets.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

argocd/manifests/argocd/external-secret-repo-forge.yaml

@@ -19,7 +19,7 @@ spec:
     name: onepassword-blumeops
   target:
     name: repo-creds-forge
-    creationPolicy: Merge
+    creationPolicy: Owner
     template:
       metadata:
         labels:

argocd/manifests/databases/external-secret-borgmatic.yaml

@@ -17,7 +17,7 @@ spec:
     name: onepassword-blumeops
   target:
     name: blumeops-pg-borgmatic
-    creationPolicy: Merge
+    creationPolicy: Owner
     template:
       type: kubernetes.io/basic-auth
       data:

argocd/manifests/databases/external-secret-eblume.yaml

@@ -17,7 +17,7 @@ spec:
     name: onepassword-blumeops
   target:
     name: blumeops-pg-eblume
-    creationPolicy: Merge
+    creationPolicy: Owner
     template:
       type: kubernetes.io/basic-auth
       data:

argocd/manifests/databases/external-secret-teslamate.yaml

@@ -17,7 +17,7 @@ spec:
     name: onepassword-blumeops
   target:
     name: blumeops-pg-teslamate
-    creationPolicy: Merge
+    creationPolicy: Owner
     template:
       type: kubernetes.io/basic-auth
       data:

argocd/manifests/forgejo-runner/external-secret.yaml

@@ -20,7 +20,7 @@ spec:
     name: onepassword-blumeops
   target:
     name: forgejo-runner-env
-    creationPolicy: Merge
+    creationPolicy: Owner
     template:
       data:
         FORGEJO_URL: "https://forge.ops.eblu.me"

argocd/manifests/grafana-config/external-secret-admin.yaml

@@ -17,7 +17,7 @@ spec:
     name: onepassword-blumeops
   target:
     name: grafana-admin
-    creationPolicy: Merge
+    creationPolicy: Owner
     template:
       data:
         admin-user: admin

argocd/manifests/grafana-config/external-secret-teslamate-datasource.yaml

@@ -20,7 +20,7 @@ spec:
     name: onepassword-blumeops
   target:
     name: grafana-teslamate-datasource
-    creationPolicy: Merge
+    creationPolicy: Owner
     template:
       data:
         TESLAMATE_DB_PASSWORD: "{{ .password }}"

argocd/manifests/tailscale-operator/external-secret.yaml

@@ -17,7 +17,7 @@ spec:
     name: onepassword-blumeops
   target:
     name: operator-oauth
-    creationPolicy: Merge
+    creationPolicy: Owner
   data:
   - secretKey: client_id
     remoteRef:

argocd/manifests/teslamate/external-secret-db.yaml

@@ -17,7 +17,7 @@ spec:
     name: onepassword-blumeops
   target:
     name: teslamate-db
-    creationPolicy: Merge
+    creationPolicy: Owner
   data:
   - secretKey: password
     remoteRef:

argocd/manifests/teslamate/external-secret-encryption-key.yaml

@@ -19,7 +19,7 @@ spec:
     name: onepassword-blumeops
   target:
     name: teslamate-encryption
-    creationPolicy: Merge
+    creationPolicy: Owner
   data:
   - secretKey: key
     remoteRef: