FIX(velero): fix UI and backup visibility

- Enable backup-sync to show backups in UI
- Disable prune to preserve dynamic resources
- Move velero-ui to master node with single replica

velero/argocd.yaml

@@ -32,13 +32,11 @@ spec:
     namespace: velero
   syncPolicy:
     automated:
-      prune: true
+      prune: false  # Disabled: Backup/Restore/ServerStatusRequest are dynamic
       selfHeal: true
       allowEmpty: false
     syncOptions:
     - CreateNamespace=true
-    - PrunePropagationPolicy=foreground
-    - PruneLast=true
     - RespectIgnoreDifferences=true
     retry:
       limit: 5
@@ -71,7 +69,7 @@ spec:
           tag: latest
           pullPolicy: IfNotPresent
 
-        replicaCount: 2
+        replicaCount: 1
 
         resources:
           requests:
@@ -88,15 +86,16 @@ spec:
           - name: BASIC_AUTH_ENABLED
             value: "false"
 
-        affinity:
-          podAntiAffinity:
-            preferredDuringSchedulingIgnoredDuringExecution:
-              - weight: 100
-                podAffinityTerm:
-                  labelSelector:
-                    matchLabels:
-                      app: velero-ui
-                  topologyKey: kubernetes.io/hostname
+        # Run on master node with velero controller
+        nodeSelector:
+          node-role.kubernetes.io/control-plane: "true"
+
+        tolerations:
+          - key: "node-role.kubernetes.io/control-plane"
+            operator: "Exists"
+            effect: "NoSchedule"
+
+        affinity: {}
         envFrom: []
 
         podSecurityContext:
@@ -132,13 +131,11 @@ spec:
     namespace: velero
   syncPolicy:
     automated:
-      prune: true
+      prune: false  # Disabled: Same namespace as velero
       selfHeal: true
       allowEmpty: false
     syncOptions:
     - CreateNamespace=true
-    - PrunePropagationPolicy=foreground
-    - PruneLast=true
     retry:
       limit: 5
       backoff:

velero/helm-values.yaml

@@ -81,9 +81,7 @@ configuration:
   # This prevents status updates that trigger ArgoCD refreshes
   storeValidationFrequency: 0s
 
-  # Disable backup-sync controller (user only uses manual backups)
-  # This prevents lastSyncedTime updates that trigger ArgoCD refreshes
-  disableControllers: backup-sync
+  # Note: backup-sync is enabled to show backups in velero-ui
 
 # Credentials for S3 access (from Vault via External Secrets)
 credentials: