fix: reuse existing secretKey and TLS certs to prevent ArgoCD drift - #2310
Open
MyoungHaSong wants to merge 1 commit into
Open
fix: reuse existing secretKey and TLS certs to prevent ArgoCD drift#2310MyoungHaSong wants to merge 1 commit into
MyoungHaSong wants to merge 1 commit into
Conversation
When using ArgoCD or other GitOps tools, the helm template is rendered on each sync. Previously, `secretKey` did not use the lookup function to check for existing values, and TLS certificates were always regenerated with `genCA`. This caused unnecessary secret updates and pod restarts. Changes: - secretKey: Add lookup fallback to reuse existing value - tls.key/tls.crt: Check for existing certificates before generating new ones This fixes the drift issue reported in goharbor#2263 where ArgoCD detects changes on every sync due to randomly generated values. Closes goharbor#2263 Signed-off-by: danny.song <danny.song@sionic.ai>
MyoungHaSong
force-pushed
the
fix/argocd-secret-drift
branch
from
February 3, 2026 16:53
12a26eb to
70a2e79
Compare
isityael
added a commit
to isityael/harbor-helm
that referenced
this pull request
Mar 16, 2026
Cherry-picked upstream PRs: - goharbor#2310: fix secret drift for ArgoCD (fixes goharbor#2263) - goharbor#2307: default image tag to chart appVersion - goharbor#2314: fix rollingUpdate checks for jobservice/registry - goharbor#2312: fix ArgoCD diff in httproute - goharbor#2317: configurable health probe timeoutSeconds/failureThreshold - goharbor#2330: parametrise gracePeriodTerminationSeconds + core startupProbe Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
This PR is being marked stale due to a period of inactivty. If this PR is still relevant, please comment or remove the stale label. Otherwise, this PR will close in 30 days. |
|
Please keep it open |
isityael
added a commit
to isityael/harbor-helm
that referenced
this pull request
Apr 14, 2026
Cherry-picked upstream PRs: - goharbor#2310: fix secret drift for ArgoCD (fixes goharbor#2263) - goharbor#2307: default image tag to chart appVersion - goharbor#2314: fix rollingUpdate checks for jobservice/registry - goharbor#2312: fix ArgoCD diff in httproute - goharbor#2317: configurable health probe timeoutSeconds/failureThreshold - goharbor#2330: parametrise gracePeriodTerminationSeconds + core startupProbe Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
isityael
added a commit
to isityael/harbor-helm
that referenced
this pull request
Apr 14, 2026
Cherry-picked upstream PRs: - goharbor#2310: fix secret drift for ArgoCD (fixes goharbor#2263) - goharbor#2307: default image tag to chart appVersion - goharbor#2314: fix rollingUpdate checks for jobservice/registry - goharbor#2312: fix ArgoCD diff in httproute - goharbor#2317: configurable health probe timeoutSeconds/failureThreshold - goharbor#2330: parametrise gracePeriodTerminationSeconds + core startupProbe Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> ci: replace upstream GHA with GHCR OCI release + lint workflows - release.yaml: package and push to oci://ghcr.io/sm-moshi/charts on tag push - lint.yaml: helm lint + template on PRs and sm-moshi/main pushes - Remove upstream-specific workflows (Docker Hub publish, stale issues, integration, unittest) - Add CLAUDE.md with fork maintenance instructions Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> ci: replace GitHub Actions with Woodpecker CI pipelines - .woodpecker/lint.yaml: helm lint + template on push/PR - .woodpecker/release.yaml: package, push to ghcr.io/sm-moshi/charts, create GitHub release on tag push - Remove .github/workflows/ (GHA no longer needed) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> ci: use DHI helm 4.1.3 image, pinned by digest Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> build: mark chart as 1.19.0-rc2 to match appVersion v2.15.0-rc2 Chart version should reflect pre-release status while shipping RC images. Will bump to 1.19.0 when Harbor v2.15.0 GA ships. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
isityael
added a commit
to isityael/harbor-helm
that referenced
this pull request
Apr 14, 2026
Cherry-picked upstream PRs: - goharbor#2310: fix secret drift for ArgoCD (fixes goharbor#2263) - goharbor#2307: default image tag to chart appVersion - goharbor#2314: fix rollingUpdate checks for jobservice/registry - goharbor#2312: fix ArgoCD diff in httproute - goharbor#2317: configurable health probe timeoutSeconds/failureThreshold - goharbor#2330: parametrise gracePeriodTerminationSeconds + core startupProbe Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> ci: replace upstream GHA with GHCR OCI release + lint workflows - release.yaml: package and push to oci://ghcr.io/sm-moshi/charts on tag push - lint.yaml: helm lint + template on PRs and sm-moshi/main pushes - Remove upstream-specific workflows (Docker Hub publish, stale issues, integration, unittest) - Add CLAUDE.md with fork maintenance instructions Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> ci: replace GitHub Actions with Woodpecker CI pipelines - .woodpecker/lint.yaml: helm lint + template on push/PR - .woodpecker/release.yaml: package, push to ghcr.io/sm-moshi/charts, create GitHub release on tag push - Remove .github/workflows/ (GHA no longer needed) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> ci: use DHI helm 4.1.3 image, pinned by digest Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> build: mark chart as 1.19.0-rc2 to match appVersion v2.15.0-rc2 Chart version should reflect pre-release status while shipping RC images. Will bump to 1.19.0 when Harbor v2.15.0 GA ships. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
isityael
added a commit
to isityael/harbor-helm
that referenced
this pull request
Apr 14, 2026
Cherry-picked upstream PRs: - goharbor#2310: fix secret drift for ArgoCD (fixes goharbor#2263) - goharbor#2307: default image tag to chart appVersion - goharbor#2314: fix rollingUpdate checks for jobservice/registry - goharbor#2312: fix ArgoCD diff in httproute - goharbor#2317: configurable health probe timeoutSeconds/failureThreshold - goharbor#2330: parametrise gracePeriodTerminationSeconds + core startupProbe Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> ci: replace upstream GHA with GHCR OCI release + lint workflows - release.yaml: package and push to oci://ghcr.io/sm-moshi/charts on tag push - lint.yaml: helm lint + template on PRs and sm-moshi/main pushes - Remove upstream-specific workflows (Docker Hub publish, stale issues, integration, unittest) - Add CLAUDE.md with fork maintenance instructions Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> ci: replace GitHub Actions with Woodpecker CI pipelines - .woodpecker/lint.yaml: helm lint + template on push/PR - .woodpecker/release.yaml: package, push to ghcr.io/sm-moshi/charts, create GitHub release on tag push - Remove .github/workflows/ (GHA no longer needed) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> ci: use DHI helm 4.1.3 image, pinned by digest Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> build: mark chart as 1.19.0-rc2 to match appVersion v2.15.0-rc2 Chart version should reflect pre-release status while shipping RC images. Will bump to 1.19.0 when Harbor v2.15.0 GA ships. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Please merge it |
|
This PR is being marked stale due to a period of inactivty. If this PR is still relevant, please comment or remove the stale label. Otherwise, this PR will close in 30 days. |
|
Unstale |
|
@MinerYang Any chance on getting this merged? It's causing replicaset revision spam |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
When using ArgoCD or other GitOps tools, the helm template is rendered on each sync. This causes unnecessary secret updates and pod restarts because:
secretKeydid not use thelookupfunction to check for existing valuestls.key,tls.crt) were always regenerated withgenCAChanges
genCAHow it works
The fix follows the same pattern already used for
secretandCSRF_KEY:For TLS certificates, we check if both
tls.keyandtls.crtexist in the current secret before falling back togenCA.Testing
helm templaterenders successfullyCloses #2263