Fleet doesn't detect when Helm values from Secrets or ConfigMaps change

[thomashoell]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

I have a bundle where I import values from a secret like this:

helm:
  valuesFrom:
    - secretKeyRef:
        name: secret-values
        key: values.yaml

When this secret changes, Fleet doesn't detect this and still shows my bundle as in sync. Even when I hit force update, the old values are redeployed, as the BundleDeployment does not update. I need to change something in my bundle to force Fleet to reread the referenced secret.

This is especially unsatisfying as this specific secret is automatically generated by the External Secrets Operator.

Expected Behavior

Fleet should detect that the values from a referenced Secret/ConfigMap change and redeploy the Bundle if needed.

Steps To Reproduce

1. Create a Fleet Bundle and reference Helm values from a Secret or ConfigMap
2. Deploy the Bundle
3. Change the values in the Secret/ConfigMap
4. Nothing happens

Environment

- Architecture: amd64
- Fleet Version: 0.9.0
- Cluster:
  - Provider: RKE2
  - Options:
  - Kubernetes Version: 1.26.12

Logs

No response

Anything else?

No response

[schakko]

+1

[und-miller]

Experiencing similar issues when updating the fleet.yaml file.

[matmitch]

@thomashoell I am using a similar setup (values from secret generated by external secret operator) did you find a workaround for this issue ?

[thomashoell]

@thomashoell I am using a similar setup (values from secret generated by external secret operator) did you find a workaround for this issue ?

Not really. You could try to make the deployed application itself aware of changes in a secret using https://github.com/jimmidyson/configmap-reload or something similar.

[shane-davidson]

I am having the same issue. Force sync is the only way I can get fleet to update the bundle deployment

Does the fleet controller / BundleDeployment template the valuesFrom? and would it make more sense for the "values" to be added to the bundle deployment and the "valuesFrom" to be added/templated by the agent running downstream? Then the agent could subscribe to changes to any secret/configmaps that change.

bundle deployment would just pass the reference to any required downsteam configmap/secret

Is there any work around to force the deployments on a time etc?

Does "force update" just increase the forceSyncGeneration option on the gitrepo resource? (I was looking at making a workaround to automatically increase the value on a set time interval)

Would this cause the controller to churn a lot?