From 1294303a34794c6bb865034854e749d56f65a781 Mon Sep 17 00:00:00 2001 From: Mike Stankavich Date: Fri, 29 May 2026 09:04:30 -0500 Subject: [PATCH] fix(trakrf-backend): omit JWT_SECRET from chart Secret when placeholder/empty MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ArgoCD rendering the chart's placeholder default ("change-me") meant it owned and reverted the operator-set JWT_SECRET on every sync/image-update — crashing the backend's fail-fast guard (TRA-860) and silently stalling preview rollouts. ignoreDifferences+RespectIgnoreDifferences (the trakrf-backend Application carve-out) did not reliably survive the image-update sync path. Bulletproof fix: only render JWT_SECRET when secrets.jwtSecret is a real, non-default value. With the default/empty, the key is omitted, so ArgoCD never manages /data/JWT_SECRET and the out-of-band operator value persists across ALL sync paths. Fail-closed for fresh envs (no secret → guard refuses to boot until a real one is set), matching the ESO+GCP-Secret-Manager direction (TRA-375). Co-Authored-By: Claude Opus 4.8 (1M context) --- helm/trakrf-backend/templates/secret.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/helm/trakrf-backend/templates/secret.yaml b/helm/trakrf-backend/templates/secret.yaml index dc92def..05e98bf 100644 --- a/helm/trakrf-backend/templates/secret.yaml +++ b/helm/trakrf-backend/templates/secret.yaml @@ -6,6 +6,19 @@ metadata: {{- include "trakrf-backend.labels" . | nindent 4 }} type: Opaque stringData: + {{- /* + JWT_SECRET is intentionally NOT rendered when it's the placeholder default + ("change-me") or empty. The real value is set out-of-band (operator kubectl + today; External Secrets + GCP Secret Manager later — TRA-375). If the chart + rendered "change-me", ArgoCD would own and REVERT the operator-set value on + every sync/image-update, and the backend's fail-fast guard (TRA-860) would + then refuse to boot — which silently stalled preview rollouts. Omitting the + key means ArgoCD never manages /data/JWT_SECRET, so the out-of-band value + persists across all sync paths. (The trakrf-backend Application also carries + an ignoreDifferences carve-out on this key as belt-and-suspenders.) + */}} + {{- if and .Values.secrets.jwtSecret (ne .Values.secrets.jwtSecret "change-me") }} JWT_SECRET: {{ .Values.secrets.jwtSecret | quote }} + {{- end }} RESEND_API_KEY: {{ .Values.secrets.resendApiKey | quote }} SENTRY_DSN: {{ .Values.secrets.sentryDsn | quote }}