Skip to content

feat(lifecycle): refactor secrets generation for GitOps/ArgoCD compatibility#45

Open
binlab wants to merge 1 commit intomainfrom
feat/refactor-lifecycle-secrets
Open

feat(lifecycle): refactor secrets generation for GitOps/ArgoCD compatibility#45
binlab wants to merge 1 commit intomainfrom
feat/refactor-lifecycle-secrets

Conversation

@binlab
Copy link
Copy Markdown
Contributor

@binlab binlab commented Apr 21, 2026

Description

This PR refactors the generation of secrets and configmaps within the main lifecycle umbrella Helm chart to ensure full compatibility with GitOps tools like ArgoCD. The use of randAlphaNum combined with Helm hooks (pre-install) and .Release.IsInstall conditions caused persistent issues where secrets were either pruned during synchronization or continually overwritten during each helm template evaluation.

By introducing an idempotent approach via a new ..helper.getValueFromSecret helper, we now:

  1. Look up existing secret and configmap values deployed in the cluster and retain them, preventing unnecessary differences in ArgoCD.
  2. Remove .Release.IsInstall constraints, ensuring the manifests are consistently evaluated, rendered, and maintained across regular upgrades.
  3. Remove problematic helm.sh/hook annotations from secrets and configmaps, allowing ArgoCD to manage these resources correctly as standard, tracked resources.

Changes Made

  • Added ..helper.getValueFromSecret and ..helper.getValueFromConfigMap helpers in _helpers.tpl to fetch existing values directly from the cluster state.
  • Refactored secret-objectstore.yaml, secret-postgres.yaml, secret-redis.yaml, secret-common.yaml and configmap.yaml to leverage the helper and remove hooks/.Release.IsInstall.
  • Removed .Release.IsInstall constraints and hooks from secret-bootstrap.yaml.
  • Bumped chart version in Chart.yaml and README.md to 0.10.0 (minor bump due to significant GitOps refactoring).

Verification

  • Validated all updated templates format correctly with getValueFromSecret.
  • Confirmed that Helm hook annotations and strict install conditionals have been systematically replaced.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant