htpasswd function generates new htpasswd on every helm upgrade / gitops deploy

[mweibel]

hi

I had issues with replicasets being recreated way too often and upon looking closer into it I saw that there are several random generators in the helm chart which cause those secrets to change and the deployments to automatically create new replicasets.

Related issues are: #459, #107, #597

I have a similar issue with registry-htpasswd secret as the htpasswd function creates a new value on each call. I changed that locally to have a separate value too:

REGISTRY_HTPASSWD: {{ .Values.registry.credentials.htpasswd | default (htpasswd .Values.registry.credentials.username .Values.registry.credentials.password) | b64enc | quote }}

But that's a bit ugly, not sure if you want that in the helm chart.

Anyway I think there should be somewhere a word of warning about using GitOps tools with this helm chart specifying which values need to be set to avoid the recreation of replicasets over and over again. Or remove the automatic defaults and require the user to specify those secrets like it's done with several other secrets (secretKey f.e.)

JFYI I needed to set:

.Values.registry.secret
.Values.jobservice.secret
.Values.core.secret
.Values.core.xsrfKey
.Values.registry.credentials.htpasswd (new, does not exist usually)

[TomHellier]

I've been seeing something similar, I use argocd to deploy harbor, and its pointed at a monorepo which updates these resources whenever a PR is merged into master.

I'd welcome some change which would support gitops

[sebtiz13]

Hello have you try to ignore the generated secret in your Argo CD app ?

For exemple to ignore REGISTRY_HTPASSWD in harbor-registry secret

spec:
  ignoreDifferences:
    - kind: Secret
      name: harbor-registry
      jsonPointers:
        - /data/REGISTRY_HTPASSWD

I had the same issue with generation of notary certificates, I tried these approaches and it seems to work for now.

For more information:
https://argo-cd.readthedocs.io/en/stable/user-guide/diffing/

[TomHellier]

That's a great idea, I will give it a go tomorrow. I typically only have used ignoreDifferences where apps show out of sync for reasons I cannot easily control without updating upstream charts.

[github-actions]

This issue is being marked stale due to a period of inactivity. If this issue is still relevant, please comment or remove the stale label. Otherwise, this issue will close in 30 days.

[github-actions]

This issue was closed because it has been stalled for 30 days with no activity. If this issue is still relevant, please re-open a new issue.