reconciliation overwrites existing secrets #4374
-
|
once reconciliate runs. it deletes secretes replicated with kubernetes-replicator across namespaces. referencethere has been a discussion about this: |
Beta Was this translation helpful? Give feedback.
Replies: 4 comments
-
|
Please share some more information on your setup, at least the GitRepository and Kustomization manifests. Flux doesn't delete any resources it doesn't govern. However, it will overwrite resources if they exist in the cluster but are also governed by Flux (e.g. by being present in a Git repository that's reconciled). |
Beta Was this translation helpful? Give feedback.
-
|
well the cluster itself is managed itself by flux, its all standard, meaning the setup after a bootstrap, the namespaces are nested due to hierarchical namespaces addon # kubectl hns tree staging
staging
├── [s] cert-manager
├── [s] csi-driver-nfs
├── [s] docker-registry
├── [s] gitsrv
├── [s] kubernetes-replicator
├── [s] metallb-system
└── [s] traefik
|- flux-systemthe secrets are replicated by kubernetes-replicator kind: Secret
metadata:
annotations:
cert-manager.io/private-key-encoding: PKCS1
cert-manager.io/private-key-size: 4096
replicator.v1.mittwald.de/replication-allowed: "true"
replicator.v1.mittwald.de/replication-allowed-namespaces: "traefik,docker-registry"
name: tlscertificatesecret
namespace: cert-manager
type: kubernetes.io/tls
data:
tls.crt: <OMITED SECRET>
tls.key: <OMITED SECRET>apiVersion: v1
kind: Secret
metadata:
name: tlscertificatesecret
namespace: traefik
annotations:
replicator.v1.mittwald.de/replicate-from: cert-manager/tlscertificatesecret
replicator.v1.mittwald.de/replicated-keys: tls.crt,tls.key
type: kubernetes.io/tls
data:
tls.crt: ""
tls.key: ""it does sync the secret by kubernetes-replicator, but returns to its default state (tls.crt, tls.key empty) once |
Beta Was this translation helpful? Give feedback.
-
|
Same happens with secrets of type kubernetes.io/dockerconfigjson over time they will be overridden with the default value |
Beta Was this translation helpful? Give feedback.
-
|
If you want Flux to ignore changes made to secrets which are managed by other controllers add the apiVersion: v1
kind: Secret
metadata:
annotations:
kustomize.toolkit.fluxcd.io/ssa: IfNotPresent |
Beta Was this translation helpful? Give feedback.
If you want Flux to ignore changes made to secrets which are managed by other controllers add the
IfNotPresentannotation:Docs here: https://fluxcd.io/flux/components/kustomize/kustomizations/#controlling-the-apply-behavior-of-resources