chore(chart-deps): update argocd-image-updater to version 1.2.4 - #3500
Draft
svcAPLBot wants to merge 17 commits into
Draft
chore(chart-deps): update argocd-image-updater to version 1.2.4#3500svcAPLBot wants to merge 17 commits into
svcAPLBot wants to merge 17 commits into
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Pull request overview
This PR bumps the argocd-image-updater Helm chart dependency to 1.2.4 and updates the vendored chart content to match, including new webhook TLS-related configuration, ServiceMonitor enhancements, RBAC updates, and CRD changes.
Changes:
- Update
argocd-image-updaterchart dependency/version to1.2.4. - Add/adjust chart templates and values for webhook TLS Secret handling and ServiceMonitor options.
- Update CRDs and RBAC rules to align with newer
argocd-image-updaterbehavior.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| charts/dependencies.yaml | Bumps the argocd-image-updater dependency version. |
| charts/argocd-image-updater/Chart.yaml | Updates chart metadata (chart version/appVersion/changelog). |
| charts/argocd-image-updater/values.yaml | Adds new metrics ServiceMonitor options and webhook TLS Secret configuration knobs. |
| charts/argocd-image-updater/templates/servicemonitor.yaml | Renders new ServiceMonitor fields (scheme/tlsConfig/authorization). |
| charts/argocd-image-updater/templates/secret.yaml | Adds optional TLS Secret creation for webhook TLS material. |
| charts/argocd-image-updater/templates/deployment.yaml | Wires new env vars and mounts TLS Secret volume for webhook TLS. |
| charts/argocd-image-updater/templates/rbac.yaml | Expands RBAC permissions for new CRD resources and watch verbs. |
| charts/argocd-image-updater/crds/crd-imageupdaters.yaml | Updates the ImageUpdater CRD schema and status fields. |
| charts/argocd-image-updater/README.md | Documents upgrade notes and newly introduced chart values. |
Suppressed comments (1)
charts/argocd-image-updater/README.md:101
- These
certificateSecret.*table descriptions refer to anargocd-repo-server-tlssecret and "Repo service" SANs, but this chart creates a TLS Secret for argocd-image-updater (see templates/secret.yaml). The descriptions should match the actual Secret name/purpose so users don’t configure the wrong SANs/Secret.
| certificateSecret.annotations | object | `{}` | Annotations to be added to argocd-repo-server-tls secret |
| certificateSecret.crt | string | `""` | Certificate data. Must contain SANs of Repo service (ie: argocd-repo-server, argocd-repo-server.argo-cd.svc) |
| certificateSecret.enabled | bool | `false` | Create argocd-repo-server-tls secret |
| certificateSecret.key | string | `""` | Certificate private key |
| certificateSecret.labels | object | `{}` | Labels to be added to argocd-repo-server-tls secret |
| optional: true | ||
| - name: argocd-image-updater-tls | ||
| secret: | ||
| secretName: argocd-image-updater-tls |
Comment on lines
426
to
427
| type: object | ||
| namespace: | ||
| description: |- | ||
| Namespace indicates the target namespace of the applications. | ||
|
|
||
| Deprecated: This field is deprecated and will be removed in a future release. | ||
| The controller now uses the ImageUpdater CR's namespace (metadata.namespace) | ||
| to determine which namespace to search for applications. This field is ignored. | ||
| type: string | ||
| writeBackConfig: |
Comment on lines
+410
to
+423
| # TLS certificate configuration via Secret for Webhook | ||
| ## Ref: https://argocd-image-updater.readthedocs.io/en/stable/configuration/webhook/#tls-configuration | ||
| ## Note: Issuing certificates via cert-manager in not supported right now because it's not possible to restart repo server automatically without extra controllers. | ||
| certificateSecret: | ||
| # -- Create argocd-repo-server-tls secret | ||
| enabled: false | ||
| # -- Annotations to be added to argocd-repo-server-tls secret | ||
| annotations: {} | ||
| # -- Labels to be added to argocd-repo-server-tls secret | ||
| labels: {} | ||
| # -- Certificate private key | ||
| key: "" | ||
| # -- Certificate data. Must contain SANs of Repo service (ie: argocd-repo-server, argocd-repo-server.argo-cd.svc) | ||
| crt: "" |
Comment on lines
+56
to
+59
| extraEnv: | ||
| - name: DISABLE_TLS | ||
| value: "false" | ||
| ``` |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.
Suppressed comments (8)
charts/argocd-image-updater/templates/deployment.yaml:286
- The TLS Secret volume references a hard-coded Secret name (argocd-image-updater-tls), but the chart creates the Secret as {{ include "argocd-image-updater.fullname" . }}-tls. This breaks installs when the release name/nameOverride/fullnameOverride changes.
- name: argocd-image-updater-tls
secret:
secretName: argocd-image-updater-tls
optional: true
charts/argocd-image-updater/values.yaml:414
- This new certificateSecret block is described as creating an "argocd-repo-server-tls" Secret and references restarting the repo server, but this chart is for argocd-image-updater. The comments should refer to the image-updater webhook TLS Secret instead, otherwise users will configure the wrong component.
# TLS certificate configuration via Secret for Webhook
## Ref: https://argocd-image-updater.readthedocs.io/en/stable/configuration/webhook/#tls-configuration
## Note: Issuing certificates via cert-manager in not supported right now because it's not possible to restart repo server automatically without extra controllers.
certificateSecret:
# -- Create argocd-repo-server-tls secret
charts/argocd-image-updater/README.md:59
- The example for opting out of TLS sets DISABLE_TLS to "false", which contradicts the text (and flag name) about disabling TLS. The example should show DISABLE_TLS="true" to actually opt out.
```yaml
extraEnv:
- name: DISABLE_TLS
value: "false"
**charts/argocd-image-updater/values.yaml:419**
* These certificateSecret comments still refer to "argocd-repo-server-tls", which is a different component. This chart creates a TLS Secret for the argocd-image-updater webhook, so the descriptions should match that to avoid misconfiguration.
-- Annotations to be added to argocd-repo-server-tls secret
annotations: {}
-- Labels to be added to argocd-repo-server-tls secret
labels: {}
**charts/argocd-image-updater/values.yaml:423**
* certificateSecret.key/crt descriptions mention "Repo service" SANs; this TLS Secret is for the image-updater webhook Service. The comments should describe the webhook Service DNS names instead.
-- Certificate private key
key: ""
-- Certificate data. Must contain SANs of Repo service (ie: argocd-repo-server, argocd-repo-server.argo-cd.svc)
crt: ""
**charts/argocd-image-updater/templates/secret.yaml:21**
* When certificateSecret.enabled is true, this template will still render a kubernetes.io/tls Secret even if crt/key are empty strings, producing an invalid TLS Secret that can be hard to diagnose. It’s safer to fail rendering with a clear message when enabled but values are missing.
data:
tls.crt: {{ .Values.certificateSecret.crt | b64enc | quote }}
tls.key: {{ .Values.certificateSecret.key | b64enc | quote }}
**charts/argocd-image-updater/README.md:101**
* The new certificateSecret values table entries refer to "argocd-repo-server-tls" and "Repo service" SANs, but this chart creates a TLS Secret for the argocd-image-updater webhook. These descriptions are misleading and should be corrected.
| certificateSecret.annotations | object | {} | Annotations to be added to argocd-repo-server-tls secret |
| certificateSecret.crt | string | "" | Certificate data. Must contain SANs of Repo service (ie: argocd-repo-server, argocd-repo-server.argo-cd.svc) |
| certificateSecret.enabled | bool | false | Create argocd-repo-server-tls secret |
| certificateSecret.key | string | "" | Certificate private key |
| certificateSecret.labels | object | {} | Labels to be added to argocd-repo-server-tls secret |
**charts/argocd-image-updater/values.yaml:308**
* metrics.serviceMonitor.tlsConfig defaults to insecureSkipVerify: true. Even though ServiceMonitor is disabled by default, this encourages disabling TLS verification when enabled, which is generally unsafe and can hide MITM/endpoint misconfiguration.
# -- Prometheus ServiceMonitor tlsConfig
tlsConfig:
insecureSkipVerify: true
</details>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR updates the dependency argocd-image-updater to version 1.2.4.
TODO: Update app version in apps.yaml.