feat: allow deploy secret as regular non-hooked resources

Author: fernandezcuesta

helm/defectdojo/templates/celery-beat-deployment.yaml

@@ -162,6 +162,7 @@ spec:
             secretKeyRef:
               name: {{ $fullName }}
               key: DD_SECRET_KEY
+              optional: true
         {{- with .Values.celery.beat.extraEnv }}
           {{- . | toYaml | nindent 8 }}
         {{- end }}

helm/defectdojo/templates/celery-worker-deployment.yaml

@@ -157,6 +157,7 @@ spec:
             secretKeyRef:
               name: {{ $fullName }}
               key: DD_SECRET_KEY
+              optional: true
         {{- with .Values.celery.worker.extraEnv }}
           {{- . | toYaml | nindent 8 }}
         {{- end }}

helm/defectdojo/templates/django-deployment.yaml

@@ -200,11 +200,13 @@ spec:
             secretKeyRef:
               name: {{ $fullName }}
               key: DD_SECRET_KEY
+              optional: true
         - name: DD_CREDENTIAL_AES_256_KEY
           valueFrom:
             secretKeyRef:
               name: {{ $fullName }}
               key: DD_CREDENTIAL_AES_256_KEY
+              optional: true
         - name: DD_SESSION_COOKIE_SECURE
           value: {{- if or .Values.django.ingress.activateTLS .Values.django.nginx.tls.enabled }} "True" {{- else }} "False" {{- end }}
         - name: DD_CSRF_COOKIE_SECURE

helm/defectdojo/templates/sa.yaml

@@ -15,9 +15,11 @@ metadata:
     {{- toYaml . | nindent 4 }}
     {{- end }}
   annotations:
+    {{- if (not .Values.disableHooks) }}
     helm.sh/resource-policy: keep
     helm.sh/hook: "pre-install"
     helm.sh/hook-delete-policy: "before-hook-creation"
+    {{- end }}
     {{- with .Values.annotations }}
     {{ toYaml . | nindent 4 }}
     {{- end }}

helm/defectdojo/templates/secret-postgresql.yaml

@@ -12,9 +12,11 @@ metadata:
       {{- toYaml . | nindent 4 }}
     {{- end }}
   annotations:
+    {{- if (not .Values.disableHooks) }}
     helm.sh/resource-policy: keep
     helm.sh/hook: "pre-install"
     helm.sh/hook-delete-policy: "before-hook-creation"
+    {{- end }}
     {{- with .Values.secrets.annotations }}
       {{- toYaml . | nindent 4 }}
     {{- end }}

helm/defectdojo/templates/secret-redis.yaml

@@ -12,9 +12,11 @@ metadata:
       {{- toYaml . | nindent 4 }}
     {{- end }}
   annotations:
+    {{- if (not .Values.disableHooks) }}
     helm.sh/resource-policy: keep
     helm.sh/hook: "pre-install"
     helm.sh/hook-delete-policy: "before-hook-creation"
+    {{- end }}
     {{- with .Values.secrets.annotations }}
       {{- toYaml . | nindent 4 }}
     {{- end }}

helm/defectdojo/templates/secret.yaml

@@ -13,9 +13,11 @@ metadata:
       {{- toYaml . | nindent 4 }}
     {{- end }}
   annotations:
+    {{- if (not .Values.disableHooks) }}
     helm.sh/resource-policy: keep
     helm.sh/hook: "pre-install"
     helm.sh/hook-delete-policy: "before-hook-creation"
+    {{- end }}
     {{- with .Values.secrets.annotations }}
       {{- toYaml . | nindent 4 }}
     {{- end }}

helm/defectdojo/templates/tests/unit-tests.yaml

@@ -51,11 +51,13 @@ spec:
             secretKeyRef:
               name: {{ $fullName }}
               key: DD_SECRET_KEY
+              optional: true
         - name: DD_CREDENTIAL_AES_256_KEY
           valueFrom:
             secretKeyRef:
               name: {{ $fullName }}
               key: DD_CREDENTIAL_AES_256_KEY
+              optional: true
       resources:
         {{- toYaml .Values.tests.unitTests.resources | nindent 8 }}
   restartPolicy: Never

helm/defectdojo/values.yaml

@@ -1,4 +1,4 @@
----
+  ---
 # Global settings
 # create defectdojo specific secret
 createSecret: false
@@ -12,6 +12,9 @@ createPostgresqlSecret: false
 # - enabled, enables tracking configuration changes based on SHA256
 # trackConfig: disabled
 
+# Avoid using pre-install hooks, which might cause issues with ArgoCD
+disableHooks: false
+
 extraLabels: {}
 # Add extra labels for k8s