feat(argocd-image-updater): Add missing config values, webhook support, and controller flags

charts/argocd-image-updater/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: argocd-image-updater
 description: A Helm chart for Argo CD Image Updater, a tool to automatically update the container images of Kubernetes workloads which are managed by Argo CD
 type: application
-version: 1.1.3
+version: 1.2.0
 appVersion: v1.1.1
 home: https://github.com/argoproj-labs/argocd-image-updater
 icon: https://argocd-image-updater.readthedocs.io/en/stable/assets/logo.png
@@ -18,5 +18,5 @@ annotations:
     fingerprint: 2B8F22F57260EFA67BE1C5824B11F800CD9D2252
     url: https://argoproj.github.io/argo-helm/pgp_keys.asc
   artifacthub.io/changes: |
-    - kind: fixed
-      description: Remove command override in deployment to allow Dockerfile ENTRYPOINT with tini init process to prevent zombie processes
+    - kind: added
+      description: Wire ALIYUN_ACR_WEBHOOK_SECRET and CLOUDEVENTS_WEBHOOK_SECRET env vars, add metricsSecure and enableHTTP2 controller flags, and bind --health-probe-bind-address to containerPorts.health

charts/argocd-image-updater/README.md

@@ -104,6 +104,7 @@ The `config.registries` value can be used exactly as it looks in the documentati
 | createClusterRoles | bool | `true` | Create cluster roles for cluster-wide installation. |
 | dualStack.ipFamilies | list | `[]` | IP families that should be supported and the order in which they should be applied to ClusterIP as well. Can be IPv4 and/or IPv6. |
 | dualStack.ipFamilyPolicy | string | `""` | IP family policy to configure dual-stack see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services) |
+| enableHTTP2 | bool | `nil` | Enable HTTP/2 for the metrics and webhook servers. Upstream default is `false`. Only applies to the new `run` command (controller-runtime based). Leave unset to omit the flag entirely. |
 | extraArgs | list | `[]` | Extra arguments for argocd-image-updater not defined in `config.argocd`. If a flag contains both key and value, they need to be split to a new entry. |
 | extraEnv | list | `[]` | Extra environment variables for argocd-image-updater. |
 | extraEnvFrom | list | `[]` | Extra envFrom to pass to argocd-image-updater |
@@ -135,6 +136,7 @@ The `config.registries` value can be used exactly as it looks in the documentati
 | metrics.serviceMonitor.namespace | string | `""` | Prometheus ServiceMonitor namespace |
 | metrics.serviceMonitor.relabelings | list | `[]` | Prometheus [RelabelConfigs] to apply to samples before scraping |
 | metrics.serviceMonitor.selector | object | `{}` | Prometheus ServiceMonitor selector |
+| metricsSecure | bool | `nil` | Serve metrics endpoint securely via HTTPS. Upstream default is `true`. Only applies to the new `run` command (controller-runtime based). Leave unset to omit the flag entirely. |
 | nameOverride | string | `""` | Global name (argocd-image-updater.name in _helpers.tpl) override |
 | namespaceOverride | string | `""` | Global namespace (argocd-image-updater.namespace in _helpers.tpl) override |
 | nodeSelector | object | `{}` | Kubernetes nodeSelector settings for the deployment |

charts/argocd-image-updater/templates/deployment.yaml

@@ -36,6 +36,13 @@ spec:
         - name: {{ include "argocd-image-updater.fullname" . }}-controller
           args:
             - --metrics-bind-address=:{{ .Values.containerPorts.metrics }}
+            - --health-probe-bind-address=:{{ .Values.containerPorts.health }}
+            {{- if kindIs "bool" .Values.metricsSecure }}
+            - --metrics-secure={{ .Values.metricsSecure }}
+            {{- end }}
+            {{- if kindIs "bool" .Values.enableHTTP2 }}
+            - --enable-http2={{ .Values.enableHTTP2 }}
+            {{- end }}
             - run
             {{- with .Values.extraArgs }}
               {{- toYaml . | nindent 12 }}
@@ -149,6 +156,18 @@ spec:
                 name: argocd-image-updater-secret
                 key: webhook.harbor-secret
                 optional: true
+          - name: ALIYUN_ACR_WEBHOOK_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: argocd-image-updater-secret
+                key: webhook.aliyun-acr-secret
+                optional: true
+          - name: CLOUDEVENTS_WEBHOOK_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: argocd-image-updater-secret
+                key: webhook.cloudevents-secret
+                optional: true
           - name: WEBHOOK_RATELIMIT_ALLOWED
             valueFrom:
               configMapKeyRef:

charts/argocd-image-updater/values.yaml

@@ -36,6 +36,12 @@ namespaceOverride: ""
 ## If you want to use this, please set `.Values.rbac.enabled` true as well.
 createClusterRoles: true
 
+# -- (bool) Serve metrics endpoint securely via HTTPS. Upstream default is `true`. Only applies to the new `run` command (controller-runtime based). Leave unset to omit the flag entirely.
+metricsSecure:
+
+# -- (bool) Enable HTTP/2 for the metrics and webhook servers. Upstream default is `false`. Only applies to the new `run` command (controller-runtime based). Leave unset to omit the flag entirely.
+enableHTTP2:
+
 # -- Extra arguments for argocd-image-updater not defined in `config.argocd`.
 # If a flag contains both key and value, they need to be split to a new entry.
 extraArgs: []