Skip to content

fix(argo-cd): fixed externally managed redis secret marked as optional (#2836)#3849

Open
michaelvl wants to merge 1 commit intoargoproj:mainfrom
michaelvl:fix/external-redis-secret-optional
Open

fix(argo-cd): fixed externally managed redis secret marked as optional (#2836)#3849
michaelvl wants to merge 1 commit intoargoproj:mainfrom
michaelvl:fix/external-redis-secret-optional

Conversation

@michaelvl
Copy link
Copy Markdown
Contributor

@michaelvl michaelvl commented Apr 24, 2026

Fixes #2836

Note, the settings for Redis in this chart is a little complicated. Generally the options are:

  1. External redis (.Values.externalRedis.host)
    • .Values.externalRedis.existingSecret allow naming an external Redis secret
  2. Internal redis (if not .Values.externalRedis.host` given)
    • Redis secret hardcoded to argocd-redis
    • If .Values.redisSecretInit.enabled, then Helm chart generates a secret
    • else an externally managed secret is assumed and reference is given with optional: true

The questionable part of this PR is how to make the optional be configurable - especially since there is no good section of the values.yaml file where an option could fit in - the "internal Redis with externally managed secret" does not have a section of its own. Since there are several other references that similarly are given with optional: true my thinking was to create a separate section for 'reference optinality' where other refences could be added in the future. The default values ensures that the change is backward compatible,

Hence, anyone using an externally managed Redis secret will need to add:

configRefOptionality:
  redisUsernameSecret: false
  redisPasswordSecret: false

with this, e.g. the application controller pod will have the following env-var settings:

        - name: REDIS_USERNAME
          valueFrom:
            secretKeyRef:
              name: "argocd-redis"
              key: redis-username
              optional: false.   # <-- note
        - name: REDIS_PASSWORD
          valueFrom:
            secretKeyRef:
              name: "argocd-redis"
              key: auth
              optional: false.   # <--- note

Checklist:

  • I have bumped the chart version according to versioning
  • I have updated the documentation according to documentation
  • I have updated the chart changelog with all the changes that come with this pull request according to changelog.
  • Any new values are backwards compatible and/or have sensible default.
  • I have signed off all my commits as required by DCO.
  • I have created a separate pull request for each chart according to pull requests
  • My build is green (troubleshooting builds).

@michaelvl michaelvl force-pushed the fix/external-redis-secret-optional branch from 0d8c3e1 to 13665c5 Compare April 24, 2026 11:01
@michaelvl michaelvl changed the title fix: fixed externally managed redis secret marked as optional (#2836) fix(argo-cd): fixed externally managed redis secret marked as optional (#2836) Apr 24, 2026
@michaelvl michaelvl force-pushed the fix/external-redis-secret-optional branch 2 times, most recently from 2f9148f to 26375b2 Compare April 24, 2026 11:05
@michaelvl michaelvl marked this pull request as ready for review April 24, 2026 11:31
@michaelvl michaelvl force-pushed the fix/external-redis-secret-optional branch 2 times, most recently from 3027960 to cd145fc Compare April 29, 2026 04:13
…oj#2836)

Signed-off-by: Michael Vittrup Larsen <mvl.gh@network42.dk>
@michaelvl michaelvl force-pushed the fix/external-redis-secret-optional branch from cd145fc to 8a8d538 Compare April 30, 2026 10:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Optional REDIS_PASSWORD env variable cause race condition and Redis NOAUTH failures

1 participant