Skip creating core/jobservice secrets when using external secrets by eidmantas · Pull Request #2289 · goharbor/harbor-helm

eidmantas · 2025-12-16T07:19:00Z

Hello, I noticed that when you move all secrets to an external (non-helm generated) source - the secrets still remain and cause confusion for peers.

I thought about adding a helper function and if everything is moved, then we do not create a secret at all.

When all secret fields are sourced from external secrets (e.g., via ExternalSecrets operator), the chart was still creating empty Secret objects with only metadata. This caused conflicts and confusion. Added helper functions to determine if secrets should be created: - harbor.core.createSecret - harbor.jobservice.createSecret The secrets are now only created when at least one data field would be populated. If all fields use existingSecret references, the Secret object is skipped entirely.

eidmantas · 2025-12-16T07:21:38Z

Also now I am thinking, we probably need to deal with annotations as well? Or is cksum of 0 fine? At least local templating worked fine.

MinerYang · 2025-12-22T07:00:35Z

Hi @eidmantas ,

I would take the values.core.secret as an example, that we are now avoiding random generate the secret value if:

the value.core.existingSecret do exist within the same namespace
Or the values.core.secret do has value.

Could you elaborate more in your scenario what is move all secrets to an external source to understanding your case?

eidmantas · 2025-12-22T07:32:20Z

Hey @MinerYang , for example storing secrets in an external engine for all, and then using ExternalSecrets in k8s, or some other mechanism to create k8s secrets and use those instead of the helm generated ones.

github-actions · 2026-02-21T09:09:27Z

This PR is being marked stale due to a period of inactivty. If this PR is still relevant, please comment or remove the stale label. Otherwise, this PR will close in 30 days.

cthtrifork · 2026-02-22T17:55:53Z

This is still relevant

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> feat: make PERMITTED_REGISTRY_TYPES_FOR_PROXY_CACHE and REPLICATION_ADAPTER_WHITELIST configurable via values Signed-off-by: Fernando Carletti <fernando@carletti.dev> docs: add PRs goharbor#2289, goharbor#2305 to cherry-picked list Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add .vscode/, .woodpecker/, CLAUDE.md to helmignore so they don't get packaged into the OCI artifact. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> docs: add PR goharbor#2289 to cherry-picked list Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> feat: make PERMITTED_REGISTRY_TYPES_FOR_PROXY_CACHE and REPLICATION_ADAPTER_WHITELIST configurable via values Signed-off-by: Fernando Carletti <fernando@carletti.dev> docs: add PRs goharbor#2289, goharbor#2305 to cherry-picked list Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> chore(deps): update woodpeckerci/plugin-release docker digest to caf18bc chore(deps): update module github.com/gruntwork-io/terratest to v0.56.0 (#3) Co-authored-by: Renovate Bot <renovate@m0sh1.cc> chore(deps): update dhi.io/helm:4.1.3-debian13-dev docker digest to b604d0b chore(deps): update module k8s.io/api to v0.35.2 chore(deps): update dhi.io/helm:4.1.3-debian13-dev docker digest to 0a68e1a (#6) build: bump chart to 1.19.0 / appVersion v2.15.0 GA Harbor v2.15.0 has been released as the latest upstream stable. All 8 cherry-picked helm PRs are still unmerged upstream. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> chore(deps): update module k8s.io/api to v0.35.3 (#7) Co-authored-by: Renovate Bot <renovate@m0sh1.cc> chore(deps): update dhi.io/helm:4.1.3-debian13-dev docker digest to 0e15ecf (#8) Co-authored-by: Renovate Bot <renovate@m0sh1.cc> chore: bump chart version to 1.19.1 OCI registries treat versions as immutable — 1.19.0 was published with appVersion v2.15.0-rc2. Bump to 1.19.1 so the v2.15.0 GA appVersion is published as a new artifact. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> chore: remove deprecated engine field, enable auto release notes - Remove `engine: gotpl` from Chart.yaml (deprecated since Helm 3, causes strict parse warning) - Add `note: "auto"` to release plugin so GitHub releases get auto-generated release notes Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> chore(deps): update woodpeckerci/plugin-release docker digest to 284b612 (#10) Co-authored-by: Renovate Bot <renovate@m0sh1.cc> chore(deps): update dhi.io/helm:4.1.3-debian13-dev docker digest to 211bc06 (#11) Co-authored-by: Renovate Bot <renovate@m0sh1.cc> chore(deps): update woodpeckerci/plugin-release docker digest to 397f161 (#12) Co-authored-by: Renovate Bot <renovate@m0sh1.cc> chore(deps): update woodpeckerci/plugin-release docker digest to b178a16 (#13) Co-authored-by: Renovate Bot <renovate@m0sh1.cc> fix: null rollingUpdate field when strategy is Recreate Cherry-picked from upstream goharbor/harbor-helm main. Kubernetes rejects switching strategy from RollingUpdate to Recreate unless the rollingUpdate field is explicitly set to null. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> build: bump chart to 1.19.2 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> chore(deps): update dhi.io/helm:4.1.3-debian13-dev docker digest to 8649155 (#14) Co-authored-by: Renovate Bot <renovate@m0sh1.cc> chore(deps): update dhi.io/helm docker tag to v4.1.4-debian13-dev (#15) Co-authored-by: Renovate Bot <renovate@m0sh1.cc> chore(deps): update woodpeckerci/plugin-release docker digest to 9d61f12 (#16) fix: remove duplicate entries in values.yaml (goharbor#2338) Signed-off-by: thomas <thomas.zawisza@hotmail.fr>

github-actions · 2026-04-24T09:37:27Z

This PR is being marked stale due to a period of inactivty. If this PR is still relevant, please comment or remove the stale label. Otherwise, this PR will close in 30 days.

cthtrifork · 2026-04-24T20:07:11Z

This is still relevant

github-actions · 2026-06-24T10:07:00Z

This PR is being marked stale due to a period of inactivty. If this PR is still relevant, please comment or remove the stale label. Otherwise, this PR will close in 30 days.

cthtrifork · 2026-06-24T14:06:47Z

This is still relevant

MinerYang self-assigned this Dec 22, 2025

github-actions Bot added the Stale label Feb 21, 2026

github-actions Bot removed the Stale label Feb 23, 2026

isityael added a commit to isityael/harbor-helm that referenced this pull request Mar 16, 2026

docs: add PR goharbor#2289 to cherry-picked list

7699306

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

isityael added a commit to isityael/harbor-helm that referenced this pull request Mar 16, 2026

docs: add PRs goharbor#2289, goharbor#2305 to cherry-picked list

1fc3a47

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

isityael added a commit to isityael/harbor-helm that referenced this pull request Apr 14, 2026

docs: add PR goharbor#2289 to cherry-picked list

0bc0dc0

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

isityael added a commit to isityael/harbor-helm that referenced this pull request Apr 14, 2026

docs: add PRs goharbor#2289, goharbor#2305 to cherry-picked list

965ed3a

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

isityael added a commit to isityael/harbor-helm that referenced this pull request Apr 14, 2026

docs: add PR goharbor#2289 to cherry-picked list

6104fdb

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

isityael added a commit to isityael/harbor-helm that referenced this pull request Apr 14, 2026

docs: add PRs goharbor#2289, goharbor#2305 to cherry-picked list

31ee55b

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

isityael added a commit to isityael/harbor-helm that referenced this pull request Apr 14, 2026

docs: add PR goharbor#2289 to cherry-picked list

f86da96

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

isityael added a commit to isityael/harbor-helm that referenced this pull request Apr 14, 2026

docs: add PRs goharbor#2289, goharbor#2305 to cherry-picked list

fe18952

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

github-actions Bot added the Stale label Apr 24, 2026

github-actions Bot removed the Stale label Apr 25, 2026

github-actions Bot added the Stale label Jun 24, 2026

github-actions Bot removed the Stale label Jun 25, 2026

Navigation Menu

Uh oh!

Skip creating core/jobservice secrets when using external secrets - #2289

Skip creating core/jobservice secrets when using external secrets#2289
eidmantas wants to merge 1 commit into
goharbor:mainfrom
eidmantas:feat/external-secrets-cleanup

eidmantas commented Dec 16, 2025

Uh oh!

eidmantas commented Dec 16, 2025 •

edited

Loading

Uh oh!

MinerYang commented Dec 22, 2025

Uh oh!

eidmantas commented Dec 22, 2025

Uh oh!

github-actions Bot commented Feb 21, 2026

Uh oh!

cthtrifork commented Feb 22, 2026

Uh oh!

github-actions Bot commented Apr 24, 2026

Uh oh!

cthtrifork commented Apr 24, 2026

Uh oh!

github-actions Bot commented Jun 24, 2026

Uh oh!

cthtrifork commented Jun 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

eidmantas commented Dec 16, 2025

Uh oh!

eidmantas commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MinerYang commented Dec 22, 2025

Uh oh!

eidmantas commented Dec 22, 2025

Uh oh!

github-actions Bot commented Feb 21, 2026

Uh oh!

cthtrifork commented Feb 22, 2026

Uh oh!

github-actions Bot commented Apr 24, 2026

Uh oh!

cthtrifork commented Apr 24, 2026

Uh oh!

github-actions Bot commented Jun 24, 2026

Uh oh!

cthtrifork commented Jun 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

eidmantas commented Dec 16, 2025 •

edited

Loading