chore(envoy-gateway): exclude certgen hook Job from projected manifests - #186
Merged
Conversation
The gateway-helm chart ships certgen.yaml as a Helm `pre-install,pre-upgrade` hook that generates the envoy-gateway webhook certs. `helm template` emits hooks like any other manifest and the helm3 hololens has no --no-hooks option, so the Job lands in the projection and gets kubectl-applied on every deploy. Because it carries `ttlSecondsAfterFinished: 30` it deletes itself moments after running, so `kubectl diff` reports it as a fresh creation in every deploy PR. That noise recurs indefinitely and buries the real changes — it showed up alongside the vaultwarden bump in #185 and in #181 before that, and each occurrence has to be re-triaged by hand. Excluding the chart template drops the Job before helm renders it, mirroring the `!templates/tests/**` exclusion already used for the vaultwarden chart. certgen-rbac.yaml is deliberately left in place so re-enabling this is a one-line revert. Verified safe to drop: - The Job is idempotent and does not rotate existing certs — it re-ran during #181 and the envoy/envoy-gateway secrets still date to 2026-05-18. - Those certs are valid until 2031-05-17. Verified with `git holo project k8s-manifests`: the only delta against the deployed tree is removal of envoy-gateway-system/Job/envoy-gateway-gateway-helm-certgen.yaml. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MSNAVVDuF46SMHjnyfmxwU
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stops the envoy-gateway certgen Job from appearing as recurring drift in every deploy PR.
Problem
The gateway-helm chart ships
certgen.yamlas a Helmpre-install,pre-upgradehook that generates the envoy-gateway webhook certs.helm templateemits hooks like any other manifest, and the helm3 hololens has no--no-hooksoption — so the Job lands in the projection and getskubectl apply'd on every deploy.It carries
ttlSecondsAfterFinished: 30, so it deletes itself moments after running.kubectl difftherefore reports it as a fresh creation in every deploy PR, forever. It appeared alongside the vaultwarden bump in #185 and in #181 before that, and each occurrence has to be re-triaged by hand to confirm it's benign — which is exactly the kind of standing noise that erodes the diff gate's value as a review surface.Fix
Exclude the chart template so the Job is dropped before helm renders it. This mirrors the
!templates/tests/**exclusion already used for the vaultwarden chart, and sits next to the existing ingress-nginx exclusion in the same mapping.certgen-rbac.yamlis deliberately left in place, so re-enabling this is a one-line revert.Why it's safe to drop
envoyandenvoy-gatewaysecrets still date to 2026-05-18 — it only creates certs when missing.kubectl apply.Should this cluster ever need certgen again (cert loss, a from-scratch rebuild), reverting this line restores it.
Verification
Ran
git holo project k8s-manifestslocally against this branch. The only delta versus the currently deployed tree:The certgen RBAC (
ClusterRole,ClusterRoleBinding,Role,RoleBinding,ServiceAccount) is retained as intended, and nothing else in the projection moves.🤖 Generated with Claude Code
https://claude.ai/code/session_01MSNAVVDuF46SMHjnyfmxwU