From 14d9bd4b223cd58addb1789249007374ba1afbaa Mon Sep 17 00:00:00 2001 From: Chris Alfano Date: Tue, 25 Aug 2026 12:34:04 -0400 Subject: [PATCH] chore(envoy-gateway): exclude certgen hook Job from projected manifests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The gateway-helm chart ships certgen.yaml as a Helm `pre-install,pre-upgrade` hook that generates the envoy-gateway webhook certs. `helm template` emits hooks like any other manifest and the helm3 hololens has no --no-hooks option, so the Job lands in the projection and gets kubectl-applied on every deploy. Because it carries `ttlSecondsAfterFinished: 30` it deletes itself moments after running, so `kubectl diff` reports it as a fresh creation in every deploy PR. That noise recurs indefinitely and buries the real changes — it showed up alongside the vaultwarden bump in #185 and in #181 before that, and each occurrence has to be re-triaged by hand. Excluding the chart template drops the Job before helm renders it, mirroring the `!templates/tests/**` exclusion already used for the vaultwarden chart. certgen-rbac.yaml is deliberately left in place so re-enabling this is a one-line revert. Verified safe to drop: - The Job is idempotent and does not rotate existing certs — it re-ran during #181 and the envoy/envoy-gateway secrets still date to 2026-05-18. - Those certs are valid until 2031-05-17. Verified with `git holo project k8s-manifests`: the only delta against the deployed tree is removal of envoy-gateway-system/Job/envoy-gateway-gateway-helm-certgen.yaml. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01MSNAVVDuF46SMHjnyfmxwU --- .holo/branches/k8s-manifests/_civic-cloud.toml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.holo/branches/k8s-manifests/_civic-cloud.toml b/.holo/branches/k8s-manifests/_civic-cloud.toml index ca89979..6bd8c64 100644 --- a/.holo/branches/k8s-manifests/_civic-cloud.toml +++ b/.holo/branches/k8s-manifests/_civic-cloud.toml @@ -11,5 +11,19 @@ files = [ # from a now-empty input tree. "!ingress-nginx/**", "!.holo/lenses/ingress-nginx.toml", + + # certgen.yaml is a Helm `pre-install,pre-upgrade` hook Job that generates + # the envoy-gateway webhook certs. `helm template` emits hooks like any + # other manifest (the helm3 lens has no --no-hooks), so it lands in the + # projection and gets kubectl-applied on every deploy. + # + # It carries `ttlSecondsAfterFinished: 30`, so it deletes itself moments + # after running. `kubectl diff` therefore reports it as a fresh creation in + # EVERY deploy PR, which buries real changes in recurring noise. + # + # Dropping the template excludes the Job while leaving certgen-rbac.yaml in + # place, so re-enabling it is a one-line revert. The certs it generated are + # valid until 2031-05-17 and it does not rotate existing ones. + "!envoy-gateway/helm-chart/templates/certgen.yaml", ] before = "*"