The reference framework is Openshift/ArgoCD. I have an application defined in ArgoCD that, among other resources, contains a configMap that serves for certificate injection into the namespace:
apiVersion: v1
data: {}
kind: ConfigMap
metadata:
labels:
config.openshift.io/inject-trusted-cabundle: "true"
name: ca-inject
namespace: apache
The data
field is empty, for the label config.openshift.io/inject-trusted-cabundle: "true"
guarantees that the such field is automatically populated with a predefined set of certificates when the ConfigMap is loaded:
$ oc get ca-inject -o yaml
apiVersion: v1
kind: ConfigMap
metadata:
labels:
config.openshift.io/inject-trusted-cabundle: "true"
name: ca-inject
namespace: apache
data:
ca-bundle.crt: "-----BEGIN CERTIFICATE-----\n etc."
(reference: OpenShift manual)
However, this behaviour prevents the ConfigMap to ever appear as "in sync" in ArgoCD because the diff between the actual and the desired manifest is always showing the content of the CA bundle:
I have tried to exclude the field using ignoreDifferences
in the Application spec with no success:
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: test-app-cm
namespace: openshift-gitops
spec:
destination:
namespace: test-app-cm
server: [redacted]
ignoreDifferences:
- group: core
kind: ConfigMap
managedFieldsManagers:
- ca-bundle.crt
project: test-app-cm
source:
path: .
repoURL: [redacted]
targetRevision: main
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=false
- Prune=true
- RespectIgnoreDifferences=true
I had done almost everything correctly but I missed some little details:
jsonPointers
instead of managedFieldsManager"*"
as resource groupignoreDifferences
section; otherwise the ignoreDifferences
would be applied to all ConfigMaps.Here is the correct Application configuration:
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: test-app-cm
namespace: openshift-gitops
spec:
destination:
namespace: test-app-cm
server: [redacted]
ignoreDifferences:
- group: "*"
kind: ConfigMap
jsonPointers:
- /data
name: ca-inject
project: test-app-cm
source:
path: .
repoURL: [redacted]
targetRevision: main
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=false
- Prune=true
- RespectIgnoreDifferences=true