From 50887550e08f8d8ec3f8277c7f64fc36c911803a Mon Sep 17 00:00:00 2001
From: Erki Aas <erki@veebkolm.ee>
Date: Mon, 31 Aug 2026 17:50:52 +0300
Subject: [PATCH] Let Argo ignore dynamically generated secret diffs

---
 argocd/applications/garage.yaml          |  7 ++++
 argocd/applications/harbor-operator.yaml | 47 ++++++++++++++++++++++++
 argocd/applications/woodpecker.yaml      |  7 ++++
 3 files changed, 61 insertions(+)

diff --git a/argocd/applications/garage.yaml b/argocd/applications/garage.yaml
index 0bd3310..a94f2d6 100644
--- a/argocd/applications/garage.yaml
+++ b/argocd/applications/garage.yaml
@@ -20,6 +20,13 @@ spec:
   destination:
     server: 'https://kubernetes.default.svc'
     namespace: garage
+  ignoreDifferences:
+    - group: ""
+      kind: Secret
+      name: garage-rpc-secret
+      namespace: garage
+      jsonPointers:
+        - /data
   syncPolicy:
     automated:
       prune: true
diff --git a/argocd/applications/harbor-operator.yaml b/argocd/applications/harbor-operator.yaml
index b80a714..d0255ce 100644
--- a/argocd/applications/harbor-operator.yaml
+++ b/argocd/applications/harbor-operator.yaml
@@ -14,6 +14,53 @@ spec:
   destination:
     server: 'https://kubernetes.default.svc'
     namespace: harbor-operator
+  ignoreDifferences:
+    - group: ""
+      kind: Secret
+      namespace: harbor-operator
+      name: harbor-core
+      jsonPointers:
+        - /data
+    - group: ""
+      kind: Secret
+      namespace: harbor-operator
+      name: harbor-jobservice
+      jsonPointers:
+        - /data
+    - group: ""
+      kind: Secret
+      namespace: harbor-operator
+      name: harbor-registry
+      jsonPointers:
+        - /data
+    - group: ""
+      kind: Secret
+      namespace: harbor-operator
+      name: harbor-registry-htpasswd
+      jsonPointers:
+        - /data
+    - group: apps
+      kind: Deployment
+      namespace: harbor-operator
+      name: harbor-core
+      jsonPointers:
+        - /spec/template/metadata/annotations/checksum~1secret
+        - /spec/template/metadata/annotations/checksum~1secret-jobservice
+    - group: apps
+      kind: Deployment
+      namespace: harbor-operator
+      name: harbor-jobservice
+      jsonPointers:
+        - /spec/template/metadata/annotations/checksum~1secret
+        - /spec/template/metadata/annotations/checksum~1secret-core
+    - group: apps
+      kind: Deployment
+      namespace: harbor-operator
+      name: harbor-registry
+      jsonPointers:
+        - /spec/template/metadata/annotations/checksum~1secret
+        - /spec/template/metadata/annotations/checksum~1secret-core
+        - /spec/template/metadata/annotations/checksum~1secret-jobservice
   syncPolicy:
     automated:
      prune: true
diff --git a/argocd/applications/woodpecker.yaml b/argocd/applications/woodpecker.yaml
index 698b7e8..22293d7 100644
--- a/argocd/applications/woodpecker.yaml
+++ b/argocd/applications/woodpecker.yaml
@@ -14,6 +14,13 @@ spec:
   destination:
     server: 'https://kubernetes.default.svc'
     namespace: woodpecker
+  ignoreDifferences:
+    - group: ""
+      kind: Secret
+      name: woodpecker-default-agent-secret
+      namespace: woodpecker
+      jsonPointers:
+        - /data
   syncPolicy:
     automated:
       prune: true