add default secretgen rebase rule for secrets (#284)

Co-authored-by: Dmitriy Kalinin <[email protected]>
carvel-dev · Aug 23, 2021 · d362816 · d362816
1 parent a85ae04
commit d362816
Showing 1 changed file with 17 additions and 0 deletions.
diff --git a/pkg/kapp/config/default.go b/pkg/kapp/config/default.go
@@ -153,6 +153,23 @@ rebaseRules:
   resourceMatchers:
   - apiVersionKindMatcher: {apiVersion: v1, kind: ServiceAccount}
 
+# Secretgen populates secret data for annotated secrets
+- paths:
+  - [data, .dockerconfigjson]
+  - [metadata, annotations, secretgen.carvel.dev/status]
+  type: copy
+  sources: [existing, new]
+  resourceMatchers:
+  - andMatcher:
+      matchers:
+      - apiVersionKindMatcher: {apiVersion: v1, kind: Secret}
+      - hasAnnotationMatcher:
+          keys: [secretgen.carvel.dev/image-pull-secret]
+      - notMatcher:
+          matcher:
+            hasAnnotationMatcher:
+              keys: [kapp.k14s.io/disable-default-secretgen-rebase-rules]
+
 diffAgainstLastAppliedFieldExclusionRules:
 - path: [metadata, annotations, "deployment.kubernetes.io/revision"]
   resourceMatchers: *appsV1DeploymentWithRevAnnKey