fix: pin docker-registry haSharedSecret to avoid sandbox manifest churn#7108
Merged
fix: pin docker-registry haSharedSecret to avoid sandbox manifest churn#7108
Conversation
The docker-registry Helm subchart generates a random haSharedSecret on every helm template run when the value is not set. This causes complete.yaml and dev.yaml to always show as modified after running `make sandbox-build`, even with no actual deployment changes. Pin the secret to a static value in flyte-sandbox values.yaml since this is a local development sandbox environment. Signed-off-by: Kevin Su <pingsutw@apache.org>
machichima
approved these changes
Mar 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tracking issue
N/A
Why are the changes needed?
Every time
make sandbox-buildis run,docker/sandbox-bundled/manifests/complete.yamlanddev.yamlshow as modified in git — even when no deployment configuration has changed. This creates unnecessary noise ingit statusand risks accidental commits of non-functional changes.What changes were proposed in this pull request?
The docker-registry Helm subchart generates a random
haSharedSecretviarandAlphaNum 16whensecrets.haSharedSecretis not set. This also changes thechecksum/secretannotation on every run.The fix pins
secrets.haSharedSecretto a static value (flytesandboxsecret) incharts/flyte-sandbox/values.yaml. This is safe since the sandbox is a local development environment, not a production deployment.Changed files:
charts/flyte-sandbox/values.yaml— added staticsecrets.haSharedSecretdocker/sandbox-bundled/manifests/complete.yaml— regenerated with pinned secretdocker/sandbox-bundled/manifests/dev.yaml— regenerated with pinned secretHow was this patch tested?
Ran
make -C docker/sandbox-bundled manifeststwice consecutively and confirmed the generated manifests are identical between runs (no diff).Labels
Check all the applicable boxes
I updated the documentation accordingly.
All new and existing tests passed.
All commits are signed-off.
main