From 248282831aeb93ec52b716a657e9289e6d18037e Mon Sep 17 00:00:00 2001 From: AYDEV-FR Date: Sat, 27 Jun 2026 17:36:11 +0200 Subject: [PATCH] fix(chart): roll dploy pod when secrets change MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit dploy reads OIDC_CLIENT_SECRET and the JWKS/issuer values from the chart-managed Secret as environment variables, which are injected once at container start. When Helm updates the Secret (e.g. rotating the OIDC client_secret) the Deployment pod template is unchanged, so Kubernetes never rolls the pod and the running process keeps the stale secret — silently breaking CTFd SSO with "invalid_client" at the token endpoint until a manual `kubectl rollout restart`. Add a checksum/secret pod annotation hashing the rendered Secret so any value change triggers a rollout automatically. --- charts/dploy/templates/deployment.yaml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/charts/dploy/templates/deployment.yaml b/charts/dploy/templates/deployment.yaml index 1ded144..72c24f4 100644 --- a/charts/dploy/templates/deployment.yaml +++ b/charts/dploy/templates/deployment.yaml @@ -16,10 +16,15 @@ spec: {{- include "dploy.selectorLabels" . | nindent 6 }} template: metadata: - {{- with .Values.podAnnotations }} annotations: + # Roll the pod whenever the Secret changes. dploy reads OIDC_CLIENT_SECRET + # (and the JWKS/issuer values) as env vars, injected once at container + # start, so a Helm-updated Secret is otherwise ignored until a manual + # restart — e.g. rotating the OIDC client_secret breaks SSO silently. + checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} + {{- with .Values.podAnnotations }} {{- toYaml . | nindent 8 }} - {{- end }} + {{- end }} labels: {{- include "dploy.selectorLabels" . | nindent 8 }} spec: