fix: conditionally render insecureSkipTLSVerify in APIService template #1727

pawl · 2025-09-25T05:06:51Z

What this PR does / why we need it:
This PR fixes GitOps sync drift caused by the APIService template unconditionally rendering the insecureSkipTLSVerify field.

Problem: When apiService.insecureSkipTLSVerify: false is set in values, Kubernetes omits this field from live resources (since false is the API default), but the Helm template always renders it explicitly. This causes a continuous diff between desired state (Helm template) and live state (Kubernetes API), leading GitOps tools like ArgoCD to show the APIService as "OutOfSync".

Solution: Implement conditional rendering using {{- if .Values.apiService.insecureSkipTLSVerify }} to only include the field when the value is true. This matches the approach used by other projects like KEDA that encountered the same issue.

Which issue(s) this PR fixes:
Fixes #1725

Testing:
The existing chart CI will verify this change works correctly:

Helm chart linting and template validation via chart-testing
Installation testing with insecureSkipTLSVerify: false in multiple scenarios:
- ci/tls-certManager-values.yaml (cert-manager TLS)
- ci/tls-helm-values.yaml (helm-generated TLS)
- ci/tls-existingSecret-values.yaml (existing secret TLS, set dynamically)
Real cluster deployment testing to ensure APIService creation succeeds

Release note:

Fix APIService template to conditionally render insecureSkipTLSVerify field, preventing GitOps sync drift when value is false

linux-foundation-easycla · 2025-09-25T05:06:58Z

The committers listed above are authorized under a signed CLA.

✅ login: pawl / name: Paul Brown (85338e9)

k8s-ci-robot · 2025-09-25T05:06:59Z

This issue is currently awaiting triage.

If metrics-server contributors determine this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot · 2025-09-25T05:07:00Z

Welcome @pawl!

It looks like this is your first PR to kubernetes-sigs/metrics-server 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/metrics-server has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2025-09-25T05:07:01Z

Hi @pawl. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

stevehipwell

Thanks for the PR @pawl, I've added a comment on the change. Could you also add an entry to the chart CHANGELOG.

stevehipwell · 2025-09-25T08:32:53Z

charts/metrics-server/templates/apiservice.yaml

+  {{- if .Values.apiService.insecureSkipTLSVerify }}
  insecureSkipTLSVerify: {{ .Values.apiService.insecureSkipTLSVerify }}
+  {{- end }}


Suggested change

{{- if .Values.apiService.insecureSkipTLSVerify }}

insecureSkipTLSVerify: {{ .Values.apiService.insecureSkipTLSVerify }}

{{- end }}

{{- with .Values.apiService.insecureSkipTLSVerify }}

insecureSkipTLSVerify: {{ . }}

{{- end }}

This would be more idiomatic to the chart.

stevehipwell · 2025-09-25T08:57:47Z

charts/metrics-server/templates/apiservice.yaml

+  {{- with .Values.apiService.insecureSkipTLSVerify }}
+    insecureSkipTLSVerify: {{ . }}
+  {{- end }}


Suggested change

{{- with .Values.apiService.insecureSkipTLSVerify }}

insecureSkipTLSVerify: {{ . }}

{{- end }}

{{- with .Values.apiService.insecureSkipTLSVerify }}

insecureSkipTLSVerify: {{ . }}

{{- end }}

I suspect GitHub didn't get the formatting correct in my last comment, but the indentation needs fixing.

stevehipwell · 2025-09-25T08:59:34Z

charts/metrics-server/CHANGELOG.md

+### Fixed
+
+- Conditionally render `insecureSkipTLSVerify` field in APIService template to prevent GitOps sync drift when value is `false`. ([#1727](https://github.com/kubernetes-sigs/metrics-server/pull/1727)) _@pawl_
+


This needs to be put under the [UNRELEASED] heading. While you're there could you replace the TBC from the 3.13.0 release heading with 2025-07-22 as this hasn't been updated yet.

Only render insecureSkipTLSVerify field when true to prevent GitOps sync drift. Kubernetes omits this field when false (API default), causing ArgoCD to show resources as OutOfSync.

stevehipwell · 2025-09-25T09:27:18Z

Thanks for the prompt changes @pawl.

/ok-to-test

stevehipwell · 2025-09-25T09:44:14Z

/lgtm
/approve

k8s-ci-robot · 2025-09-25T09:44:22Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: pawl, stevehipwell

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~charts/OWNERS~~ [stevehipwell]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Sep 25, 2025

k8s-ci-robot requested review from RainbowMango and stevehipwell September 25, 2025 05:06

k8s-ci-robot added the needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. label Sep 25, 2025

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Sep 25, 2025

github-project-automation bot added this to SIG Instrumentation Sep 25, 2025

github-project-automation bot moved this to Needs Triage in SIG Instrumentation Sep 25, 2025

k8s-ci-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Sep 25, 2025

pawl force-pushed the fix/conditional-insecureSkipTLSVerify branch from ea8a608 to 28ed655 Compare September 25, 2025 05:15

k8s-ci-robot removed the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Sep 25, 2025

stevehipwell suggested changes Sep 25, 2025

View reviewed changes

github-project-automation bot moved this from Needs Triage to In Progress in SIG Instrumentation Sep 25, 2025

pawl force-pushed the fix/conditional-insecureSkipTLSVerify branch 4 times, most recently from 3fb9eb7 to ffd0928 Compare September 25, 2025 08:45

stevehipwell suggested changes Sep 25, 2025

View reviewed changes

fix: conditionally render insecureSkipTLSVerify in APIService template

85338e9

Only render insecureSkipTLSVerify field when true to prevent GitOps sync drift. Kubernetes omits this field when false (API default), causing ArgoCD to show resources as OutOfSync.

pawl force-pushed the fix/conditional-insecureSkipTLSVerify branch from ffd0928 to 85338e9 Compare September 25, 2025 09:14

k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Sep 25, 2025

k8s-ci-robot added the ok-to-test Indicates a non-member PR verified by an org member that is safe to test. label Sep 25, 2025

k8s-ci-robot removed the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Sep 25, 2025

k8s-ci-robot assigned stevehipwell Sep 25, 2025

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 25, 2025

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 25, 2025

k8s-ci-robot merged commit 6513fa9 into kubernetes-sigs:master Sep 25, 2025
14 checks passed

github-project-automation bot moved this from In Progress to Done in SIG Instrumentation Sep 25, 2025

RainbowMango mentioned this pull request Nov 20, 2025

Proposing release 0.9.0 #1739

Open

16 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: conditionally render insecureSkipTLSVerify in APIService template #1727

fix: conditionally render insecureSkipTLSVerify in APIService template #1727

pawl commented Sep 25, 2025

Uh oh!

linux-foundation-easycla bot commented Sep 25, 2025 •

edited

Loading

Uh oh!

k8s-ci-robot commented Sep 25, 2025

Uh oh!

k8s-ci-robot commented Sep 25, 2025

Uh oh!

k8s-ci-robot commented Sep 25, 2025

Uh oh!

stevehipwell left a comment

Uh oh!

stevehipwell Sep 25, 2025

Uh oh!

stevehipwell Sep 25, 2025

Uh oh!

stevehipwell Sep 25, 2025

Uh oh!

stevehipwell commented Sep 25, 2025

Uh oh!

stevehipwell commented Sep 25, 2025

Uh oh!

k8s-ci-robot commented Sep 25, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		### Fixed

		- Conditionally render `insecureSkipTLSVerify` field in APIService template to prevent GitOps sync drift when value is `false`. ([#1727](https://github.com/kubernetes-sigs/metrics-server/pull/1727)) _@pawl_

fix: conditionally render insecureSkipTLSVerify in APIService template #1727

fix: conditionally render insecureSkipTLSVerify in APIService template #1727

Conversation

pawl commented Sep 25, 2025

Uh oh!

linux-foundation-easycla bot commented Sep 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Sep 25, 2025

Uh oh!

k8s-ci-robot commented Sep 25, 2025

Uh oh!

k8s-ci-robot commented Sep 25, 2025

Uh oh!

stevehipwell left a comment

Choose a reason for hiding this comment

Uh oh!

stevehipwell Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

stevehipwell Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

stevehipwell Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

stevehipwell commented Sep 25, 2025

Uh oh!

stevehipwell commented Sep 25, 2025

Uh oh!

k8s-ci-robot commented Sep 25, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

linux-foundation-easycla bot commented Sep 25, 2025 •

edited

Loading