Reintroduce logic to redeploy agent (daemonset and api-reader deployment) when secrets or configmap changes

Author: Michael Chmielewski

templates/daemonset.yaml

@@ -22,9 +22,16 @@ spec:
         app.kubernetes.io/managed-by: {{ .Release.Service }}
       name: {{ include "threatstack-agent.name" . }}
       annotations:
-      {{- if .Values.daemonset.podAnnotations }}
+        # If configmap or secret files change, this will change the checksum annotations in the daemonset, forcing a redeploy.
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+{{- if not .Values.agentSetupExternalSecretRef }}
+        checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+{{- else }}
+        checksum/secrets: {{ .Values.agentSetupExternalSecretRef.checksum | sha256sum }}
+{{- end }}
+{{- if .Values.daemonset.podAnnotations }}
 {{ toYaml .Values.daemonset.podAnnotations | indent 8 }}
-      {{- end }}
+{{- end }}
     spec:
 {{- if .Values.imagePullSecrets }}
       imagePullSecrets:

templates/deployment-api-reader.yaml

@@ -23,6 +23,13 @@ spec:
         app.kubernetes.io/managed-by: {{ .Release.Service }}
       name: {{ include "threatstack-agent.name" .}}-kubernetes-api
       annotations:
+        # If configmap or secret files change, this will change the checksum annotations in the daemonset, forcing a redeploy.
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+{{- if not .Values.agentSetupExternalSecretRef }}
+        checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+{{- else }}
+        checksum/secrets: {{ .Values.agentSetupExternalSecretRef.checksum | sha256sum }}
+{{- end }}
     spec:
 {{- if .Values.imagePullSecrets }}
       imagePullSecrets: