[Bug] `chart/templates/tetrate-istio.yaml` should use `spec: ignoreDifferences:` to hide things that will always be out of sync

[spkane]

There are some fields that will ALWAYS show a difference in ArgoCD unless ignoreDifferences is set correctly in the Application manifest for tetrate-istio

See: https://argo-cd.readthedocs.io/en/stable/user-guide/diffing/#application-level-configuration

I'll add the exact config here, if/when I work it out.

[spkane]

I feel like something like this should work, and although I can get this to apply and not produce any errors, it also does not hide the diff.

  ignoreDifferences:
  - kind: MutatingWebhookConfiguration
    name: istio-sidecar-injector
    jqPathExpressions:
    - '.webhooks[]?.clientConfig.caBundle'
  - kind: ValidatingWebhookConfiguration
    name: istiod-default-validator
    jqPathExpressions:
    - '.webhooks[]?.failurePolicy'

Mode docs: https://github.com/argoproj/argo-cd/blob/master/docs/user-guide/diffing.md#application-level-configuration

[spkane]

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: istiod-default-validator

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: istio-sidecar-injector

[spkane]

I think that this is indeed the correct thing to add to the Application spec:

  ignoreDifferences:
  - kind: MutatingWebhookConfiguration
    name: istio-sidecar-injector
    jqPathExpressions:
    - '.webhooks[]?.clientConfig.caBundle'
  - kind: ValidatingWebhookConfiguration
    name: istiod-default-validator
    jqPathExpressions:
    - '.webhooks[]?.failurePolicy'

But I have reported a bug upstream, as I can't actually get this to work, despite what the documentation suggests.

[allamand]

@spkane, what is the status on this one ?

[spkane]

@allamand No idea unfortunately. I am no longer working on this and have no idea if a solution was ever discovered.

[hybner]

@spkane there should be group field. You can try:

  ignoreDifferences:
  - group: admissionregistration.k8s.io
    kind: MutatingWebhookConfiguration
    name: istio-sidecar-injector
    jqPathExpressions:
    - '.webhooks[]?.clientConfig.caBundle'
  - group: admissionregistration.k8s.io
    kind: ValidatingWebhookConfiguration
    name: istiod-default-validator
    jqPathExpressions:
    - '.webhooks[]?.failurePolicy'