argocd-secret.github-webhook.patch.yaml

#
#  Author: Hari Sekhon
#  Date: 2021-06-10 18:26:29 +0100 (Thu, 10 Jun 2021)
#
#  vim:ts=2:sts=2:sw=2:et
#  lint: k8s
#
#  https://github.com/HariSekhon/Kubernetes-configs
#
#  License: see accompanying Hari Sekhon LICENSE file
#
#  If you're using my code you're welcome to connect with me on LinkedIn and optionally send me feedback to help steer this or other code I publish
#
#  https://www.linkedin.com/in/HariSekhon
#

# ============================================================================ #
#                     ArgoCD Secret Patch for GitHub Webhook
# ============================================================================ #

# https://argo-cd.readthedocs.io/en/stable/operator-manual/webhook/

# Configures ArgoCD master secret 'argocd-secret' with a GitHub Webhook string secret for authenticated webhook calls
#
# This secret change triggers a self-shutdown restart of ArgoCD

# Apply options:
#
# 1. Sourced via Kustomize patchesStrategicMerge since upstream base does define argocd-secret object
#
# 2. CLI patch:
#
#   run: kubectl patch secret argocd-secret -n argocd --type merge --patch "$(cat argocd-secret.github-webhook.patch.yaml)"
#
# OR
#
# 3. CLI without saved patch file (safest):
#
#   echo "$GITHUB_WEBHOOK_SECRET" | kubectl patch secret argocd-secret --namespace argocd --patch '{"data": { "webhook.github.secret": "{'"$(base64)"'}" } }'

---
apiVersion: v1
kind: Secret
metadata:
  name: argocd-secret
  #namespace: argocd  # breaks kustomize patching, see argocd-cm.repos.patch.yaml for details
# stringData is a special Kubernetes trick to not have to base64 encode this so it stays readable
stringData:
  webhook.github.secret: some_non_sensitive_secret_otherwise_use_CLI_above_without_saved_patch