Using Kustomize to merge secret into existing secret

[chupacabra71]

I amusing ArgoCD to build an app of apps and also using authentik for SSO. in order for ArgoCD to work with SSO, the instructions specify adding a secret for the client into an existing secret created by ArgoCD. in my kustomize, i can merge the secret using a secret generator.

secretGenerator:
- behavior: merge
  literals:
  - dex.authentik.clientSecret=MyClientSecret
  name: argocd-secret

I was wondering if there is a way to merge the client secret into the existing argocd-secret from external-secrets so that the details are hidden like all my other secrets.

[ikaruswill]

I'm using Argo CD as well, what I did was to set the following on the ExternalSecret

spec:
  target:
    creationPolicy: Merge
    deletionPolicy: Merge

This should then allow ExternalSecret CR to only manage the keys that's defined in the spec.data array, leaving all else untouched.

For relevant docs:
https://external-secrets.io/latest/guides/ownership-deletion-policy/

[chupacabra71]

Thank you! that worked like a charm

[AurimasNav]

How do you handle that the updated secret is out of sync in argocd ?

[langburd]

@AurimasNav, I handled it using annotations in ExternalSecret

metadata:
  annotations:
    argocd.argoproj.io/compare-options: IgnoreExtraneous
    argocd.argoproj.io/sync-options: Prune=false