[Helm] Random password regenerated indefinitely

[maorfr]

Bug Report

What did you do?
As a part of a hack day, we created a Jenkins operator from the stable/jenkins chart, with a couple of modifications. After installing the operator, we noticed that the jenkins admin password, which is defined to be generated randomly, is regenerated indefinitely.

Repository can be found here: https://github.com/jenkins-operator/jenkins-operator
Line in template causing the problem: https://github.com/jenkins-operator/jenkins-operator/blob/master/helm-charts/jenkins/templates/secret.yaml#L18

Currently the repository contains a hard coded admin password (set to "admin" of course 🥇).

What did you expect to see?
We expected the password to be generated once and remain consistent.

What did you see instead? Under which circumstances?
The password was changing every few moments, probably due to a reconciliation loop.

Environment

• operator-sdk version:

operator-sdk version: v0.8.2, commit: 28bd2b0

• go version:

go version go1.11.5 linux/amd64

• Kubernetes version information:

minishift v1.33.0+ba29431

• Kubernetes cluster kind: MiniShift

• Are you writing your operator in ansible, helm, or go?

Helm

Thank you very much!

[joelanford]

@maorfr This sounds like a duplicate of #1106 and #1291.

The helm-operator reconciler upgrade logic works by running a dry-run upgrade and comparing the manifest with the current deployed release. If they differ, an upgrade is performed. When using random functions on helm charts, the dry-run upgrade will always produce a different manfiest, resulting in a never-ending upgrade/reconcile loop.

In this case, the solution would be to set .master.adminPassword in your CR spec so that the template uses the provided value instead of the random function.

[maorfr]

That would mean storing the password in source control in many cases, which is suboptimal imo.
Can the reconciler check if the resource already exists and take that into consideration? If it exists, and it is a randomly generated password, ignore it? Or something similar?