Unnecessary Harbor Pod Restarts Triggered on every PR merge

[amar-opsverse]

Expected behavior and actual behavior:

Expected behavior:
Harbor pods should remain stable without unnecessary restarts when no functional changes are made to Harbor's configuration or resources. ArgoCD should only trigger syncs for actual changes in Harbor's deployment or configuration.

Actual behavior:
Every time a PR is merged into the GitOps repository, ArgoCD detects changes in Harbor-related resources (like secrets or ConfigMaps) and triggers a sync. This results in Harbor pods restarting, even when there are no functional changes. This disrupts availability, impacts builds, and causes unnecessary delays in deployments.
Despite adding the ignoreDifferences rule for Harbor-related secrets in the ArgoCD App YAML, the pod restarts continue due to the checksum in Helm templates for the Deployment and StatefulSet, which detects changes in the associated resources.

Steps to reproduce the problem:

1. Set up Harbor with ArgoCD for GitOps-based deployment.
2. Add Harbor to ArgoCD with ignoreDifferences set for secrets and ConfigMaps in the ArgoCD App YAML.
3. Merge any PR to the GitOps repository that isn't related to Harbor.
4. Observe that ArgoCD triggers a sync, resulting in Harbor pods restarting, even if no changes were made to Harbor-related resources.

Versions:

• Harbor version: v2.5.5
• Kubernetes version: 1.31
• ArgoCD version: v2.3.3
• Helm version: v3.15.4

harbor:
  expose:
    type: ingress
    tls:
      enabled: true
      certSource: secret
      secretName: infra-harbor-ingress
      notarySecretName: infra-harbor-ingress-notary
    ingress:
      hosts:
        core: registry.devopsnow.io
        notary: notary-registry.devopsnow.io
      controller: default
      annotations:
        ingress.kubernetes.io/ssl-redirect: "true"
        ingress.kubernetes.io/proxy-body-size: "0"
        nginx.ingress.kubernetes.io/ssl-redirect: "true"
        nginx.ingress.kubernetes.io/proxy-body-size: "0"
        cert-manager.io/cluster-issuer: cluster-letsencrypt-prod
    clusterIP:
      name: harbor
      annotations: {}
      ports:
        httpPort: 80
        httpsPort: 443
        notaryPort: 4443

  externalURL: https://registry.devopsnow.io

  persistence:
    enabled: true
    resourcePolicy: "keep"
    imageChartStorage:
      type: s3
      s3:
        region: us-east-1
        bucket: "<BUCKET_NAME>"
        accesskey: "<ACCESS_KEY>"
        secretkey: "<SECRET_KEY>"

  updateStrategy:
    type: Recreate

  harborAdminPassword: "<HARBOR_ADMIN_PASSWORD>"

  core:
    replicas: 2

  registry:
    replicas: 2
    relativeurls: true

  chartmuseum:
    replicas: 1

  trivy:
    enabled: true
    image:
      tag: v2.9.1
    gitHubToken: "<GITHUB_TOKEN>"
    skipUpdate: false

  notary:
    server:
      replicas: 2
    signer:
      replicas: 2

[bobindagit]

Same issue. Here is the list of services, which restarts:

• harbor-core
• harbor-jobservice
• harbor-registry

[amar-opsverse]

Same issue. Here is the list of services, which restarts:

• harbor-core
• harbor-jobservice
• harbor-registry

Exactly, the issue I think is with the secret changing in the PR. Any idea why there are dynamic changes picking up

[MinerYang]

dup of #1901

[amar-opsverse]

Same issue. Here is the list of services, which restarts:

• harbor-core
• harbor-jobservice
• harbor-registry

Hi have you guys done any workaround

[bobindagit]

Same issue. Here is the list of services, which restarts:

• harbor-core
• harbor-jobservice
• harbor-registry

Hi have you guys done any workaround

Hi. It doesn't bother us, that's why we didn't try to workaround it