feat(argus,csc): release argus version 15.1.0 & csc version 12.3.0

charts/argus/Chart.yaml

@@ -6,11 +6,11 @@ maintainers:
   - email: argus@logicmonitor.com
     name: LogicMonitor
 name: argus
-version: 15.0.1
+version: 15.1.0
 home: https://logicmonitor.github.io/helm-charts
-appVersion: v18.0.0
+appVersion: v18.1.0
 dependencies:
   - name: lmutil
     repository: https://logicmonitor.github.io/helm-charts
     # repository: file://../lmutil
-    version: 0.1.10
+    version: 0.1.11

charts/argus/templates/_helpers.tpl

@@ -160,12 +160,20 @@ capabilities:
 
 {{/*
 LM Credentials and Proxy Details.
-The user can provide proxy details in values.yaml or by creating user defined secret.
-Argus proxy takes precendence over the global proxy. We need to check if the user defined secret contains
-Argus proxy details or not, for this we're using Lookup function in helm.
+
+These env vars are emitted statically into the Deployment so the manifest is
+fully declarative and GitOps tools (Rancher Fleet, Argo CD) do not see drift.
+This replaces a post-install Job that previously patched the Deployment env
+based on a runtime lookup of the user-defined Secret.
+
+Precedence enforced by the Argus binary (see pkg/config/config.go,
+applySecretEnvOverrides): values from the user-defined Secret win over the
+plaintext values rendered from .Values. Every `*_FROM_SECRET` env var uses
+`optional: true` so a key missing from the user-defined Secret simply leaves
+the override unset — Argus then falls back to the plaintext env.
 */}}
 
-{{- define "lm-credentials-and-proxy-details" -}}
+{{- define "argus.lm-credentials-and-proxy-details" -}}
 - name: ACCESS_ID
   valueFrom:
     secretKeyRef:
@@ -181,14 +189,69 @@ Argus proxy details or not, for this we're using Lookup function in helm.
     secretKeyRef:
       name: {{ include "lmutil.secret-name" . }}
       key: account
-{{- if or .Values.proxy.user .Values.global.proxy.user }}
+{{- /* COMPANY_DOMAIN: secret override (if userDefinedSecret) wins, else plaintext */}}
+{{- if .Values.global.userDefinedSecret }}
+- name: COMPANY_DOMAIN_FROM_SECRET
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.global.userDefinedSecret }}
+      key: companyDomain
+      optional: true
+{{- end }}
+- name: COMPANY_DOMAIN
+  value: {{ .Values.global.companyDomain | default "logicmonitor.com" | quote }}
+{{- /* ETCD_DISCOVERY_TOKEN: optional, sourced from secret only */}}
+{{- if .Values.global.userDefinedSecret }}
+- name: ETCD_DISCOVERY_TOKEN_FROM_SECRET
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.global.userDefinedSecret }}
+      key: etcdDiscoveryToken
+      optional: true
+{{- else }}
+- name: ETCD_DISCOVERY_TOKEN
+  valueFrom:
+    secretKeyRef:
+      name: {{ include "lmutil.secret-name" . }}
+      key: etcdDiscoveryToken
+      optional: true
+{{- end }}
+{{- /* PROXY_USER: argus-specific secret key wins over generic, then plaintext */}}
+{{- if .Values.global.userDefinedSecret }}
+- name: PROXY_USER_FROM_SECRET_ARGUS
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.global.userDefinedSecret }}
+      key: argusProxyUser
+      optional: true
+- name: PROXY_USER_FROM_SECRET
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.global.userDefinedSecret }}
+      key: proxyUser
+      optional: true
+{{- else if or .Values.proxy.user .Values.global.proxy.user }}
 - name: PROXY_USER
   valueFrom:
     secretKeyRef:
       name: {{ include "lmutil.secret-name" . }}
       key: proxyUser
 {{- end }}
-{{- if or .Values.proxy.pass .Values.global.proxy.pass }}
+{{- /* PROXY_PASS: argus-specific secret key wins over generic, then plaintext */}}
+{{- if .Values.global.userDefinedSecret }}
+- name: PROXY_PASS_FROM_SECRET_ARGUS
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.global.userDefinedSecret }}
+      key: argusProxyPass
+      optional: true
+- name: PROXY_PASS_FROM_SECRET
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.global.userDefinedSecret }}
+      key: proxyPass
+      optional: true
+{{- else if or .Values.proxy.pass .Values.global.proxy.pass }}
 - name: PROXY_PASS
   valueFrom:
     secretKeyRef:

charts/argus/templates/collectorset.yaml

@@ -34,7 +34,15 @@ spec:
   {{- $proxyUser := .Values.collector.proxy.user | default "" }}
   {{- $globalProxyUser := .Values.global.proxy.user | default "" }}
   {{- $userDefinedSecret := .Values.global.userDefinedSecret | default "" }}
-  {{- if and (or $proxyUser $globalProxyUser) (empty $userDefinedSecret) }}
+  {{- /*
+  When userDefinedSecret is set, always reference it as the collector's secretName so
+  the CollectorSet can pick up proxy/credentials keys from it. This used to be done at
+  runtime by a post-install Job (`kubectl patch collectorset ... secretName: <uds>`),
+  which caused drift in Rancher Fleet/Argo CD. Inlining it keeps the manifest declarative.
+  */ -}}
+  {{- if $userDefinedSecret }}
+  secretName: {{ $userDefinedSecret }}
+  {{- else if or $proxyUser $globalProxyUser }}
   secretName: {{ include "lmutil.fullname" . }}-collector
   {{- end }}
   {{- if .Values.collector.proxy.url }}

charts/argus/templates/deployment.yaml

@@ -10,7 +10,7 @@ metadata:
     checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
     checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
 spec:
-  replicas: 0
+  replicas: {{ .Values.replicas | default 1 }}
   selector:
     matchLabels:
       {{ include "lmutil.selectorLabels" . | nindent 6 }}
@@ -85,7 +85,7 @@ spec:
               value: {{ template "lmutil.name" . }}
             - name: APP_KUBERNETES_IO_INSTANCE
               value: {{ .Release.Name }}
-        {{ include "lm-credentials-and-proxy-details" . | nindent 12 }}
+        {{ include "argus.lm-credentials-and-proxy-details" . | nindent 12 }}
       volumes:
         - name: collector-ids
           configMap: