Argo CD regenerates the secrets, breaking the app

[ilyannn]

The automatic generation of Postgres secret does not play well with any tool that only uses helm template, e.g. Argo CD.

To reproduce:

1. Create an Argo CD application with the chart
2. Sync the application, creating it
3. Note the value of password in the postgres-secret secret
4. Sync the application again
5. Remove the app pod
6. Observe that the pod is being restarted
7. Note the value of password in the postgres-secret secret again

Expected: the pod successfully restarts, the two noted values are the same
Actual result: the pod fails to restart with the error about incorrect password; the two noted values are different.

Mitigations:

• Do not use automatic secret generation in this situation
• Copy secret values to a new secret and manually switch to using it
• Sync the application without automatic secret generation immediately after creation. This will keep the secret, but always mark it as out of sync
• Use https://github.com/argoproj-labs/argocd-vault-plugin or https://github.com/crumbhole/argocd-vault-replacer

Probably the same happens for the generated internal keys.