You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[INFRA-1333] feat(plane-enterprise): global.deterministicRender for GitOps (3.11.6) - #369
Was: every helm template of the same values differed. The migrator, Plane AI migrator, Argus migrator and MinIO bucket Jobs are named …-<YYYYMMDD-HHMMSS>, and Argus stamps timestamp: now on its pods outside the forceRedeploy gate. ArgoCD shows such releases as permanently out of sync; a customer on 3.10.2 reported it.
Now: opt-in global.deterministicRender (default false). When on:
each of those Jobs is named after a hash of its own rendered spec, so identical values give identical names and any spec change still gives a new Job (needed anyway, because Job specs are immutable). The MinIO bucket Job also hashes the doc-store Secret and chart version, because its bucket name lives in that Secret, not its spec;
Argus uses the shared plane.podAnnotations (checksum/config, timestamp only with forceRedeploy), plus checksum/argus-config, because argus-env is not in the shared checksum.
Each Job's spec moves into a named template so the name can hash it. With the flag off, output is byte-identical to before.
Where to look
🔴 templates/_helpers.tpl — plane.jobRunSuffix (hash vs clock) and plane.argusPodAnnotations (+ checksum/argus-config)
🟡 templates/workloads/{migrator,pi-migrator,argus-migrator}.job.yaml, minio.stateful.yaml — spec moved into a define, name uses the suffix; the spec text is unchanged. MinIO's suffix also hashes the doc-store Secret + chart version
🟡 templates/workloads/argus.deployment.yaml — annotations via the helper
Opt-in, not the default. With hash names, re-rendering identical values no longer reruns migrations, and a failed Job isn't retried until it's deleted. Mutable image tags without forceRedeploy also stop triggering migrations. Keeping the clock by default leaves every existing release and the re-run helm upgrade advice in the README unchanged.
The hash covers the full spec, not just the image. A partial hash would let a spec change keep the same name, and helm upgrade would then fail with field is immutable.
Blast Radius
Every existing release (flag off): manifests identical to master apart from the clock values, verified for defaults, the OpenShift example and forceRedeploy=true.
Releases that turn the flag on: on the first upgrade, the clock-named Jobs are pruned and hash-named Jobs created (migrations run once). After that, Jobs rerun only on spec changes, and Argus pods stop restarting on every render.
Proof
Important
Confidence: Medium — render behaviour verified for every mode; no live ArgoCD or helm upgrade on a cluster
Ran:helm lint. With Argus, Pi and MinIO enabled:
flag off vs master: identical after normalising the clock (default, OpenShift example, forceRedeploy=true), with the same 4 clock-named Jobs;
flag on: two renders identical, zero clock values;
an Argus-only setting change: the Argus migrator is renamed and Argus pods get a new checksum/argus-config; no line outside Argus changes and checksum/config is untouched;
env.docstore_bucket change: the MinIO bucket Job is renamed; a chart-version-only change renames all three Jobs; with doc_store_existingSecret renders stay stable;
planeVersion bump: the three migrators get new names, while the MinIO bucket Job keeps its name because its spec doesn't reference the version;
changing only services.web.replicas: the migrator name is unchanged;
flag + forceRedeploy: new names on every render;
Argus annotations checked for all four flag combinations.
Try it:helm template r charts/plane-enterprise --set license.licenseDomain=x --set global.deterministicRender=true | grep -E '^ name: r-.*migrate-' twice → same names.
Not verified: a live ArgoCD sync and a helm upgrade that switches the flag on, on a cluster.
Rollout
Additive, default off. GitOps users set global.deterministicRender: true.
Values supplied through external_secrets.*_existingSecret are invisible to the chart, so changing only those reruns no Job in this mode (README says so).
Follow-up idea: a CI job that renders twice with the flag on and diffs.
Added an opt-in deterministic rendering setting for GitOps deployments. When enabled, unchanged values produce stable manifests, and selected Job names change when their specifications change.
Failed Jobs are not retried by rerendering unchanged values; delete the Job or enable force redeployment to trigger another run.
Documentation
Documented the new setting and its behavior in the chart documentation.
The chart adds the default-off global.deterministicRender setting. When enabled, selected Job names use hashes of their rendered specs, and Argus pod annotations use shared annotations. The chart version changes from 3.11.4 to 3.11.5.
Changes
Deterministic rendering
Layer / File(s)
Summary
Setting and rendering helpers charts/plane-enterprise/values.yaml, charts/plane-enterprise/templates/_helpers.tpl, charts/plane-enterprise/README.md, charts/plane-enterprise/Chart.yaml
Adds the default-off setting and helpers for hash-based Job suffixes and Argus pod annotations. The README documents stable rendering, rerun behavior, and the setting. The chart version changes to 3.11.5.
Workload naming and annotations charts/plane-enterprise/templates/workloads/argus-migrator.job.yaml, charts/plane-enterprise/templates/workloads/argus.deployment.yaml, charts/plane-enterprise/templates/workloads/migrator.job.yaml, charts/plane-enterprise/templates/workloads/minio.stateful.yaml, charts/plane-enterprise/templates/workloads/pi-migrator.job.yaml
The migrator, Plane AI migrator, Argus migrator, and MinIO bucket Jobs derive suffixes from their rendered specs. Argus deployment and migration pod annotations use the shared helper. When deterministic rendering is disabled, timestamp-based naming and annotations remain in use.
Resolve the deterministic-mode configuration gaps before merging: changing the MinIO bucket can leave uploads targeting a nonexistent bucket, and Argus configuration changes can leave workloads using old settings. The feature is opt-in and disabled by default.
Pre-merge checks: 4
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Title check
The title names the primary change: an opt-in global.deterministicRender setting for GitOps in the plane-enterprise chart. The changeset adds that setting, the helpers that derive hash-based Job nam…
Full details: Title check
Explanation
The title names the primary change: an opt-in global.deterministicRender setting for GitOps in the plane-enterprise chart. The changeset adds that setting, the helpers that derive hash-based Job names, and the Argus annotation change. The version bump to 3.11.6 is a minor detail. The title follows the expected conventional format and is specific. Note that the chart version in Chart.yaml changes to 3.11.5 in the summary, so the title's 3.11.6 does not match the file-level change.
Finishing Touches
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit checks the rendered chart, And watches Job names match their part. A spec hash keeps each name in place, While Argus annotations leave no trace. The rabbit hops through stable YAML with delight.
CodeRabbit Verify
Run CodeRabbit Verify to test the changes in this pull request.
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
pratapalakshmi
changed the title
[INFRA-1333] feat(plane-enterprise): global.deterministicRender for GitOps (3.11.4)
[INFRA-1333] feat(plane-enterprise): global.deterministicRender for GitOps (3.11.5)
Nov 2, 2026
…itOps (3.11.4)
Every render differed, so ArgoCD showed releases as permanently out of sync:
the migrator, Plane AI migrator, Argus migrator and MinIO bucket Jobs are
named after the render time, and Argus stamps a `timestamp` pod annotation
outside the forceRedeploy gate every other workload uses.
Add global.deterministicRender (default false). When on, each of those Jobs is
named after a hash of its own rendered spec. Identical values give an identical
name, and any spec change (image, config checksum, chart version) gives a new
Job, which Job immutability requires anyway. Argus moves onto the shared
plane.podAnnotations. forceRedeploy still renames the Jobs on every render.
Each Job's spec moves into a named template so its name can hash it. With the
flag off, renders are byte-identical to before apart from the clock.
…Jobs when their own config changes (3.11.6)
With global.deterministicRender on, two Jobs could keep their name when their
input changed:
- Argus: argus-env is not in plane.configChecksum, and the per-render timestamp
is gone in this mode, so an Argus-only setting changed nothing in the Argus
pod template or the migrator spec. argusPodAnnotations now adds
checksum/argus-config (a hash of argus-env) in deterministic mode only.
Adding argus-env to configChecksum instead would roll every workload.
- MinIO bucket Job: the bucket name and credentials come from the doc-store
Secret, not the Job spec. Its run suffix now hashes that Secret and the chart
version, so the README's "reruns on image, config or chart version" holds.
Default-mode renders are unchanged (diffed against master with the clock
normalised). Version 3.11.6: master took 3.11.5 in #372.
pratapalakshmi
changed the title
[INFRA-1333] feat(plane-enterprise): global.deterministicRender for GitOps (3.11.5)
[INFRA-1333] feat(plane-enterprise): global.deterministicRender for GitOps (3.11.6)
Nov 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
pratapalakshmi
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
What
helm templateof the same values differed. The migrator, Plane AI migrator, Argus migrator and MinIO bucket Jobs are named…-<YYYYMMDD-HHMMSS>, and Argus stampstimestamp: nowon its pods outside theforceRedeploygate. ArgoCD shows such releases as permanently out of sync; a customer on 3.10.2 reported it.global.deterministicRender(defaultfalse). When on:plane.podAnnotations(checksum/config,timestamponly withforceRedeploy), pluschecksum/argus-config, because argus-env is not in the shared checksum.Where to look
templates/_helpers.tpl—plane.jobRunSuffix(hash vs clock) andplane.argusPodAnnotations(+checksum/argus-config)templates/workloads/{migrator,pi-migrator,argus-migrator}.job.yaml,minio.stateful.yaml— spec moved into adefine, name uses the suffix; the spec text is unchanged. MinIO's suffix also hashes the doc-store Secret + chart versiontemplates/workloads/argus.deployment.yaml— annotations via the helpervalues.yaml,README.md(GitOps paragraph + parameter row),Chart.yaml(3.11.6)Watch out for:
forceRedeployalso stop triggering migrations. Keeping the clock by default leaves every existing release and there-run helm upgradeadvice in the README unchanged.helm upgradewould then fail withfield is immutable.Blast Radius
forceRedeploy=true.Proof
Important
Confidence: Medium — render behaviour verified for every mode; no live ArgoCD or helm upgrade on a cluster
helm lint. With Argus, Pi and MinIO enabled:forceRedeploy=true), with the same 4 clock-named Jobs;checksum/argus-config; no line outside Argus changes andchecksum/configis untouched;env.docstore_bucketchange: the MinIO bucket Job is renamed; a chart-version-only change renames all three Jobs; withdoc_store_existingSecretrenders stay stable;planeVersionbump: the three migrators get new names, while the MinIO bucket Job keeps its name because its spec doesn't reference the version;services.web.replicas: the migrator name is unchanged;forceRedeploy: new names on every render;helm template r charts/plane-enterprise --set license.licenseDomain=x --set global.deterministicRender=true | grep -E '^ name: r-.*migrate-'twice → same names.helm upgradethat switches the flag on, on a cluster.Rollout
global.deterministicRender: true.external_secrets.*_existingSecretare invisible to the chart, so changing only those reruns no Job in this mode (README says so).Links
🤖 Generated with Claude Code
Summary by CodeRabbit