From 6c6776f2b4ae423d721e5532e73779f898b50b72 Mon Sep 17 00:00:00 2001
From: hstanley <hstanley@thoughtmachine.net>
Date: Wed, 26 Jun 2019 17:43:23 +0100
Subject: [PATCH 1/7] Optionally disable checking k8s Secrets

---
 internal/pkg/cmd/reloader.go | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/internal/pkg/cmd/reloader.go b/internal/pkg/cmd/reloader.go
index 70750527..e8c8b61f 100644
--- a/internal/pkg/cmd/reloader.go
+++ b/internal/pkg/cmd/reloader.go
@@ -23,6 +23,7 @@ func NewReloaderCommand() *cobra.Command {
 	cmd.PersistentFlags().StringVar(&options.ConfigmapUpdateOnChangeAnnotation, "configmap-annotation", "configmap.reloader.stakater.com/reload", "annotation to detect changes in configmaps")
 	cmd.PersistentFlags().StringVar(&options.SecretUpdateOnChangeAnnotation, "secret-annotation", "secret.reloader.stakater.com/reload", "annotation to detect changes in secrets")
 	cmd.PersistentFlags().StringVar(&options.ReloaderAutoAnnotation, "auto-annotation", "reloader.stakater.com/auto", "annotation to detect changes in secrets")
+	cmd.PersistentFlags().Bool("ignore-secrets", false, "disable detection of changes in secrets")
 
 	return cmd
 }
@@ -41,6 +42,16 @@ func startReloader(cmd *cobra.Command, args []string) {
 		logrus.Fatal(err)
 	}
 
+	resources := kube.ResourceMap
+	ignoreSecrets, err := cmd.Flags().GetBool("ignore-secrets")
+	if err != nil {
+		logrus.Fatal(err)
+	}
+
+	if ignoreSecrets {
+		delete(resources, "ignore-secrets")
+	}
+
 	for k := range kube.ResourceMap {
 		c, err := controller.NewController(clientset, k, currentNamespace)
 		if err != nil {

From 59fd71d15f0e1f5470e926f4dc0139a756249c58 Mon Sep 17 00:00:00 2001
From: hstanley <hstanley@thoughtmachine.net>
Date: Tue, 2 Jul 2019 14:08:13 +0100
Subject: [PATCH 2/7] Add 'resources-to-watch' flag

---
 internal/pkg/cmd/reloader.go | 29 ++++++++++++++++++++++++-----
 1 file changed, 24 insertions(+), 5 deletions(-)

diff --git a/internal/pkg/cmd/reloader.go b/internal/pkg/cmd/reloader.go
index e8c8b61f..fb1c9ebe 100644
--- a/internal/pkg/cmd/reloader.go
+++ b/internal/pkg/cmd/reloader.go
@@ -23,12 +23,15 @@ func NewReloaderCommand() *cobra.Command {
 	cmd.PersistentFlags().StringVar(&options.ConfigmapUpdateOnChangeAnnotation, "configmap-annotation", "configmap.reloader.stakater.com/reload", "annotation to detect changes in configmaps")
 	cmd.PersistentFlags().StringVar(&options.SecretUpdateOnChangeAnnotation, "secret-annotation", "secret.reloader.stakater.com/reload", "annotation to detect changes in secrets")
 	cmd.PersistentFlags().StringVar(&options.ReloaderAutoAnnotation, "auto-annotation", "reloader.stakater.com/auto", "annotation to detect changes in secrets")
-	cmd.PersistentFlags().Bool("ignore-secrets", false, "disable detection of changes in secrets")
+	cmd.PersistentFlags().StringSlice("resources-to-watch", []string{"configMaps", "secrets"}, "list of resources to watch (valid options 'configMaps', 'secrets')")
 
 	return cmd
 }
 
 func startReloader(cmd *cobra.Command, args []string) {
+	var watchList List
+	var err error
+
 	logrus.Info("Starting Reloader")
 	currentNamespace := os.Getenv("KUBERNETES_NAMESPACE")
 	if len(currentNamespace) == 0 {
@@ -42,17 +45,22 @@ func startReloader(cmd *cobra.Command, args []string) {
 		logrus.Fatal(err)
 	}
 
-	resources := kube.ResourceMap
-	ignoreSecrets, err := cmd.Flags().GetBool("ignore-secrets")
+	watchList, err = cmd.Flags().GetStringSlice("resources-to-watch")
 	if err != nil {
 		logrus.Fatal(err)
 	}
 
-	if ignoreSecrets {
-		delete(resources, "ignore-secrets")
+	for _, v := range watchList {
+		if v != "configMaps" && v != "secrets" {
+			logrus.Fatalf("'resources-to-watch' only accepts 'configMaps' and 'secrets', not '%s'", v)
+		}
 	}
 
 	for k := range kube.ResourceMap {
+		if !watchList.Contains(k) {
+			continue
+		}
+
 		c, err := controller.NewController(clientset, k, currentNamespace)
 		if err != nil {
 			logrus.Fatalf("%s", err)
@@ -68,3 +76,14 @@ func startReloader(cmd *cobra.Command, args []string) {
 	// Wait forever
 	select {}
 }
+
+type List []string
+
+func (l *List) Contains(s string) bool {
+	for _, v := range *l {
+		if v == s {
+			return true
+		}
+	}
+	return false
+}

From 361bea43733432f34863143ab35d80b0f26495b1 Mon Sep 17 00:00:00 2001
From: hstanley <hstanley@thoughtmachine.net>
Date: Wed, 3 Jul 2019 10:32:33 +0100
Subject: [PATCH 3/7] move List to util.go

---
 internal/pkg/cmd/reloader.go | 14 ++------------
 internal/pkg/util/util.go    | 11 +++++++++++
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/internal/pkg/cmd/reloader.go b/internal/pkg/cmd/reloader.go
index fb1c9ebe..7fbb9047 100644
--- a/internal/pkg/cmd/reloader.go
+++ b/internal/pkg/cmd/reloader.go
@@ -7,6 +7,7 @@ import (
 	"github.com/spf13/cobra"
 	"github.com/stakater/Reloader/internal/pkg/controller"
 	"github.com/stakater/Reloader/internal/pkg/options"
+	"github.com/stakater/Reloader/internal/pkg/util"
 	"github.com/stakater/Reloader/pkg/kube"
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 )
@@ -29,7 +30,7 @@ func NewReloaderCommand() *cobra.Command {
 }
 
 func startReloader(cmd *cobra.Command, args []string) {
-	var watchList List
+	var watchList util.List
 	var err error
 
 	logrus.Info("Starting Reloader")
@@ -76,14 +77,3 @@ func startReloader(cmd *cobra.Command, args []string) {
 	// Wait forever
 	select {}
 }
-
-type List []string
-
-func (l *List) Contains(s string) bool {
-	for _, v := range *l {
-		if v == s {
-			return true
-		}
-	}
-	return false
-}
diff --git a/internal/pkg/util/util.go b/internal/pkg/util/util.go
index c1e516a3..e0153f51 100644
--- a/internal/pkg/util/util.go
+++ b/internal/pkg/util/util.go
@@ -46,3 +46,14 @@ func GetSHAfromSecret(data map[string][]byte) string {
 	sort.Strings(values)
 	return crypto.GenerateSHA(strings.Join(values, ";"))
 }
+
+type List []string
+
+func (l *List) Contains(s string) bool {
+	for _, v := range *l {
+		if v == s {
+			return true
+		}
+	}
+	return false
+}

From 8cf105726f9ed780ef3bd34615097a4a057798fa Mon Sep 17 00:00:00 2001
From: hstanley <hstanley@thoughtmachine.net>
Date: Wed, 3 Jul 2019 10:56:09 +0100
Subject: [PATCH 4/7] Update helm charts (deployments and RBAC)

---
 .../kubernetes/chart/reloader/templates/clusterrole.yaml    | 4 ++++
 .../kubernetes/chart/reloader/templates/deployment.yaml     | 6 ++++++
 deployments/kubernetes/chart/reloader/templates/role.yaml   | 4 ++++
 deployments/kubernetes/chart/reloader/values.yaml           | 2 ++
 deployments/kubernetes/manifests/deployment.yaml            | 3 +++
 deployments/kubernetes/reloader.yaml                        | 3 +++
 deployments/kubernetes/templates/chart/values.yaml.tmpl     | 2 ++
 7 files changed, 24 insertions(+)

diff --git a/deployments/kubernetes/chart/reloader/templates/clusterrole.yaml b/deployments/kubernetes/chart/reloader/templates/clusterrole.yaml
index 770f33c2..78206b4b 100644
--- a/deployments/kubernetes/chart/reloader/templates/clusterrole.yaml
+++ b/deployments/kubernetes/chart/reloader/templates/clusterrole.yaml
@@ -16,8 +16,12 @@ rules:
   - apiGroups:
       - ""
     resources:
+{{- if eq .Values.reloader.watchSecrets true }}
       - secrets
+{{- end }}
+{{- if eq .Values.reloader.watchConfigMaps true }}
       - configmaps
+{{- end }}
     verbs:
       - list
       - get
diff --git a/deployments/kubernetes/chart/reloader/templates/deployment.yaml b/deployments/kubernetes/chart/reloader/templates/deployment.yaml
index 3249cae4..f75e61fc 100644
--- a/deployments/kubernetes/chart/reloader/templates/deployment.yaml
+++ b/deployments/kubernetes/chart/reloader/templates/deployment.yaml
@@ -93,6 +93,12 @@ spec:
           - "--auto-annotation"
           - "{{ .Values.reloader.custom_annotations.auto }}"
           {{- end }}
+          {{- if eq .Values.reloader.watchSecrets true }}
+          - "--resources-to-watch=secrets"
+          {{- end }}
+          {{- if eq .Values.reloader.watchConfigMaps true }}
+          - "--resources-to-watch=configMaps"
+          {{- end }}
       {{- end }}
       serviceAccountName: {{ template "reloader-serviceAccountName" . }}
     {{- if eq .Values.reloader.readOnlyRootFileSystem true }}
diff --git a/deployments/kubernetes/chart/reloader/templates/role.yaml b/deployments/kubernetes/chart/reloader/templates/role.yaml
index dd5dac54..e421c3dc 100644
--- a/deployments/kubernetes/chart/reloader/templates/role.yaml
+++ b/deployments/kubernetes/chart/reloader/templates/role.yaml
@@ -16,8 +16,12 @@ rules:
   - apiGroups:
       - ""
     resources:
+      {{- if .Values.reloader.watchSecrets }}
       - secrets
+      {{- end }}
+      {{- if .Values.reloader.watchConfigMaps }}
       - configmaps
+      {{- end }}
     verbs:
       - list
       - get
diff --git a/deployments/kubernetes/chart/reloader/values.yaml b/deployments/kubernetes/chart/reloader/values.yaml
index fcfc2b62..e593b5ad 100644
--- a/deployments/kubernetes/chart/reloader/values.yaml
+++ b/deployments/kubernetes/chart/reloader/values.yaml
@@ -4,6 +4,8 @@ kubernetes:
   host: https://kubernetes.default
 
 reloader:
+  watchSecrets: true
+  watchConfigMaps: true
   watchGlobally: true
   # Set to true if you have a pod security policy that enforces readOnlyRootFilesystem
   readOnlyRootFileSystem: false
diff --git a/deployments/kubernetes/manifests/deployment.yaml b/deployments/kubernetes/manifests/deployment.yaml
index 1bb00246..ff1bd387 100644
--- a/deployments/kubernetes/manifests/deployment.yaml
+++ b/deployments/kubernetes/manifests/deployment.yaml
@@ -37,5 +37,8 @@ spec:
         image: "stakater/reloader:v0.0.31"
         imagePullPolicy: IfNotPresent
         name: reloader
+        args:
+          - "--resources-to-watch=secrets"
+          - "--resources-to-watch=configMaps"
       serviceAccountName: reloader
 
diff --git a/deployments/kubernetes/reloader.yaml b/deployments/kubernetes/reloader.yaml
index af1c757b..8f6527c1 100644
--- a/deployments/kubernetes/reloader.yaml
+++ b/deployments/kubernetes/reloader.yaml
@@ -41,6 +41,9 @@ spec:
         image: "stakater/reloader:v0.0.31"
         imagePullPolicy: IfNotPresent
         name: reloader
+        args:
+          - "--resources-to-watch=secrets"
+          - "--resources-to-watch=configMaps"
       serviceAccountName: reloader
 
 ---
diff --git a/deployments/kubernetes/templates/chart/values.yaml.tmpl b/deployments/kubernetes/templates/chart/values.yaml.tmpl
index 6575647d..6b43edb6 100644
--- a/deployments/kubernetes/templates/chart/values.yaml.tmpl
+++ b/deployments/kubernetes/templates/chart/values.yaml.tmpl
@@ -4,6 +4,8 @@ kubernetes:
   host: https://kubernetes.default
 
 reloader:
+  watchSecrets: true
+  watchConfigMaps: true
   watchGlobally: true
   # Set to true if you have a pod security policy that enforces readOnlyRootFilesystem
   readOnlyRootFileSystem: false

From 3e6c4a3f609492f8f9eef277f90c6503b1e76821 Mon Sep 17 00:00:00 2001
From: hstanley <hstanley@thoughtmachine.net>
Date: Wed, 3 Jul 2019 16:01:15 +0100
Subject: [PATCH 5/7] Switch from list of resources to monitor to list of
 resources to ignore

---
 .../chart/reloader/templates/clusterrole.yaml        |  4 ++--
 .../chart/reloader/templates/deployment.yaml         |  8 ++++----
 .../kubernetes/chart/reloader/templates/role.yaml    |  8 ++++----
 deployments/kubernetes/chart/reloader/values.yaml    |  4 ++--
 .../kubernetes/templates/chart/values.yaml.tmpl      |  4 ++--
 internal/pkg/cmd/reloader.go                         | 12 ++++++------
 6 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/deployments/kubernetes/chart/reloader/templates/clusterrole.yaml b/deployments/kubernetes/chart/reloader/templates/clusterrole.yaml
index 78206b4b..8075763e 100644
--- a/deployments/kubernetes/chart/reloader/templates/clusterrole.yaml
+++ b/deployments/kubernetes/chart/reloader/templates/clusterrole.yaml
@@ -16,10 +16,10 @@ rules:
   - apiGroups:
       - ""
     resources:
-{{- if eq .Values.reloader.watchSecrets true }}
+{{- if .Values.reloader.ignoreSecrets }}{{- else }}
       - secrets
 {{- end }}
-{{- if eq .Values.reloader.watchConfigMaps true }}
+{{- if .Values.reloader.ignoreConfigMaps }}{{- else }}
       - configmaps
 {{- end }}
     verbs:
diff --git a/deployments/kubernetes/chart/reloader/templates/deployment.yaml b/deployments/kubernetes/chart/reloader/templates/deployment.yaml
index f75e61fc..3ccf44f1 100644
--- a/deployments/kubernetes/chart/reloader/templates/deployment.yaml
+++ b/deployments/kubernetes/chart/reloader/templates/deployment.yaml
@@ -93,11 +93,11 @@ spec:
           - "--auto-annotation"
           - "{{ .Values.reloader.custom_annotations.auto }}"
           {{- end }}
-          {{- if eq .Values.reloader.watchSecrets true }}
-          - "--resources-to-watch=secrets"
+          {{- if eq .Values.reloader.ignoreSecrets true }}
+          - "--resources-to-ignore=secrets"
           {{- end }}
-          {{- if eq .Values.reloader.watchConfigMaps true }}
-          - "--resources-to-watch=configMaps"
+          {{- if eq .Values.reloader.ignoreConfigMaps true }}
+          - "--resources-to-ignore=configMaps"
           {{- end }}
       {{- end }}
       serviceAccountName: {{ template "reloader-serviceAccountName" . }}
diff --git a/deployments/kubernetes/chart/reloader/templates/role.yaml b/deployments/kubernetes/chart/reloader/templates/role.yaml
index e421c3dc..90a348f6 100644
--- a/deployments/kubernetes/chart/reloader/templates/role.yaml
+++ b/deployments/kubernetes/chart/reloader/templates/role.yaml
@@ -16,12 +16,12 @@ rules:
   - apiGroups:
       - ""
     resources:
-      {{- if .Values.reloader.watchSecrets }}
+{{- if .Values.reloader.ignoreSecrets }}{{- else }}
       - secrets
-      {{- end }}
-      {{- if .Values.reloader.watchConfigMaps }}
+{{- end }}
+{{- if .Values.reloader.ignoreConfigMaps }}{{- else }}
       - configmaps
-      {{- end }}
+{{- end }}
     verbs:
       - list
       - get
diff --git a/deployments/kubernetes/chart/reloader/values.yaml b/deployments/kubernetes/chart/reloader/values.yaml
index e593b5ad..7df3dcf7 100644
--- a/deployments/kubernetes/chart/reloader/values.yaml
+++ b/deployments/kubernetes/chart/reloader/values.yaml
@@ -4,8 +4,8 @@ kubernetes:
   host: https://kubernetes.default
 
 reloader:
-  watchSecrets: true
-  watchConfigMaps: true
+  ignoreSecrets: false
+  ignoreConfigMaps: false
   watchGlobally: true
   # Set to true if you have a pod security policy that enforces readOnlyRootFilesystem
   readOnlyRootFileSystem: false
diff --git a/deployments/kubernetes/templates/chart/values.yaml.tmpl b/deployments/kubernetes/templates/chart/values.yaml.tmpl
index 6b43edb6..06b857b3 100644
--- a/deployments/kubernetes/templates/chart/values.yaml.tmpl
+++ b/deployments/kubernetes/templates/chart/values.yaml.tmpl
@@ -4,8 +4,8 @@ kubernetes:
   host: https://kubernetes.default
 
 reloader:
-  watchSecrets: true
-  watchConfigMaps: true
+  ignoreSecrets: false
+  ignoreConfigMaps: false
   watchGlobally: true
   # Set to true if you have a pod security policy that enforces readOnlyRootFilesystem
   readOnlyRootFileSystem: false
diff --git a/internal/pkg/cmd/reloader.go b/internal/pkg/cmd/reloader.go
index 7fbb9047..98aa6b67 100644
--- a/internal/pkg/cmd/reloader.go
+++ b/internal/pkg/cmd/reloader.go
@@ -24,13 +24,13 @@ func NewReloaderCommand() *cobra.Command {
 	cmd.PersistentFlags().StringVar(&options.ConfigmapUpdateOnChangeAnnotation, "configmap-annotation", "configmap.reloader.stakater.com/reload", "annotation to detect changes in configmaps")
 	cmd.PersistentFlags().StringVar(&options.SecretUpdateOnChangeAnnotation, "secret-annotation", "secret.reloader.stakater.com/reload", "annotation to detect changes in secrets")
 	cmd.PersistentFlags().StringVar(&options.ReloaderAutoAnnotation, "auto-annotation", "reloader.stakater.com/auto", "annotation to detect changes in secrets")
-	cmd.PersistentFlags().StringSlice("resources-to-watch", []string{"configMaps", "secrets"}, "list of resources to watch (valid options 'configMaps', 'secrets')")
+	cmd.PersistentFlags().StringSlice("resources-to-ignore", []string{}, "list of resources to ignore (valid options 'configMaps', 'secrets')")
 
 	return cmd
 }
 
 func startReloader(cmd *cobra.Command, args []string) {
-	var watchList util.List
+	var ignoreList util.List
 	var err error
 
 	logrus.Info("Starting Reloader")
@@ -46,19 +46,19 @@ func startReloader(cmd *cobra.Command, args []string) {
 		logrus.Fatal(err)
 	}
 
-	watchList, err = cmd.Flags().GetStringSlice("resources-to-watch")
+	ignoreList, err = cmd.Flags().GetStringSlice("resources-to-ignore")
 	if err != nil {
 		logrus.Fatal(err)
 	}
 
-	for _, v := range watchList {
+	for _, v := range ignoreList {
 		if v != "configMaps" && v != "secrets" {
-			logrus.Fatalf("'resources-to-watch' only accepts 'configMaps' and 'secrets', not '%s'", v)
+			logrus.Fatalf("'resources-to-ignore' only accepts 'configMaps' or 'secrets', not '%s'", v)
 		}
 	}
 
 	for k := range kube.ResourceMap {
-		if !watchList.Contains(k) {
+		if ignoreList.Contains(k) {
 			continue
 		}
 

From a69674ba4ca902b01b84e9b7615d71058942b99c Mon Sep 17 00:00:00 2001
From: hstanley <hstanley@thoughtmachine.net>
Date: Thu, 4 Jul 2019 10:03:14 +0100
Subject: [PATCH 6/7] Remove errant 'resources-to-watch' flags

---
 deployments/kubernetes/manifests/deployment.yaml | 3 ---
 deployments/kubernetes/reloader.yaml             | 3 ---
 2 files changed, 6 deletions(-)

diff --git a/deployments/kubernetes/manifests/deployment.yaml b/deployments/kubernetes/manifests/deployment.yaml
index ff1bd387..1bb00246 100644
--- a/deployments/kubernetes/manifests/deployment.yaml
+++ b/deployments/kubernetes/manifests/deployment.yaml
@@ -37,8 +37,5 @@ spec:
         image: "stakater/reloader:v0.0.31"
         imagePullPolicy: IfNotPresent
         name: reloader
-        args:
-          - "--resources-to-watch=secrets"
-          - "--resources-to-watch=configMaps"
       serviceAccountName: reloader
 
diff --git a/deployments/kubernetes/reloader.yaml b/deployments/kubernetes/reloader.yaml
index 8f6527c1..af1c757b 100644
--- a/deployments/kubernetes/reloader.yaml
+++ b/deployments/kubernetes/reloader.yaml
@@ -41,9 +41,6 @@ spec:
         image: "stakater/reloader:v0.0.31"
         imagePullPolicy: IfNotPresent
         name: reloader
-        args:
-          - "--resources-to-watch=secrets"
-          - "--resources-to-watch=configMaps"
       serviceAccountName: reloader
 
 ---

From 795de2399bf02be9d44ba35952e2261d25797db1 Mon Sep 17 00:00:00 2001
From: hstanley <hstanley@thoughtmachine.net>
Date: Thu, 4 Jul 2019 10:21:19 +0100
Subject: [PATCH 7/7] Fail if user tries to ignore all resource types

---
 internal/pkg/cmd/reloader.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/internal/pkg/cmd/reloader.go b/internal/pkg/cmd/reloader.go
index 98aa6b67..426b5e0d 100644
--- a/internal/pkg/cmd/reloader.go
+++ b/internal/pkg/cmd/reloader.go
@@ -24,7 +24,7 @@ func NewReloaderCommand() *cobra.Command {
 	cmd.PersistentFlags().StringVar(&options.ConfigmapUpdateOnChangeAnnotation, "configmap-annotation", "configmap.reloader.stakater.com/reload", "annotation to detect changes in configmaps")
 	cmd.PersistentFlags().StringVar(&options.SecretUpdateOnChangeAnnotation, "secret-annotation", "secret.reloader.stakater.com/reload", "annotation to detect changes in secrets")
 	cmd.PersistentFlags().StringVar(&options.ReloaderAutoAnnotation, "auto-annotation", "reloader.stakater.com/auto", "annotation to detect changes in secrets")
-	cmd.PersistentFlags().StringSlice("resources-to-ignore", []string{}, "list of resources to ignore (valid options 'configMaps', 'secrets')")
+	cmd.PersistentFlags().StringSlice("resources-to-ignore", []string{}, "list of resources to ignore (valid options 'configMaps' or 'secrets')")
 
 	return cmd
 }
@@ -57,6 +57,10 @@ func startReloader(cmd *cobra.Command, args []string) {
 		}
 	}
 
+	if len(ignoreList) > 1 {
+		logrus.Fatal("'resources-to-ignore' only accepts 'configMaps' or 'secrets', not both")
+	}
+
 	for k := range kube.ResourceMap {
 		if ignoreList.Contains(k) {
 			continue