feat(helm): allow to disable tls-checksum generation

[lukidzi]

Checklist prior to review

It might be useful to not generate a new checksum for each secret change, sometimes we don't need to restart control plane or we are not using them. In this case, we don't need to restart. Also, Argo generates a checksum for each template and that can cause additional ReplicaSet for each deployment.

• Link to relevant issue as well as docs and UI issues --
• This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as a image registry) and it will work on Windows, system specific functions like syscall.Mkfifo have equivalent implementation on the other OS --
• Tests (Unit test, E2E tests, manual test on universal and k8s) --
• Do you need to update UPGRADE.md? --
• Does it need to be backported according to the backporting policy? (this GH action will add "backport" label based on these file globs, if you want to prevent it from adding the "backport" label use no-backport-autolabel label) --
• Do you need to explicitly set a > Changelog: entry here or add a ci/ label to run fewer/more tests?

[slonka]

don't need to restart control plane

can you be more specific here, in which cases?

we are not using them

can we just have a conditional checking for usage?

Argo generates a checksum for each template

yeah but the checksum there should be the same, right? if the underlying value of cp-webhooks-and-secrets.yaml did not change then sha256 also shouldn't change

[lukidzi]

don't need to restart control plane

can you be more specific here, in which cases?

Example: helm template, when you do helm template it doesn't connect to the cluster so even if the secret exists it doesn't know about it and generate new checksum

we are not using them

can we just have a conditional checking for usage?

It's not a trivial change and might breaks many things - each server API requires them and while going this way notice more changes than expected

Argo generates a checksum for each template

yeah but the checksum there should be the same, right? if the underlying value of cp-webhooks-and-secrets.yaml did not change then sha256 also shouldn't change

It's not correct. Because helm template doesn't connect to the cluster it generates new sha each time. While applying there is no changes but when service is using helm template (like argo) it generates new hash each time. That creates new replicaSet with new pod template, but the secret under might not change or even be used