fix: align --resources-to-ignore=configMaps with renamed ResourceMap key#1145
Merged
msafwankarim merged 4 commits intoJun 15, 2026
Conversation
PR stakater#1061 renamed the configmap key in kube.ResourceMap from "configMaps" (camelCase) to "configmaps" (lowercase) to fix controllers not being able to mark themselves as initialized. However, two callers were not updated to match the new canonical key: 1. The Helm chart's deployment template still emits `--resources-to-ignore=configMaps` (camelCase) when `reloader.ignoreConfigMaps: true` is set. 2. The validation in `GetIgnoredResourcesList` only accepts the legacy camelCase spelling. Because `ignoredResourcesList.Contains(k)` uses case-sensitive string equality, the lookup against the new lowercase ResourceMap key never matches. The configmaps controller is created and starts watching ConfigMaps cluster-wide, even though the chart's ClusterRole template (also gated on `ignoreConfigMaps`) does not grant permission for it. The resulting pod logs are full of: configmaps is forbidden: User "system:serviceaccount:reloader:reloader-reloader" cannot list resource "configmaps" in API group "" at the cluster scope This change: - Updates the chart deployment template to emit the canonical lowercase `configmaps` value. - Normalizes the input in `GetIgnoredResourcesList`, accepting both `configMaps` (legacy, for backward compatibility with users who pass the flag directly) and `configmaps` (canonical), and emitting the canonical form to the caller. - Updates the flag help text and adds tests covering both spellings.
Contributor
|
@yvjessestephens Thank you for the PR submission. Please re-sync your fork against master to fix Helm Chart Validation pipeline |
Contributor
Author
@msafwankarim done, I sync'd the fork, let me know if that looks good. |
msafwankarim
requested changes
Jun 12, 2026
Use strings.ToLower so any casing (configMaps, ConfigMaps, sEcrets) normalizes to the canonical lowercase ResourceMap key, and simplify the flag help text. Addresses PR review feedback. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
msafwankarim
approved these changes
Jun 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Background
I came across this regression while rolling out a Renovate-proposed chart bump from
chart-v2.2.5tochart-v2.2.11in one of our staging clusters. We run Reloader withreloader.ignoreConfigMaps: truebecause configmap reload is already handled by Argo CD in our environment, and we don't want both tools fighting each other.Once Argo CD synced the change, the Reloader pod immediately started spamming the log:
even though the pod also clearly logged:
That was the surprise —
ignoreConfigMaps: truewas set, the chart deliberately omits configmap RBAC when that flag is true, and yet a configmap controller was being created and trying to list cluster-wide. Rolling back tochart-v2.2.5made the errors disappear.Tracing through the code revealed a silent mismatch introduced in #1061.
Root cause
#1061 renamed the configmap key in
kube.ResourceMapfromconfigMaps(camelCase) toconfigmaps(lowercase) so controllers could mark themselves as initialized. Two callers were not updated to match:deployments/kubernetes/chart/reloader/templates/deployment.yamlstill emits--resources-to-ignore=configMaps(camelCase) whenreloader.ignoreConfigMaps: trueis set.internal/pkg/util/util.goGetIgnoredResourcesListonly accepts the legacy camelCase spelling.Because
ignoredResourcesList.Contains(k)uses case-sensitive equality, the filter atinternal/pkg/cmd/reloader.go:167never matches the new lowercaseconfigmapskey. The configmaps controller is created and starts watching ConfigMaps cluster-wide, even though the chart's ClusterRole template (also gated onignoreConfigMaps) does not grant permission for it.This regression has been present since
chart-v2.2.6/ appv1.4.11.Changes
configmapsvalue.GetIgnoredResourcesListnormalizes input, accepting bothconfigMaps(legacy, BC for users passing the flag directly) andconfigmaps(canonical), emitting the canonical form to the caller.Test plan
go test ./internal/pkg/util/...helm template ... --set reloader.ignoreConfigMaps=truerenders--resources-to-ignore=configmapsignoreConfigMaps: trueand confirm noconfigmaps is forbiddenRBAC errors