commit 30e5d4241455d23b79bab7c0c548ea84cf5f9ad6
Author: Jiří Suchomel <jiri.suchomel@suse.com>
Date:   Tue Oct 13 09:42:54 2020 +0200

    Do not re-generate password values on upgrade
    
    During 'helm upgrade', if a value is set to empty in values.yaml
    (or override file), do not generate random one but rather fetch
    existing value found in installed secret.
    
    Signed-off-by: Jiří Suchomel <jiri.suchomel@suse.com>

diff --git a/templates/core/core-secret.yaml b/templates/core/core-secret.yaml
index 589014f..c38430a 100644
--- a/templates/core/core-secret.yaml
+++ b/templates/core/core-secret.yaml
@@ -1,17 +1,50 @@
+{{- $secret := include "harbor.core" . }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ template "harbor.core" . }}
+  name: {{ $secret }}
   labels:
 {{ include "harbor.labels" . | indent 4 }}
 type: Opaque
 data:
+{{- if .Release.IsUpgrade }}
+  {{- $prevSecret := (lookup "v1" "Secret" .Release.Namespace $secret) }}
+  {{- if .Values.secretKey }}
+  secretKey: {{ .Values.secretKey | b64enc | quote }}
+  {{- else if $prevSecret }}
+  secretKey: {{ $prevSecret.data.secretKey }}
+  {{- else }}
+  secretKey: {{ randAlphaNum 16 | b64enc | quote }}
+  {{- end }}
+  {{- if .Values.secret }}
+  secret: {{ .Values.secret | b64enc | quote }}
+  {{- else if $prevSecret }}
+  secret: {{ $prevSecret.data.secret }}
+  {{- else }}
+  secret: {{ randAlphaNum 16 | b64enc | quote }}
+  {{- end }}
+  {{- if .Values.harborAdminPassword }}
+  HARBOR_ADMIN_PASSWORD: {{ .Values.harborAdminPassword | b64enc | quote }}
+  {{- else if $prevSecret }}
+  HARBOR_ADMIN_PASSWORD: {{ $prevSecret.data.HARBOR_ADMIN_PASSWORD }}
+  {{- else }}
+  HARBOR_ADMIN_PASSWORD: {{ randAlphaNum 16 | b64enc | quote }}
+  {{- end }}
+  {{- if .Values.core.xsrfKey }}
+  CSRF_KEY: {{ .Values.core.xsrfKey | b64enc | quote }}
+  {{- else if $prevSecret }}
+  CSRF_KEY: {{ $prevSecret.data.CSRF_KEY }}
+  {{- else }}
+  CSRF_KEY: {{ randAlphaNum 32 | b64enc | quote }}
+  {{- end }}
+{{- else }}
   secretKey: {{ .Values.core.secretKey | default (randAlphaNum 16) | b64enc | quote }}
   secret: {{ .Values.core.secret | default (randAlphaNum 16) | b64enc | quote }}
+  HARBOR_ADMIN_PASSWORD: {{ .Values.harborAdminPassword | default (randAlphaNum 16) | b64enc | quote }}
+  CSRF_KEY: {{ .Values.core.xsrfKey | default (randAlphaNum 32) | b64enc | quote }}
+{{- end }}
 {{- if not .Values.core.secretName }}
   tls.crt: {{ .Files.Get "cert/tls.crt" | b64enc }}
   tls.key: {{ .Files.Get "cert/tls.key" | b64enc }}
 {{- end }}
-  HARBOR_ADMIN_PASSWORD: {{ .Values.harborAdminPassword | default (randAlphaNum 16) | b64enc | quote }}
   REGISTRY_CREDENTIAL_PASSWORD: {{ .Values.registry.credentials.password | b64enc | quote }}
-  CSRF_KEY: {{ .Values.core.xsrfKey | default (randAlphaNum 32) | b64enc | quote }}
diff --git a/templates/jobservice/jobservice-secrets.yaml b/templates/jobservice/jobservice-secrets.yaml
index a4750d2..cd84a2b 100644
--- a/templates/jobservice/jobservice-secrets.yaml
+++ b/templates/jobservice/jobservice-secrets.yaml
@@ -1,10 +1,22 @@
+{{- $secret := include "harbor.jobservice" . }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: "{{ template "harbor.jobservice" . }}"
+  name: {{ $secret }}
   labels:
 {{ include "harbor.labels" . | indent 4 }}
 type: Opaque
 data:
+  {{- if .Release.IsUpgrade }}
+    {{- $prevSecret := (lookup "v1" "Secret" .Release.Namespace $secret) }}
+    {{- if .Values.jobservice.secret }}
+  JOBSERVICE_SECRET: {{ .Values.jobservice.secret | b64enc | quote }}
+    {{- else if $prevSecret }}
+  JOBSERVICE_SECRET: {{ $prevSecret.data.JOBSERVICE_SECRET }}
+    {{- else }}
+  JOBSERVICE_SECRET: {{ randAlphaNum 16 | b64enc | quote }}
+    {{- end }}
+  {{- else }}
   JOBSERVICE_SECRET: {{ .Values.jobservice.secret | default (randAlphaNum 16) | b64enc | quote }}
+  {{- end }}
   REGISTRY_CREDENTIAL_PASSWORD: {{ .Values.registry.credentials.password | b64enc | quote }}
diff --git a/templates/registry/registry-secret.yaml b/templates/registry/registry-secret.yaml
index f49bd17..33aa40b 100644
--- a/templates/registry/registry-secret.yaml
+++ b/templates/registry/registry-secret.yaml
@@ -1,13 +1,25 @@
+{{- $secret := include "harbor.registry" . }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: "{{ template "harbor.registry" . }}"
+  name: {{ $secret }}
   labels:
 {{ include "harbor.labels" . | indent 4 }}
 type: Opaque
 data:
   REGISTRY_HTPASSWD: {{ .Values.registry.credentials.htpasswd | b64enc | quote }}
+  {{- if .Release.IsUpgrade }}
+    {{- $prevSecret := (lookup "v1" "Secret" .Release.Namespace $secret) }}
+    {{- if .Values.registry.secret }}
+  REGISTRY_HTTP_SECRET: {{ .Values.registry.secret | b64enc | quote }}
+    {{- else if $prevSecret }}
+  REGISTRY_HTTP_SECRET: {{ $prevSecret.data.REGISTRY_HTTP_SECRET }}
+    {{- else }}
+  REGISTRY_HTTP_SECRET: {{ randAlphaNum 16 | b64enc | quote }}
+    {{- end }}
+  {{- else }}
   REGISTRY_HTTP_SECRET: {{ .Values.registry.secret | default (randAlphaNum 16) | b64enc | quote }}
+  {{- end }}
   {{- $storage := .Values.persistence.imageChartStorage }}
   {{- $type := $storage.type }}
   {{- if eq $type "azure" }}
