From b8355f1fc100e038bbef5a797b882e5d0fcc2811 Mon Sep 17 00:00:00 2001
From: keyhan <k.tahvilpour@greenweb.ir>
Date: Wed, 22 Apr 2026 18:17:31 +0330
Subject: [PATCH] fix(helm): skip registry-pull-secret if already exists in
 namespace

- Use Helm lookup to check if secret exists before creating
- Add helm.sh/resource-policy: keep to prevent deletion
- Use pre-install hook to avoid ownership conflicts between releases
---
 .../cloudhost-app/templates/registry-pull-secret.yaml    | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/backend/helm/cloudhost-app/templates/registry-pull-secret.yaml b/backend/helm/cloudhost-app/templates/registry-pull-secret.yaml
index 2ef9f22..52bce9c 100644
--- a/backend/helm/cloudhost-app/templates/registry-pull-secret.yaml
+++ b/backend/helm/cloudhost-app/templates/registry-pull-secret.yaml
@@ -1,13 +1,20 @@
 {{- $name := include "cloudhost-app.name" . -}}
 {{- $ns   := include "cloudhost-app.namespace" . -}}
 {{- $registryUrl := .Values.registry.url | default "localhost:30500" -}}
+{{- $existingSecret := lookup "v1" "Secret" $ns "registry-pull-secret" -}}
+{{- if not $existingSecret }}
 apiVersion: v1
 kind: Secret
 metadata:
   name: registry-pull-secret
   namespace: {{ $ns }}
+  annotations:
+    "helm.sh/resource-policy": keep
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "-10"
   labels:
-    {{- include "cloudhost-app.labels" . | nindent 4 }}
+    app.kubernetes.io/managed-by: cloudhost
 type: kubernetes.io/dockerconfigjson
 data:
   .dockerconfigjson: {{ printf `{"auths":{"%s":{"auth":""}}}` $registryUrl | b64enc | quote }}
+{{- end }}