SharedResourceWarning using the Pull Request Generator

[amrap030]

Hello together,

I would really like to use the Pull Request Generator to create ephemeral preview environments in my productive cluster. However, I faced some problems and I don't fully understand how to circumvent them. In the following I provide a very specific example.

I tried to use a preview environment of my deployed helm chart for external-secrets. I use the following Pull generator (using the argocd apps helm chart):

argocd-apps:
  applicationsets:
    preview:
      namespace: argocd
      goTemplate: true
      goTemplateOptions: ["missingkey=error"]
      generators:
        - matrix:
            generators:
              - list:
                  elements:
                    - name: cert-manager
                      namespace: cert-manager
                      path: core/cert-manager
                      label: "preview-cert-manager"
                    - name: external-secrets
                      namespace: external-secrets
                      path: core/external-secrets
                      label: "preview-external-secrets"
              - pullRequest:
                  requeueAfterSeconds: 600
                  github:
                    owner: "uptime"
                    repo: "uptime"
                    api: "https://***.com/api/v3"
                    appSecretName: "argocd-repository-secret"
                    labels:
                      - "{{ .label }}"
      ignoreApplicationDifferences:
        - jsonPointers:
            - /spec/syncPolicy
      template:
        metadata:
          name: "{{ .name }}-{{ .number }}-preview"
          namespace: argocd
          # finalizers:
          #   - resources-finalizer.argocd.argoproj.io
        spec:
          project: default
          source:
            repoURL: "https://***.com/uptime/uptime.git"
            targetRevision: "{{ .head_sha }}"
            path: "cluster/apps/ndc-prod2/{{ .path }}"
            helm:
              valueFiles:
                - values.yaml
                - values-preview.yaml
              parameters:
                - name: "environment"
                  value: "preview"
          destination:
            server: "https://kubernetes.default.svc"
            namespace: "{{ .name }}-{{ .number }}-preview"
          syncPolicy:
            automated:
              prune: true
              selfHeal: true
            retry:
              limit: 10
              backoff:
                duration: 1m
                maxDuration: 16m
                factor: 2
            syncOptions:
              - CreateNamespace=true
              - ServerSideApply=true
              - ApplyOutOfSyncOnly=true
              - RespectIgnoreDifferences=true

When I add the label preview-external-secrets, argocd creates the preview application in my cluster. It is then called for example external-secrets-211-preview. The problem is that I now get a SharedResourceWarning with the following message:

ValidatingWebhookConfiguration/externalsecret-validate is part of applications argocd/external-secrets-215-preview and external-secrets

The problem is, that the chart that I am using has hardcoded the names of the webhook configurations, so the shared resource warning error appears (see here: https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/validatingwebhook.yaml).

I face the same error when the chart includes cluster wide resources.

Now the question is, how do I handle a SharedResourceWarning in my preview applications generated by the Pull Request Generator?

Any help would be appreciated!

P.S. I am deploying my apps in argocd using the umbrella chart approach.