feat(plane-ce): extraObjects, so an environment can ship its own ESO manifests (1.8.0)

[pratapalakshmi]

#285 gave this chart the externalized-secret contract but no way to deliver the objects that produce those Secrets. A SecretStore and the ExternalSecrets behind external_secrets.* belong to the operator rather than to this chart — but they have nowhere to live when a GitOps tool treats one directory as one unit.

Without this they need a second Fleet bundle purely to exist, and a second bundle is a second thing to order correctly. plane-enterprise already has extraObjects for exactly this; this brings plane-ce level.

The part that is easy to get wrong

Rendered with toYaml and not tpl, matching plane-enterprise. The objects people put here are usually ExternalSecrets whose target.template carries ESO's own {{ }} placeholders — tpl would try to evaluate those as Helm expressions and either fail or, worse, silently resolve them to empty.

Verified with a realistic ExternalSecret. In, and out of the render byte-identical:

REDIS_URL: 'redis://:{{ .password }}@t-redis.ns.svc.cluster.local:6379/'

Ordering

Left to the standard Helm hook annotations, which is what an ExternalSecret wants:

extraObjects:
  - apiVersion: external-secrets.io/v1
    kind: SecretStore
    metadata:
      annotations:
        helm.sh/hook: pre-install,pre-upgrade
        helm.sh/hook-weight: "-10"
        helm.sh/hook-delete-policy: before-hook-creation

This chart's Secret references are optional: false, so a pod that starts before its Secret exists waits in CreateContainerConfigError rather than starting without a credential — which is the behaviour you want, and why the hook weights matter.

Verification

• Additive: with extraObjects empty (the default), the render is 0 lines different from published 1.7.0.
• extraObjects renders, hook annotations intact, ESO placeholders untouched.
• helm lint clean.

Why it needs to land

internal-scripts is migrating community-canary and community-latest off committed credentials — secrets already in AWS (terraform-scripts#117), IAM in internal-scripts#172. Their ESO manifests need somewhere to live, and this is it.

Note this is only extraObjects — no Reloader annotation. That stays out of the public charts and is set per workload from the deployment repo via services.<name>.annotations, which already reaches the workload resource.

[coderabbitai]

Warning

Review limit reached

Next included review available in 2 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d79ec202-1dfb-4d45-beef-a1542a5ce591

📥 Commits

Reviewing files that changed from the base of the PR and between 23b924a and f1e6fb6.

📒 Files selected for processing (3)

• charts/plane-ce/Chart.yaml
• charts/plane-ce/templates/extra-objects.yaml
• charts/plane-ce/values.yaml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}