argo-cd: new multiple sources doesn't work with helm-secrets

Checklist:

  • I’ve searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
  • I’ve included steps to reproduce the bug.
  • I’ve pasted the output of argocd version.

Describe the bug

When using as values files in helm application with secrets, using the “secrets+age-import:///age-secret-key/keys.txt” file uri, the ref is not replaced with the file path.

To Reproduce

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: namespace-config
spec:
  project: project
  destination:
    name: in-cluster
    namespace: staging
  source:
    - repoURL: repo2
      targetRevision: main
      ref: config
    - repoURL: repo # Can point to either a Helm chart repo or a git repo.
      targetRevision: HEAD  # For Helm, this refers to the chart version.
      path: path # This has no meaning for Helm charts pulled directly from a Helm repo instead of git.
      helm:
        valueFiles:
          - values.yaml
          - $config/namespace-config/default/values.namespace.yaml
          - secrets+age-import:///age-secret-key/keys.txt?$config/namespace-config/default/secrets.namespace.yaml
          - $config/namespace-config/staging/values.namespace.yaml
          - secrets+age-import:///age-secret-key/keys.txt?$config/namespace-config/staging/secrets.namespace.yaml
      ignoreMissingValueFiles: false
  syncPolicy:
    automated: # automated sync by default retries failed attempts 5 times with following delays between attempts ( 5s, 10s, 20s, 40s, 80s ); retry controlled using `retry` field.
      prune: true # Specifies if resources should be pruned during auto-syncing ( false by default ).
      selfHeal: true # Specifies if partial app sync should be executed when resources are changed only in target Kubernetes cluster and no git change detected ( false by default ).
      allowEmpty: false # Allows deleting all application resources during automatic syncing ( false by default ).
    syncOptions:     # Sync options which modifies sync behavior
      - Validate=false # disables resource validation (equivalent to 'kubectl apply --validate=false') ( true by default ).
      - CreateNamespace=true # Namespace Auto-Creation ensures that namespace specified as the application destination exists in the destination cluster.
      - PrunePropagationPolicy=foreground # Supported policies are background, foreground and orphan.
      - PruneLast=true # Allow the ability for resource pruning to happen as a final, implicit wave of a sync operation
    # The retry feature is available since v1.7
    retry:
      limit: 5 # number of failed sync attempt retries; unlimited number of attempts if less than 0
      backoff:
        duration: 5s # the amount to back off. Default unit is seconds, but could also be a duration (e.g. "2m", "1h")
        factor: 2 # a factor to multiply the base duration after each failed retry
        maxDuration: 3m # the maximum amount of time allowed for the backoff strategy
  # RevisionHistoryLimit limits the number of items kept in the application's revision history, which is used for
  # informational purposes as well as for rollbacks to previous versions. This should only be changed in exceptional
  # circumstances. Setting to zero will store no history. This will reduce storage used. Increasing will increase the
  # space used to store the history, so we do not recommend increasing it.
  revisionHistoryLimit: 1

Expected behavior

ArgoCD should replace $config by the directory path

Screenshots

Version

Paste the output from `argocd version` here.
2.6.0-rc1 (i have no ingress on the argocd deployment so argocd version don't work)

Logs

Paste any relevant application logs here.

About this issue

  • Original URL
  • State: open
  • Created a year ago
  • Reactions: 17
  • Comments: 26 (9 by maintainers)

Most upvoted comments

@morey-tech Hey, so just to clarify, it seems that the fix will not be included in the 2.6 release ? I’m stuck with submodules everytime i want to use secrets for now ?

Based on https://github.com/argoproj/argo-cd/pull/11966#issuecomment-1386387547, unfortunately, it looks that way. As a beta feature, there may be edge cases that aren’t supported yet, and Helm Secrets happen to be a victim of that. Unless someone has time to figure out the solution and properly test it before the 2.6 release on 2023-02-06, it’ll have to wait for 2.7 around 2023-04-10 or there is “some hope for including it in a patch release”

Hi,

We want to use helm-secrets with sops backend + multi sources app. From the following documentation, we understand that the limitation lives on Argo CD side.

https://github.com/jkroepke/helm-secrets/wiki/ArgoCD-Integration#multi-source-application-support-beta

Should we wait for 2.7 release?

Whats is the issue with allow to substitute the $ref after the protocol handler secrets//$ref/? That would be the best user expericence.

It seems like that this issue can be resolved by #12508

@ishitasequeira Did you see any chance that the PR will be merged into 2.7?

As plugin maintainer, i’m open to any reachable solution.

I think that env is for helm-secrets that would by default reject an absolute path, not argo.

Meanwhile 1 week into testing argocd I already hit this limitation too, only because the substitution assumes that the string must start with $ref.

The simplest method for me would be to allow ref substitution (in helm plugin) using both a file path or an URI style reference, without touching the scheme to allow for arbitrary plugins (secrets://).

And limit the substitution to the first match after the scheme.

@MohammedNoureldin

PR #12508 is likely something that we are looking for, but its getting staled

@jkroepke Thanks for reaching out… I have reviewed the PR!! Looking for another eyes from the approvers to get it merged.

Oh sorry, it’s only in the examples, I have sources inside my real yaml file