helm values from secrets and configmaps

[mkjpryor]

Summary

I would like to be able to specify a configmap/secret and key containing Helm values for my application.

Motivation

I am using Argo to install Helm applications from a Helm repository, not a git repository, and am specifying values using the spec.source.helm.values field. However when my Helm values contain secrets, I would like to be able to keep them in a secret and reference the secret here instead.

More generally, it would be good to be able to specify multiple values sources from configmaps, secrets and inline blocks that are passed to Helm in the order they are defined.

Because of the way I am using ArgoCD as a backend for a user-facing system, it is not practical to use files in a git repository for this.

Proposal

I propose a new field spec.source.helm.valuesSources that can hold references to a configmap, secret or inline block, e.g.:

spec:
  source:
    helm:
      valuesSources:
        - configMap:
            name: my-configmap
            key: values
        - secret:
            name: my-secret
            key: values
        - inline: |
            inline:
              values: here

These values would be used at the same precedence as the current spec.source.helm.values block.

[blakepettersson]

This could be addressed with #12050

[crenshaw-dev]

Personally I'd want to add HTTPS and auth for both repo-server and Redis before enabling this. Those should be bare minimum protections for services which serve secrets.

[mkjpryor]

@crenshaw-dev Agreed, those things would be nice. However at the moment the only option for a case like this with no associated Git repo is to put secret data in plain-text in the Argo Application spec which is also not ideal.

[infa-msheik]

+1
need this feature ASAP.

[JordanYefet]

+1
It would be incredibly useful to have the ability to pass dynamic values from an external resource, such as Terraform (TF). Currently, we are creating ConfigMaps (CMs) and secrets with values from TF resources and utilizing a mid-script to place them inside Argo applications. However, this process is not very convenient.

[patrostkowski]

+1 this would be incredibly useful!

[AnhQuanTrl]

This feature is a must haves for bridging the gap between ArgoCD and Terraform resoures.

[matmitch]

+1 this feature would be so useful !

[vijaySamanuri]

Is this Addressed?

[AnhQuanTrl]

Currently I am using the Argocd Vault Plugin. From terraform I created a secret in the argocd namespace that contains all the terraform values that I want to export. Then in ArgoCD git repository, I use this plugin to reference these values in my yaml. It works fine for now.