[Enhancement] Documentation: Helm Values Templating Guide

[YvesEarnix]

Summary

While Argo CD has extensive documentation on secret management, there's a gap in guidance for injecting non-sensitive dynamic values (like Terraform outputs) into Helm charts.
This enhancement proposes creating comprehensive documentation to address this common use case based on this proposed solution.

Motivation

Current State

• Argo CD documentation focuses primarily on secret management best practices
• Limited guidance exists for injecting non-sensitive external values into Helm charts
• Previous long discussions about Helm values templating haven't resulted in implemented features

Use Case

A typical DevOps workflow involves:

1. Terraform provisioning cloud resources and Kubernetes clusters
2. Terraform generating outputs (e.g., account id, managed identity client IDs, resource names, ip addresses, ..)
3. Need to inject these non-sensitive values into Helm charts including public without modifying chart structure
4. Terraform outputs format must decoupling form helm values structure that can change in future versions of charts

Proposed Solution

One effective solution is to use Argo CD's ApplicationSet with Git generator to inject non-sensitive values from a Git repository into Helm charts.
This approach allows dynamic values to be templated without modifying the original Helm chart structure, ensuring compatibility with future chart versions.

What do you think about this approach?

Detailed example scenario

Injecting an Azure managed identity client ID into a Loki chart for workload identity authentication.

Step 1: Store Terraform Outputs in Git Repository

Use the Terraform GitHub provider or any others way to push non-sensitive outputs in json format to a dedicated values repository:

resource "github_repository_file" "cluster_values" {
  repository = "terraform-values"
  branch     = terraform.workspace
  file       = "clusters/${terraform.workspace}/values.json"
  content = jsonencode({
    azure = {
      storage_account = azurerm_storage_account.main_storage.name
    }
    clientid = {
      loki = azurerm_user_assigned_identity.workload_loki.client_id
    }
  })
  # Additional configuration as needed
}

File values.json will look like this:

{
  "azure": {
    "storage_account": "my-storage-account"
  },
  "clientid": {
    "loki": "123456789"
  }
}

Step 2: Configure ApplicationSet with Git Generator

Use Argo CD's Git generator to inject values from the value repository into Helm charts:

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: loki
  namespace: argocd
spec:
  generators:
    - git:
        files:
          - path: "clusters/*/values.json"
        # This is the Git repository where dynamic values from terraform are stored
        repoURL: https://github.com/company/terraform-values.git
        revision: HEAD
  goTemplate: true
  goTemplateOptions:
    - missingkey=error
  template:
    metadata:
      finalizers:
        - resources-finalizer.argocd.argoproj.io
      name: "loki"
    spec:
      project: default
      destination:
        name: in-cluster
        namespace: monitoring
      sources:
        - chart: loki
          helm:
            valueFiles:
              - $valuesRepo/argocd/loki/values.yaml
            valuesObject:
              loki:
                rulerConfig:
                  storage:
                    azure:
                      account_name: '{{.azure.storage_account}}'
                storage:
                  azure:
                    accountName: '{{.azure.storage_account}}'
              serviceAccount:
                annotations:
                  azure.workload.identity/client-id: '{{.clientid.loki}}'
          repoURL: https://grafana.github.io/helm-charts
          targetRevision: 6.23.0
        - ref: valuesRepo
          # This is the Git repository where the static values are stored
          repoURL: https://github.com/company/argocd-configurations.git
          targetRevision: HEAD

Key Components Explained

• Git Generator: Makes value file content available as template variables
• valuesObject: Contains dynamic values that are templated using Go template syntax with data from the Git generator
• valueFiles: Optional: references static configuration files in your GitOps repository that don't require templating
• Non-Invasive: Works with any public Helm chart without modification
• Automated: Terraform changes automatically propagate to applications
• GitOps Compliance: All values are stored in Git with full audit trail