Support private helm (deps) repositories

[romuduck]

Hello,

looking at the code below, I assume private repositories are not supported

func (h helmProcessor) repoEnsure(path string, name string, url string) error {
	_, err := h.helmDo(path, `repo`, `add`, name, url)
	return err
}

I was wondering if we could provide a limited support by leveraging ArgoCD env variables like: GIT_USERNAME and GIT_PASSWORD, assuming the same credentials for source repo, and all other repo found underneath.
It would work in my case but maybe too limited for community.

++
thanks

[Joibel]

I'll have a look at this. We should work out how to support it.
GIT_USERNAME and GIT_PASSWORD wouldn't get through Argo CD 2.4's allowed plugin names: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/upgrading/2.3-2.4.md#update-plugins-to-use-newly-prefixed-environment-variables

I could make ARGOCD_ENV_GIT_ work as alternatives for 2.4.

If you can token authenticate with your repo, you could define your repo as https://@/path and I'm pretty sure that would work. It isn't ideal.

I will add user+password support though.

[romuduck]

Thanks @Joibel, I ll try your workaround.
Thanks

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[Joibel]

Would still like to fix this.

[paveq]

This would be really useful feature to have.

[Tyrion85]

If you can token authenticate with your repo, you could define your repo as https://@/path and I'm pretty sure that would work. It isn't ideal.

@Joibel could you give a more detailed example? I've been trying to configure a remote base for kustomize, to no avail (because local bases don't work).

Given a private GitHub repo https://github.com/MyOrg/my-repo and a base path k8s/base/namespaces, what should a kustomization.yaml look like? This repo is added to ArgoCD with access token (or with ssh key, both work for me)

I've tried a number of different combinations of https with access token and ssh with ssh key, none of them seem to work. Some examples that don't work:

git::https://github.com/MyOrg/my-repo/k8s/base/namespaces?ref=main
https://github.com/MyOrg/my-repo/k8s/base/namespaces?ref=main
https://@/github.com/MyOrg/my-repo/k8s/base/namespaces
https://@/github.com/MyOrg/my-repo/k8s/base/namespaces?ref=main
https://username@github.com/MyOrg/my-repo/k8s/base/namespaces
https://username@github.com/MyOrg/my-repo/k8s/base/namespaces?ref=main
ssh://github.com/MyOrg/my-repo.git//k8s/base/namespaces
ssh://git@github.com/MyOrg/my-repo.git//k8s/base/namespaces
.......

Weirdly enough, ssh://github.com/MyOrg/my-repo.git//k8s/base/namespaces works when a new test case is added in test directory here in source code, but not when run in ArgoCD with reposerver having an ssh config to repo.

Thanks! 🙏🏼

[Joibel]

https://token@github.com/MyOrg/my-repo/k8s/base/namespaces is what I was thinking of.

[Tyrion85]

https://token@github.com/MyOrg/my-repo/k8s/base/namespaces is what I was thinking of.

oh, that won't work for obvious reasons out of the box :( can't really store a token in git, and there is no CI or any scripting in front of it. Maybe some preprocessing would work, but that sounds complicated. Don't you guys have requirements for inclusion of bases? Curious what others are doing and how they're solving this issue.

[Joibel]

I don't use bases myself, no.
I use applicationsets with LOVELY_KUSTOMIZE_MERGE/PATCH or sometimes just applications with same for variations. But the differences are minor between instances.
I'd like what you're doing to work. This ticket here should really be solved by reading and using the ArgoCD secrets that already exist. This is non-trivial to implement, but it is here to be done. Solving #66 for you is easier, so more likely to get done in the short term.
If you're using hashicorp vault our sister project argocd-vault-replacer can easily plug your token in at argocd level, but setting any of that up is hard work, so I don't really recommend it as a solution to your problem.

[astephanh]

@Tyrion85 One workaround for now would be to download the dependency chart and put in the charts folder.

[Joibel]

The problem with using ArgoCD secrets that it has for access to private repos is that lovely doesn't implement projects, and access to those secrets is guarded by project membership. I'll investigate project detection, but I really suspect this won't work.

As a workaround, given that only admins should have access to the application object itself, is to provide to lovely a list of secrets that it may use as secrets for repositories, then we can use argocd's secrets instead of implementing our own.

[astephanh]

Hi,

i couldn't find any information about a plugin could access the repository settings. But - just an idea here: maybe it would be possible to use the Argocd "internal" helm integration to pull the charts via the repository settings.