ApplicationSet and secret paths

[huehnerhose]

Hi,

I was not able to find how to solve this, though I have the constant feeling of not asking the right search prompts.

I use app-of-apps approach to deploy ApplicationSets, deploying e.g. qa and prod env per Application. So I have an ApplicationSet "apps-of-apps" deploying via list-generator multiple Application, e.g. Application: "supporting-services" which deployes ApplicationSet "frontend-service", which deploys "frontend-service-prod" and "frontend-service-qa". The applications themselves are helm deployments via source.helm.values. So the applicationSet (reduced) looks like:

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: frontend-service
spec:
  goTemplate: true
  generators:
  - list:
      elements:
      - project: "qa"
        namespace: qa
        vaultPath: "dev"
      - project: "prod"
        namespace: prod
        vaultPath: "prod"

  template:
    metadata:
      name: frontend-service-{{.project}}
    spec:
      destination:
        namespace: '{{.namespace}}'
        server: 'https://kubernetes.default.svc'
      project: '{{.project}}'
      source:
        repoURL: helm.repo.com
        targetRevision: '3.2.12'
        chart: frontend-service
        plugin:
          env:
            - name: TEST
              value: FOO
        helm:
          values: |
            env:
              API_KEY: "<path:myapplication-{{.vaultPath}}-secrets/data/mySecret#API_KEY>"

You probably already see the issue.

API_KEY: "<path:myapplication-{{.vaultPath}}-secrets/data/mySecret#API_KEY>"

breaks the argocd-vault-plugin generate run, since the {{.vaultPath}} replacement / templating happens after the AVP is running. So AVP gets the literal string <path:myapplication-{{.vaultPath}}-secrets/data/mySecret#API_KEY> as path to look for the secret.

I tried, as you can see with the source.plugin.env part to pass ENV to the CMP/AVP run to run some replacement prior to the actual run of argocd-vault-plugin generate. But I never get a run on this ApplicationSet / resulting Application. But always only on the Application "supporting-services".

I moved the avp-annotation between the different Application Manifests, without any result.

Long Story short: I am lost if my setup is stupid to begin with and / or can work with AVP at all?

Edit:
I deploy AVP as sidecar in the argo-cd helm chart via

          cmp:
            create: true
            plugins:
              avp:
                allowConcurrency: true
                discover:
                  find:
                    command:
                      - sh
                      - "-c"
                      - "find . -name '*.yaml' | xargs -I {} grep \"<path\\|avp\\.kubernetes\\.io\" {} | grep ."
                generate:
                  command:
                    - sh
                    - "-c"
                    - "argocd-vault-plugin generate -s \"argocd:vault-configuration\" ."