feat: enable helm-secrets for argocd

Author: josmo

gitops/base-install/argocd/overlays/argo-cd-repo-server-ksops-patch.yaml

@@ -18,7 +18,7 @@ spec:
       # 2. Use an init container to download/copy custom binaries into the emptyDir
       initContainers:
         - name: install-ksops
-          image: viaductoss/ksops:v4.1.1
+          image: viaductoss/ksops:v4.3.3
           command: ["/bin/sh", "-c"]
           args:
             - echo "Installing KSOPS...";
@@ -28,6 +28,37 @@ spec:
           volumeMounts:
             - mountPath: /custom-tools
               name: custom-tools
+        - name: install-custom-tools
+          image: alpine:latest
+          imagePullPolicy: IfNotPresent
+          command: [sh, -ec]
+          env:
+            - name: HELM_SECRETS_VERSION
+              value: "4.6.3"
+            - name: KUBECTL_VERSION
+              value: "1.30.2"
+            - name: VALS_VERSION
+              value: "0.39.3"
+            - name: SOPS_VERSION
+              value: "3.9.4"
+          args:
+            - |
+              mkdir -p /custom-tools/helm-plugins
+
+              GO_ARCH=$(uname -m | sed -e 's/x86_64/amd64/')
+              wget -qO /custom-tools/curl https://github.com/moparisthebest/static-curl/releases/latest/download/curl-${GO_ARCH}
+
+              GO_ARCH=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/') && \
+              wget -qO /custom-tools/kubectl https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/${GO_ARCH}/kubectl
+              wget -qO /custom-tools/sops https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.${GO_ARCH}
+              wget -qO- https://github.com/helmfile/vals/releases/download/v${VALS_VERSION}/vals_${VALS_VERSION}_linux_${GO_ARCH}.tar.gz | tar zxv -C /custom-tools vals
+              wget -qO- https://github.com/jkroepke/helm-secrets/releases/download/v${HELM_SECRETS_VERSION}/helm-secrets.tar.gz | tar -C /custom-tools/helm-plugins -xzf-
+
+              chmod +x /custom-tools/*
+              cp /custom-tools/helm-plugins/helm-secrets/scripts/wrapper/helm.sh /custom-tools/helm
+          volumeMounts:
+            - mountPath: /custom-tools
+              name: custom-tools
          # Import the private gpg key from the secret into argocd
         - name: import-gpg-key
           image: argoproj/argocd:v2.5.0
@@ -49,7 +80,40 @@ spec:
             - secretRef:
                 name: "sops-age"
                 optional: true
+          env:
+            - name: HELM_PLUGINS
+              value: /custom-tools/helm-plugins/
+            - name: HELM_SECRETS_CURL_PATH
+              value: /custom-tools/curl
+            - name: HELM_SECRETS_SOPS_PATH
+              value: /custom-tools/sops
+            - name: HELM_SECRETS_VALS_PATH
+              value: /custom-tools/vals
+            - name: HELM_SECRETS_KUBECTL_PATH
+              value: /custom-tools/kubectl
+            - name: HELM_SECRETS_BACKEND
+              value: sops
+            # https://github.com/jkroepke/helm-secrets/wiki/Security-in-shared-environments
+            - name: HELM_SECRETS_VALUES_ALLOW_SYMLINKS
+              value: "false"
+            - name: HELM_SECRETS_VALUES_ALLOW_ABSOLUTE_PATH
+              value: "true"
+            - name: HELM_SECRETS_VALUES_ALLOW_PATH_TRAVERSAL
+              value: "false"
+            - name: HELM_SECRETS_WRAPPER_ENABLED
+              value: "true"
+            - name: HELM_SECRETS_DECRYPT_SECRETS_IN_TMP_DIR
+              value: "true"
+            - name: HELM_SECRETS_HELM_PATH
+              value: /usr/local/bin/helm
+            - name: HELM_SECRETS_LOAD_GPG_KEYS
+              value: /sops-gpg/sops.asc
           volumeMounts:
+            - mountPath: /custom-tools
+              name: custom-tools
+            - mountPath: /usr/local/sbin/helm
+              subPath: helm
+              name: custom-tools
             - mountPath: /usr/local/bin/kustomize
               name: custom-tools
               subPath: kustomize

gitops/base-install/argocd/overlays/argocd-cm-patch.yaml

@@ -13,3 +13,8 @@ data:
   resource.customizations.ignoreDifferences.admissionregistration.k8s.io_ValidatingWebhookConfiguration: |
     jqPathExpressions:
     - '.webhooks[]?.clientConfig.caBundle'
+  helm.valuesFileSchemes: >-
+    secrets+gpg-import, secrets+gpg-import-kubernetes,
+    secrets+age-import, secrets+age-import-kubernetes,
+    secrets,secrets+literal,
+    https