Using Kustomize With Helm Charts for Argo CD Applications

# dev/values-dev.yaml
image:
  repository: bitnamilegacy/postgresql
  tag: 17.6.0-debian-12-r4

auth:
  username: "dev"
  database: "postgres"
  existingSecret: postgresql-credentials

resources:
  requests:
    cpu: 100m
    memory: 512Mi

helmCharts:
  - name: postgresql
    valuesFile: ../base/values.yaml  # Common values
    valuesInline:                     # Environment overrides
      auth:
        username: "dev"

postgresql-gitops/
├── argocd/              # Argo CD Application manifests
├── base/                # Empty (no shared resources for this use case)
├── dev/                 # Dev environment
│   ├── kustomization.yaml
│   ├── values-dev.yaml
│   └── postgresql-credentials-secret.yaml
├── staging/             # Staging environment
│   ├── kustomization.yaml
│   ├── values-staging.yaml
│   └── postgresql-credentials-secret.yaml
└── prod/                # Production environment
    ├── kustomization.yaml
    ├── values-prod.yaml
    └── postgresql-credentials-secret.yaml

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: dev  (1)

resources:  (2)
  - postgresql-credentials-secret.yaml

helmCharts:  (3)
  - name: postgresql
    repo: https://charts.bitnami.com/bitnami
    version: 16.7.27  (4)
    releaseName: postgresql
    namespace: dev
    valuesFile: values-dev.yaml  (5)

# Container image configuration
image:
  registry: docker.io
  repository: bitnamilegacy/postgresql
  tag: 17.6.0-debian-12-r4

# Authentication
auth:
  username: "dev"  (1)
  database: "postgres"
  existingSecret: postgresql-credentials  (2)

# PostgreSQL primary instance configuration
primary:

  # pg_hba.conf - Client authentication configuration
  pgHbaConfiguration: |-  (3)
    local   all             all                                     trust
    host    all             all             127.0.0.1/32            trust
    host    all             all             ::1/128                 trust
    local   replication     all                                     trust
    host    replication     all             127.0.0.1/32            trust
    host    replication     all             ::1/128                 trust
    host    all             all             10.0.0.0/8              trust
    host    all             all             192.168.0.0/16          trust

  # PostgreSQL advanced configuration
  extendedConfiguration: |-  (4)
    wal_level = logical
    max_replication_slots = 10
    max_wal_senders = 10
    max_connections = 200

  # Resource limits (smaller for dev)
  resources:  (5)
    requests:
      cpu: 100m
      memory: 512Mi
    limits:
      cpu: 500m
      memory: 1024Mi

  # Database initialization scripts
  initdb:  (6)
    scripts:
      create-databases.sql: |
        CREATE DATABASE service_foundry;
        GRANT ALL PRIVILEGES ON DATABASE service_foundry TO dev;

        CREATE DATABASE keycloak;
        GRANT ALL PRIVILEGES ON DATABASE keycloak TO dev;

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: postgresql-dev  (1)
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io  (2)
spec:
  project: default

  source:
    repoURL: git@github.com:nsalexamy/service-foundry-argocd.git  (3)
    targetRevision: main  (4)
    path: demo-apps/postgresql-gitops/dev  (5)

  destination:
    server: https://kubernetes.default.svc  (6)
    namespace: dev  (7)

  syncPolicy:
    automated:  (8)
      prune: true  (9)
      selfHeal: true  (10)
      allowEmpty: false

    syncOptions:
      - CreateNamespace=true  (11)

    retry:  (12)
      limit: 5
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m

# Apply the Application manifest
kubectl apply -f argocd/postgresql-dev-application.yaml

# Check the status
kubectl get application -n argocd postgresql-dev

# Or use the Argo CD CLI
argocd app get postgresql-dev

# Patch the argocd-cm ConfigMap to add --enable-helm
kubectl patch configmap argocd-cm -n argocd --type merge \
  -p '{"data":{"kustomize.buildOptions":"--enable-helm"}}'

# Restart the repo server to pick up the change
kubectl rollout restart deployment argocd-repo-server -n argocd

# Wait for it to be ready
kubectl rollout status deployment argocd-repo-server -n argocd --timeout=60s

# Verify the configuration
kubectl get configmap argocd-cm -n argocd \
  -o jsonpath='{.data.kustomize\.buildOptions}'
# Output: --enable-helm

# Hard refresh the application
kubectl patch application postgresql-dev -n argocd --type merge \
  -p '{"metadata":{"annotations":{"argocd.argoproj.io/refresh":"hard"}}}'

# Or delete and recreate it
kubectl delete -f argocd/postgresql-dev-application.yaml
kubectl apply -f argocd/postgresql-dev-application.yaml

configs:
  # Argo CD ConfigMap settings
  cm:
    # Enable Helm chart inflation for Kustomize apps
    kustomize.buildOptions: --enable-helm

helm install argocd argo/argo-cd \
  --namespace argocd --create-namespace \
  --values argocd-custom-values.yaml

Generator (list of environments) + Template = Multiple Applications

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: postgresql-environments  (1)
  namespace: argocd
spec:
  generators:  (2)
  - list:
      elements:
      - env: dev  (3)
        namespace: dev
      - env: staging
        namespace: staging
      - env: prod
        namespace: prod

  template:  (4)
    metadata:
      name: 'postgresql-{{env}}'  (5)
      finalizers:
        - resources-finalizer.argocd.argoproj.io
    spec:
      project: default

      source:
        repoURL: git@github.com:nsalexamy/service-foundry-argocd.git
        targetRevision: main
        path: 'demo-apps/postgresql-gitops/{{env}}'  (6)

      destination:
        server: https://kubernetes.default.svc
        namespace: '{{namespace}}'  (7)

      syncPolicy:
        automated:
          prune: true
          selfHeal: true
          allowEmpty: false

        syncOptions:
          - CreateNamespace=true

        retry:
          limit: 5
          backoff:
            duration: 5s
            factor: 2
            maxDuration: 3m

# Deploy the ApplicationSet
kubectl apply -f argocd/postgresql-applicationset.yaml

# Check what Applications were created
kubectl get applications -n argocd

# You should see:
# demo-postgresql-dev
# demo-postgresql-staging
# demo-postgresql-prod

# Your "secret" is not really secret
echo "cGFzc3dvcmQ=" | base64 -d
# Output: password

# Set your passwords and environment
POSTGRES_PASSWORD="my-super-secret-password" \
DBUSER_PASSWORD="another-secret" \
REPLICATION_PASSWORD="replication-secret" \
NAMESPACE=dev \
./seal-postgresql-secret.sh

# Output:
# Sealed secret created at postgresql-credentials-dev-sealed.yaml

#!/bin/bash

# Set defaults
POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-postgres}
DBUSER_PASSWORD=${DBUSER_PASSWORD:-postgres}
REPLICATION_PASSWORD=${REPLICATION_PASSWORD:-replication}
NAMESPACE=${NAMESPACE:-dev}

SECRET_YAML_FILE="postgresql-credentials-${NAMESPACE}.yaml"
SEALED_SECRET_YAML_FILE="postgresql-credentials-${NAMESPACE}-sealed.yaml"
K8S_PUBLIC_CERT_FILE="pub-cert.pem"

# Step 1: Create a regular Kubernetes Secret (dry-run only)
kubectl create secret generic postgresql-credentials \
    --from-literal=postgres-password=$POSTGRES_PASSWORD \
    --from-literal=password=$DBUSER_PASSWORD \
    --from-literal=replication-password=$REPLICATION_PASSWORD \
    --namespace=$NAMESPACE \
    --dry-run=client -o yaml > $SECRET_YAML_FILE

# Step 2: Fetch the public key from your cluster
kubeseal --fetch-cert \
    --controller-name=sealed-secrets-controller \
    --controller-namespace=kube-system \
    > $K8S_PUBLIC_CERT_FILE

# Step 3: Encrypt the secret using the public key
kubeseal --cert $K8S_PUBLIC_CERT_FILE \
    --format yaml < $SECRET_YAML_FILE > $SEALED_SECRET_YAML_FILE

# Clean up temporary files
rm $SECRET_YAML_FILE
rm $K8S_PUBLIC_CERT_FILE

echo "Sealed secret created at $SEALED_SECRET_YAML_FILE"

# Commit the sealed secret to Git
git add dev/postgresql-credentials-secret.yaml
git commit -m "Add encrypted dev credentials"
git push

# Argo CD will deploy it automatically!