Going insane with ArgoCD Vault ... help? maybe?

[flypenguin]

Hi folks,

we are trying to set up ArgoCD vault plugin in an ArgoCD installation. And it doesnt work. At all. And I am completely out of ideas now – after trying for hours on end.

So, here's what I did:

• We deploy ArgoCD using Helm
• We followed the "InitContainer and configuration via sidecar" approach (hopefully)

For that, we ...

• used an initContainer to download ArgoCD Vault Plugin, and
• added an extraContainer to Helm's values file to "run" it (gist with contents)

We then created a dedicated helm chart to test it, and a test secret in an existing application. Long story short: The former works, the latter does not, it just keeps the value <path:...> unchanged.

And we have no clue as of why that is. We double/triple/quadruple checked for any typos, invalid references, etc. – and there is nothing.

The repo layout looks (simplified) like the one pictured below, while the Application objects for both are in the same gist ("application-existing.yaml", "application-for-testing-only.yaml"). I also included the test secrets (one, two).

Any help is greatly appreciated, we are really, really clueless as of now, and this is taking a long time.

Thanks in advance,
Axel.

/repo-root
   |
   |- test-app/
   |    |- Chart.yaml & co
   |    |- templates/
   |         |- secret-consumer.yaml   # this "consumes" a secret from ...
   |         |- secret-reference.yaml  # ... here. that works.
   |
   |- existing-app
   |    |- Chart.yaml & co
   |    |- templates/
   |         |- [... tons of existing stuff incl. secrets ...]
   |         |- new-test-secret.yaml   # the value in here is _not_ replaced.

(also cross-posted to Reddit)