Feature request: supply external/test values for postBuild.substituteFrom (ConfigMaps/Secrets managed outside the Git repo)

[tropnikovvl]

What problem are you trying to solve?

flate has no way to provide values for postBuild.substituteFrom references whose ConfigMap/Secret is managed outside the Git repository (e.g. created by Terraform, cluster bootstrap, or an operator). In this common setup the source object never exists in the rendered tree, so flate cannot resolve the variables - and there is currently no flag, file, or env var to inject them for a CI/offline render.

Context

We manage the flux-cluster-settings ConfigMap with Terraform (it holds per-cluster values like CLUSTER_NAME, AWS_REGION, etc.), and reference it from our Flux Kustomizations:

spec:
  path: ./infrastructure/eks
  postBuild:
    substituteFrom:
      - kind: ConfigMap
        name: flux-cluster-settings   # created by Terraform, NOT in the Git repo

Real Flux resolves this fine at runtime. flate (and flux-local) cannot, because the ConfigMap is not part of the rendered manifests.

Current behavior (flate 0.4.10)

1. Default: the whole Kustomization is marked blocked by … flux-cluster-settings (not found) and flate test exits 1. Everything downstream in that stack is skipped — so those HelmReleases are never validated, and CI is red.
   ⊘ Kustomization flux-system/eks blocked by flux-system/flux-cluster-settings (not found)
2. --allow-missing-secrets does not cover postBuild.substituteFrom ConfigMaps — the stack stays blocked.
3. Marking the ref optional: true unblocks the stack, but then all unresolved ${VAR} behave inconsistently and break rendering — e.g. a chart that does range .Values.domainFilters fails on the literal string, and charts requiring a non-empty value fail (Chart cannot be installed without a valid clusterName!). --skip-schema-validation does not help, since these are Helm template-execution errors, not schema errors.
4. Committing a fallback ConfigMap to the repo is the only workaround, but (a) real Flux then also applies it (conflict/duplication with the Terraform-managed one), and (b) once any substituteFrom source is found, flate performs substitution and empties every variable not present in that ConfigMap — so the fallback must mirror all substitution variables of the stack and be kept in sync forever.

Why it matters

Managing cluster settings in Terraform (or via bootstrap/operators) rather than committing them to Git is a very common pattern. Without external value injection, flate either blocks entire stacks (no validation) or forces committing and maintaining a full mirror ConfigMap that leaks into the real cluster. A simple CI-side values file would let flate validate these stacks accurately while keeping the source of truth outside Git.

Environment

• flate 0.4.10
• macOS (Homebrew cask)

Proposed solution

A first-class way to supply substitution values for offline/CI renders that are not part of the Git tree and are not applied to any cluster. Any of these would solve it:

• A repeatable flag / env var: --substitute-from-file settings.yaml (a plain key: value file), and/or --substitute KEY=VALUE.
• An option to load extra ConfigMap/Secret manifests as substitution sources only (e.g. --extra-values-dir ./ci/flux-settings/), scoped to substitution and never emitted as rendered resources.
• A "leave unresolved variables as-is / configurable default" mode, so undefined vars don't silently become empty and break otherwise-valid renders.

Alternatives considered

No response