Skip to content

Argo CD $values multi-source ref is Git-only; blocks argocd deployer over OCI #960

Description

@mchmarny

Surfaced during live acceptance testing of #843 (PR #956). The raw argocd deployer's pkg/bundler/deployer/argocd/templates/application.yaml.tmpl renders child Applications with a multi-source pattern:

sources:
  - repoURL: {{ .Repository }}        # upstream Helm chart, e.g. https://charts.jetstack.io
    chart: {{ .Chart }}
    targetRevision: {{ .Version }}
    helm:
      valueFiles:
        - $values/{{ .BundleDir }}/values.yaml
  - repoURL: '{{ .RepoURL }}'         # AICR's repo — assumed Git
    targetRevision: {{ .TargetRevision }}
    ref: values

The ref: values source is consumed by Argo CD via $values/... substitution. Argo CD's $values multi-source support is Git-onlypkg/cli/bundle.go:172-176 now derives an oci://... repoURL for --deployer argocd --output oci://..., but Argo CD's repo-server then attempts a Git ListRefs against the OCI URL:

time=… level=error msg="Failed to get git client for repo oci://registry.aicr-registry.svc.cluster.local:5000/aicr/eks-training: failed to list refs: unsupported scheme \"oci\""

This is a known Argo CD design limitation, not a config bug. Two viable fixes for AICR:

Option A — Inline values in the template when target is OCI. application.yaml.tmpl would render helm.valuesObject: {{ .Values | toYaml | nindent N }} instead of helm.valueFiles: [$values/.../values.yaml]. Bundler already has the rendered values in hand; embedding them into the manifest is straightforward but produces larger Application manifests.

Option B — Drop multi-source; render a per-component values-blob in the Application's helm.values: |- string. Same goal, marginally different shape.

Option C — Push the bundle to a Git source for the argocd deployer; reserve OCI for argocd-helm (where the whole chart is the artifact and $values is not used). Documented constraint, less impactful change.

Phase-0 spike for #843 missed this because the spike used a hand-rolled minimal Application shape (source.directory.recurse) without the multi-source $values indirection. The live acceptance test on eks-training (14 child Applications, mix of upstream + local Helm) caught it.

PR #956 (currently draft) ships the helm + argocd-helm-oci lanes; argocd-oci is on hold pending this issue. See PR description for the full state.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    Fields

    No fields configured for Bug.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions