helmfile.yaml

#
#  Author: Hari Sekhon
#  Date: 2022-04-22 16:59:40 +0100 (Fri, 22 Apr 2022)
#
#  vim:ts=2:sts=2:sw=2:et
#
#  https://github.com/HariSekhon/Templates
#
#  License: see accompanying Hari Sekhon LICENSE file
#
#  If you're using my code you're welcome to connect with me on LinkedIn and optionally send me feedback to help steer this or other code I publish
#
#  https://www.linkedin.com/in/HariSekhon
#

# ============================================================================ #
#                                H e l m f i l e
# ============================================================================ #

# You should probably see kustomization.yaml instead under kubernetes-templates submodule

# https://github.com/helmfile/helmfile

# cleaned up from https://github.com/roboll/helmfile/tree/v0.92.1

---
# Chart repositories used from within this state file
#
# Use `helm-s3` and `helm-git` and whatever Helm Downloader plugins
# to use repositories other than the official repository or one backend by chartmuseum.
repositories:
  # To use official "stable" charts a.k.a https://github.com/helm/charts/tree/master/stable
  - name: stable
    url: https://kubernetes-charts.storage.googleapis.com
  # To use official "incubator" charts a.k.a https://github.com/helm/charts/tree/master/incubator
  - name: incubator
    url: https://kubernetes-charts-incubator.storage.googleapis.com
  # helm-git powered repository: You can treat any Git repository as a charts repository
  - name: polaris
    url: git+https://github.com/reactiveops/polaris@deploy/helm?ref=master
  # Advanced configuration: You can setup basic or tls auth
  - name: roboll
    url: http://roboll.io/charts
    certFile: optional_client_cert
    keyFile: optional_client_key
    username: optional_username
    password: optional_password
  # Advanced configuration: You can use a ca bundle to use an https repo
  # with a self-signed certificate
  - name: insecure
    url: https://charts.my-insecure-domain.com
    caFile: optional_ca_crt

# context: kube-context # this directive is deprecated, please consider using helmDefaults.kubeContext

#default values to set for args along with dedicated keys that can be set by contributers, cli args take precedence over these
helmDefaults:
  tillerNamespace: tiller-namespace  #dedicated default key for tiller-namespace
  tillerless: false                  #dedicated default key for tillerless
  kubeContext: kube-context          #dedicated default key for kube-context (--kube-context)
  # additional and global args passed to helm
  args:
    - "--set k=v"
  # defaults for verify, wait, force, timeout and recreatePods under releases[]
  verify: true
  wait: true
  timeout: 600
  recreatePods: true
  force: true
  # enable TLS for request to Tiller
  tls: true
  # path to TLS CA certificate file (default "$HELM_HOME/ca.pem")
  tlsCACert: "path/to/ca.pem"
  # path to TLS certificate file (default "$HELM_HOME/cert.pem")
  tlsCert: "path/to/cert.pem"
  # path to TLS key file (default "$HELM_HOME/key.pem")
  tlsKey: "path/to/key.pem"

# The desired states of Helm releases.
#
# Helmfile runs various helm commands to converge the current state in the live cluster to the desired state defined here.
releases:
  # Published chart example
  - name: vault                            # name of this release
    namespace: vault                       # target namespace
    labels:                                  # Arbitrary key value pairs for filtering releases
      foo: bar
    chart: roboll/vault-secret-manager     # the chart being installed to create this release, referenced by `repository/chart` syntax
    version: ~1.24.1                       # the semver of the chart. range constraint is supported
    missingFileHandler: Warn # set to either "Error" or "Warn". "Error" instructs helmfile to fail when unable to find a values or secrets file. When "Warn", it prints the file and continues.
    # Values files used for rendering the chart
    values:
      # Value files passed via --values
      - vault.yaml
      # Inline values, passed via a temporary values file and --values, so that it doesn't suffer from type issues like --set
      - address: https://vault.example.com
      # Go template available in inline values and values files.
      - image:
          # The end result is more or less YAML. So do `quote` to prevent number-like strings from accidentally parsed into numbers!
          # See https://github.com/roboll/helmfile/issues/608
          tag: {{requiredEnv "IMAGE_TAG" | quote}}
          # Otherwise:
          #   tag: "{{requiredEnv "IMAGE_TAG"}}"
          #   tag: !!string {{requiredEnv "IMAGE_TAG"}}
        db:
          username: {{requiredEnv "DB_USERNAME"}}
          # value taken from environment variable. Quotes are necessary. Will throw an error if the environment variable is not set. $DB_PASSWORD needs to be set in the calling environment ex: export DB_PASSWORD='password1'
          password: {{requiredEnv "DB_PASSWORD"}}
        proxy:
          # Interpolate environment variable with a fixed string
          #domain: {{requiredEnv "PLATFORM_ID"}}.my-domain.com
          scheme: {{env "SCHEME" | default "https"}}
    # Use `values` whenever possible!
    # `set` translates to helm's `--set key=val`, that is known to suffer from type issues like https://github.com/roboll/helmfile/issues/608
    set:
      # single value loaded from a local file, translates to --set-file foo.config=path/to/file
      - name: foo.config
        file: path/to/file
      # set a single array value in an array, translates to --set bar[0]={1,2}
      - name: bar[0]
        values:
          - 1
          - 2
      # set a templated value
      - name: namespace
        value: {{.Namespace}}
    # will attempt to decrypt it using helm-secrets plugin
    secrets:
      - vault_secret.yaml
    # verify the chart before upgrading (only works with packaged charts not directories)
    verify: true
    # wait for k8s resources via --wait. Defaults to `false`
    wait: true
    # time in seconds to wait for any individual Kubernetes operation (like Jobs for hooks, and waits on pod/pvc/svc/deployment readiness) (default 300)
    timeout: 60
    # performs pods restart for the resource if applicable
    recreatePods: true
    # forces resource update through delete/recreate if needed
    force: true
    # set `false` to uninstall on sync
    installed: true
    # restores previous state in case of failed release
    atomic: true
    # name of the tiller namespace
    tillerNamespace: vault
    # if true, will use the helm-tiller plugin
    tillerless: false
    # enable TLS for request to Tiller
    tls: true
    # path to TLS CA certificate file (default "$HELM_HOME/ca.pem")
    tlsCACert: "path/to/ca.pem"
    # path to TLS certificate file (default "$HELM_HOME/cert.pem")
    tlsCert: "path/to/cert.pem"
    # path to TLS key file (default "$HELM_HOME/key.pem")
    tlsKey: "path/to/key.pem"
    # --kube-context to be passed to helm commands
    # CAUTION: this doesn't work as expected for `tilerless: true`.
    # See https://github.com/roboll/helmfile/issues/642
    kubeContext: kube-context

  # Local chart example
  - name: grafana                            # name of this release
    namespace: another                       # target namespace
    chart: ../my-charts/grafana              # the chart being installed to create this release, referenced by relative path to local helmfile
    values:
      - "../../my-values/grafana/values.yaml"             # Values file (relative path to manifest)
      - ./values/{{requiredEnv "PLATFORM_ENV"}}/config.yaml # Values file taken from path with environment variable. $PLATFORM_ENV must be set in the calling environment.
    wait: true

#
# Advanced Configuration: Nested States
#
helmfiles:
  - # Path to the helmfile state file being processed BEFORE releases in this state file
    path: path/to/subhelmfile.yaml
    # Label selector used for filtering releases in the nested state.
    # For example, `name=prometheus` in this context is equivalent to processing the nested state like
    #   helmfile -f path/to/subhelmfile.yaml -l name=prometheus sync
    selectors:
      - name=prometheus
    # Override state values
    values:
      # Values files merged into the nested state's values
      - additional.values.yaml
      # One important aspect of using values here is that they first need to be defined in the values section
      # of the origin helmfile, so in this example key1 needs to be in the values or environments.NAME.values of path/to/subhelmfile.yaml
      # Inline state values merged into the nested state's values
      - key1: val1
      # All the nested state files under `helmfiles:` is processed in the order of definition.
      # So it can be used for preparation for your main `releases`. An example would be creating CRDs required by `releases` in the parent state file.
      - path: path/to/mycrd.helmfile.yaml
      # Terraform-module-like URL for importing a remote directory and use a file in it as a nested-state file
      # The nested-state file is locally checked-out along with the remote directory containing it.
      # Therefore all the local paths in the file are resolved relative to the file
      - path: git::https://github.com/cloudposse/helmfiles.git@releases/kiam.yaml?ref=0.40.0

#
# Advanced Configuration: Environments
#

# The list of environments managed by helmfile.
#
# The default is `environments: {"default": {}}` which implies:
#
# - `{{.Environment.Name}}` evaluates to "default"
# - `{{.Values}}` being empty
environments:
  # The "default" environment is available and used when `helmfile` is run without `--environment NAME`.
  default:
    # Everything from the values.yaml is available via `{{.Values.KEY}}`.
    # Suppose `{"foo": {"bar": 1}}` contained in the values.yaml below,
    # `{{.Values.foo.bar}}` is evaluated to `1`.
    values:
      - environments/default/values.yaml
      # Each entry in values can be either a file path or inline values.
      # The below is an example of inline values, which is merged to the `.Values`
      - myChartVer: 1.0.0-dev
  # Any environment other than `default` is used only when `helmfile` is run with `--environment NAME`.
  # That is, the "production" env below is used when and only when it is run like `helmfile --environment production sync`.
  production:
    values:
      - environment/production/values.yaml
      - myChartVer: 1.0.0
      ## `secrets.yaml` is decrypted by `helm-secrets` and available via `{{.Environment.Secrets.KEY}}`
    secrets:
      - environment/production/secrets.yaml
    # Instructs helmfile to fail when unable to find a environment values file listed under `environments.NAME.values`.
    #
    # Possible values are  "Error", "Warn", "Info", "Debug". The default is "Error".
    #
    # Use "Warn", "Info", or "Debug" if you want helmfile to not fail when a values file is missing, while just leaving
    # a message about the missing file at the log-level.
    missingFileHandler: Error

#
# Advanced Configuration: Layering
#
# Helmfile merges all the "base" state files and this state file before processing.
#
# Assuming this state file is named `helmfile.yaml`, all the files are merged in the order of:
#   environments.yaml <- defaults.yaml <- templates.yaml <- helmfile.yaml
bases:
  - environments.yaml
  - defaults.yaml
  - templates.yaml