Ability to watch final values after merging ConfigMaps and Inline values

[dan0sh]

Currently, when using the Flux Helm Controller, the final applied configuration (after merging ConfigMaps and inline values) is not easily observable. This makes it difficult to troubleshoot or verify the final state of the configuration that is passed to Helm releases.

I would like the Flux Helm Controller to provide a feature that allows us to observe or output the final ConfigMap that is applied to the Helm release. This would include the merged result of all ConfigMaps and inline values defined in the Helm release values.

I propose enhancing the HelmRelease Custom Resource Definition (CRD) to include the final merged ConfigMap in the status section. This would represent the merged result of all ConfigMaps and inline values defined in the Helm release.

This would greatly help with debugging and visibility into the actual configurations being applied by Helm, especially in complex deployments where multiple ConfigMaps and inline values are used.

[stefanprodan]

Values contain secrets, having those in the HR status would result in a CVE, while Kubernetes secrets are encrypted at rest in etcd, custom resources aren’t.

I plan to develop a command in the Flux CLI that will display the final values in stdout.

[PadreSVK]

Values contain secrets, having those in the HR status would result in a CVE, while Kubernetes secrets are encrypted at rest in etcd, custom resources aren’t.

I plan to develop a command in the Flux CLI that will display the final values in stdout.

@stefanprodan is there any possibility to have result values configmap similar to xyz-values config map?

[artem-nefedov]

Since flux helm-controller installs helm releases in a same way as helm does, you can use regular helm get values command to see merged user-provided values of an installed release.

Or you can read it directly from the Secret that stores this data, for example:

kubectl get secret -n kube-system sh.helm.release.v1.metrics-server.v1 -o jsonpath='{.data.release}' | base64 --decode | base64 --decode | gzip -d | jq .config

[stefanprodan]

Since Flux 2.7 we have a dedicated CLI command to view the final values composed from ConfigMaps/Secrets and in-line values: flux debug hr [name] --show-values