Centralize image tags and chart version of HelmRelease in kustomization

[rileyai-dev]

I would like to centralize versions (chart and image) in one Kustomization file to be able to compare my different environments. The problem is that patches don't seem to be supported by image update automation. I have tried different scenarios.

Here is my HelmRelease:

apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: linker
  namespace: my-apps
spec:
  releaseName: linker
  interval: 5m
  chart:
    spec:
      chart: linker
      version: '0.0.1'
      sourceRef:
        kind: HelmRepository
        name: my-charts
        namespace: my-apps
      interval: 1m
  values:
    replicaCount: 1
    image:
      tag: 1.0.0 # {"$imagepolicy": "flux-system:linker:tag"}
---
apiVersion: image.toolkit.fluxcd.io/v1beta1
kind: ImagePolicy
metadata:
  name: linker
  namespace: flux-system
spec:
  imageRepositoryRef:
    name: linker
  policy:
    semver:
      range: '>=1.0.0'

And my Kustomization file:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - linker.yaml

If I try to remove the chart version and image tag from the HelmRelease, I get the following kustomization:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - linker.yaml
patches:
  - target:
      name: linker
      kind: HelmRelease
    patch: |-
      - op: add
        path: /spec/values/image
        value:
          tag: 1.0.0 # {"$imagepolicy": "flux-system:linker:tag"}
      - op: add
        path: /spec/chart/spec
        value:
          version: 0.0.1

But this won't work since the patch is a string block.

I was not able to use the recommended method since I don't use an image repository but use a chart with a sourceRef (would appreciate to have a solution for that). There is also another caveat, it doesn't allow to change the chart version.

I've tried the following but it doesn't work either (and it's also without the chart version):

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - linker.yaml
images:
- name: linker
  newTag: 1.0.0 # {"$imagepolicy": "flux-system:linker:tag"}

I've also tried to put the full name of the image: 1122334455.dkr.ecr.us-east-2.amazonaws.com/linker without success.

I have two questions:

• Is there a way to use Kustomization images with HelmRelease and sourceRef (instead of repository)?
• Is there a clean way to centralize the chart and the image versions in one Kustomization file that is supported by the image update automation?

[cer]

I have a similar question. I wanted to configure the following:

• apps/base/ServiceHelmRelease.yaml
• apps/dev/kustomization.yaml that uses $imagepolicy to patch the HelmRelease's version.
• apps/prod/kustomization.yaml - updated via Github Action based promotion

In my example, I had a JSON6902 patch in Yaml format but the $imagepolicy was ignored:

In the kustomization.yaml:

  - path: patch-api-gateway.yaml
    target: 
      kind: HelmRelease
      name: api-gateway-service

patch-api-gateway.yaml:

- op: replace
  path: /spec/chart/spec/version
  value: "0.1.0-BUILD.20230510000916" # {"$imagepolicy": "default:api-gateway-service-image-policy:tag"}
- op: add
  path: /spec/values
  value: 
    replicaCount: 3

[stefanprodan]

Flux can update YAMLs which implement Kubernetes object interface, this means apiVersion and kind are required. To make this work, instead of JSON use a YAML patch, example here: https://github.com/fluxcd/flux2-kustomize-helm-example/blob/main/apps/production/podinfo-values.yaml

[janjaali]

Having a similar issue and tried out the workaround with the Kubernetes object interface:

  images:
    - name: app
      newTag: app-tag # {"$imagepolicy": "namespace:app:tag"}
  patches:
    - target:
        kind: Deployment
        name: app
      patch: |-
        apiVersion: apps/v1
        kind: Deployment
        metadata:
          name: app
        spec:
          template:
            metadata:
              labels:
                tags.datadoghq.com/version: app-tag # {"$imagepolicy": "namespace:app:tag"}

While the first image update works the one in the patch is not updated. How can I overcome this?

[cep21]

@janjaali did you ever find a workaround?

[janjaali]

Oh that's long ago but if I recall correctly the workaround for me was to use postBuild:

  images:
    - name: app
      newTag: app-tag # {"$imagepolicy": "namespace:app:tag"}
  postBuild:
    substitute:
      newTag: app-tag # {"$imagepolicy": "namespace:app:tag"}
  patches:
    - target:
        kind: Deployment
        name: app
      patch: |-
        apiVersion: apps/v1
        kind: Deployment
        metadata:
          name: app
        spec:
          template:
            metadata:
              labels:
                tags.datadoghq.com/version: ${newTag}

I hope that answer was some sort of supportive.

[cep21]

That worked! The only change was to escape your newTag with double $$. I did something like

                tags.datadoghq.com/version: $${newTag}

[cer]

Two things:

1. It would be good if the docs explicitly stated that "Flux can ONLY update YAMLs which implement Kubernetes object interface, this means apiVersion and kind are required"
2. I'd originally used patchesStrategicMerge since it's deprecated I'd switched to patch.

[stefanprodan]

For 1. can you please open a PR in the docs website? Thanks

For 2., patch supports both, just replace the JSON with a YAML stub and it will work.

[stefanprodan]

@cer please see fluxcd/flux2-kustomize-helm-example#96