Allow to use Secrets/ConfigMaps from storageNamespace in HelmRelease .spec.valuesFrom

[chilicat]

Hi Community,

I'm currently evaluating whether FluxCD can replace our custom deployment tools. We use mostly Helm.
We store Helm values as secrets in a separate "config" namespace. I was excited to see that HelmRelease offers to define the storageNamespace . I thought that fits well since I could set storageNamespace to our configuration namespace and then consume our Helm values from the existing Secrets with valuesFrom. Unfortunately, FluxCD HelmRelease searches for the values in the targetNamespace.

Is there a way to configure the HelmRelease to consume a Secret or ConfigMap from the targetNamespace?
Would it make sense to support it as a feature?

[stefanprodan]

You can place the HelmReleases in the config namespace, and you would set both the storageNamespace and targetNamespace to where the Helm release needs to be deployed, e.g. the apps namespace.

We are not going to allow Secrets to be referenced cross-namespaces, as this would break Kubernetes/Flux RBAC.

[chilicat]

thank you Stefan, that was helpful. Did not come into my mind that the value-sources are used from the namespace in which the HelmRelease is located.