Helm values
Every value of the syncotta Helm chart.
Alpha. Tested end to end on Argo CD 3 with a Jira Cloud development site. Details may change before 1.0.
Values of the syncotta chart (cluster/helm/syncotta/values.yaml). The chart has two parts, switched by
notifications.enabled (default on) and gate.enabled (default off):
- Notifications: install once per Argo CD instance. See Getting started, step 2.
- Gate: turn on in each gated application, as a dependency of the application’s chart. See
Change gating. In that case set
notifications.enabled: falseand put all values undersyncotta:.
The chart rejects unknown values. Plain helm lint without values fails on purpose, because instanceId is required.
General
| Value | Default | Meaning |
|---|---|---|
instanceId |
"" (required) |
Instance id from the admin page. 3 to 40 characters: lower-case letters, digits and inner hyphens. |
eventsUrl |
"" (required for notifications) |
Events URL from the admin page. The base URL or the one ending in /events both work; the chart adds /events itself. Must not contain a query string or fragment. |
argocdUrl |
"" |
Base URL of your Argo CD UI, used for the links to Argo CD in Jira, for example https://argocd.example.com. Required in configMap mode. In argocdValues mode, leave it empty to keep the argo-cd chart’s own notifications.argocdUrl. |
Notifications (notifications.*)
| Value | Default | Meaning |
|---|---|---|
notifications.enabled |
true |
Render the Argo CD Notifications config. Set to false when the chart is a dependency used only for the gate. |
notifications.mode |
argocdValues |
How the config reaches Argo CD. argocdValues: render a values file for the official argo-cd Helm chart into the ConfigMap <release>-argocd-values; nothing of Argo CD is touched. configMap: render argocd-notifications-cm (and argocd-notifications-secret) directly; this replaces other notification config in that ConfigMap, so move it to extraConfig. An existing Argo CD install needs helm install --take-ownership. |
notifications.argocdNamespace |
argocd |
Namespace Argo CD runs in (configMap mode). |
notifications.tokenKey |
syncotta-token |
Key in argocd-notifications-secret that holds the notifications token from the admin page. |
notifications.secret.create |
true |
configMap mode: also render argocd-notifications-secret with the token. With false you manage that Secret yourself and must put the token under tokenKey. |
notifications.secret.token |
"" |
The notifications token (syn_ followed by 43 characters). Pass it with --set-string, never commit it. |
notifications.subscriptions.defaultSelector |
syncotta.com/payload=default |
Label selector of Applications that are reported without the commit message. Works for single-source and multi-source apps. |
notifications.subscriptions.singleSourceSelector |
syncotta.com/payload=single-source |
Label selector of single-source Applications whose deployed event also carries the commit message (issue keys are read from it). Empty disables this subscription. |
notifications.extraConfig |
{} |
configMap mode: other keys for argocd-notifications-cm (your own services, templates, triggers). Keys starting with service.webhook.syncotta, template.syncotta- or trigger.syncotta- are reserved. |
notifications.keepOnUninstall |
true |
configMap mode: helm uninstall keeps argocd-notifications-cm and -secret (helm.sh/resource-policy: keep), so Argo CD’s notifications config is never deleted with Syncotta. false lets Helm delete both. |
An Application must match at most one of the two selectors (the chart refuses identical selectors). Multi-source Applications must use the default selector.
Gate (gate.*)
The gate Job asks Syncotta before every full sync whether the change is approved. Values marked “from Argo CD” are passed as Helm parameters of the Application, see Change gating.
| Value | Default | Meaning |
|---|---|---|
gate.enabled |
false |
Render the PreSync gate Job and, without existingSecret, its Secret. |
gate.appName |
"" |
Argo CD Application name. Required. From Argo CD: $ARGOCD_APP_NAME. |
gate.appNamespace |
argocd |
Namespace of the Application object itself. Do not pass $ARGOCD_APP_NAMESPACE: Argo CD sets that to the destination namespace. Set it by hand when Applications live outside argocd. |
gate.project |
"" |
Argo CD project. From Argo CD: $ARGOCD_APP_PROJECT_NAME. |
gate.revision |
"" |
Revision being synced. Required: the gate approves one revision at a time. From Argo CD: $ARGOCD_APP_REVISION. |
gate.destination.server |
https://kubernetes.default.svc |
Destination cluster of the Application, so the gate maps the same Jira environment as the deployments. Set it when the app deploys to another cluster. |
gate.destination.namespace |
"" (release namespace) |
Destination namespace. Empty means the namespace of the Helm release. |
gate.environmentId |
"" |
Optional. Environment id, like the syncotta.com/environment-id annotation. |
gate.environmentType |
"" |
Optional. Environment type, like the syncotta.com/environment-type annotation. |
gate.issueKeys |
[] |
Optional issue keys sent with the gate request. |
gate.services |
[] |
Optional service ids or keys sent with the gate request. |
gate.existingSecret |
"" |
Name of a Secret with the keys gate-url (PreSync gate URL from the admin page) and hmac-key, in the application namespace. Recommended: create it yourself (sealed secrets, external secrets). |
gate.url |
"" |
Without existingSecret: the gate URL (https). The chart renders the Secret from it. It ends up in the Application spec, so keep it out of Git. |
gate.hmacKey |
"" |
Without existingSecret: the HMAC key (64 hex characters). Same warning as gate.url. |
gate.deadlineSeconds |
1800 |
How long a sync may wait for approval. Keep it below Argo CD’s controller.sync.timeout.seconds when you set that. |
gate.pollMinSeconds |
15 |
Start of the wait between gate calls. Must not exceed pollMaxSeconds. |
gate.pollMaxSeconds |
30 |
Upper bound of the wait between gate calls. |
gate.image.repository |
ghcr.io/syncotta/gate-client |
Gate client image (linux/amd64 and arm64), published with each chart release. |
gate.image.tag |
"" |
Image tag. Empty means the chart appVersion. |
gate.image.digest |
"" |
Image digest. When set it is used instead of the tag. |
gate.image.pullPolicy |
IfNotPresent |
Image pull policy. |
gate.resources |
requests cpu: 10m, memory: 16Mi; limits memory: 64Mi |
Resources of the gate container. |
With gate.enabled, either gate.existingSecret or both gate.url and gate.hmacKey must be set, and appName and
revision are required. The chart fails at render time otherwise.
What the gate Job is
- A PreSync hook, replaced on every sync (
BeforeHookCreation), withbackoffLimit: 0(Argo CD’s sync retry starts a new Job). - Runs as non-root user 65534 with a read-only root filesystem and no service account token.
- Reads the URL and key from the mounted Secret (
fsGroup: 65534, file mode0440) and never prints them.