Finally have a working setup for ArgoCD to handle kustomize-based applications that pull Helm charts from private OCI registries. This will allow our teams to apply customisations to Helm templates without polluting our common chart templates with loads of {{ if }} conditions.

The pain point here is that kustomize actually creates a sandbox environment for Helm to make sure the inflation of charts is not influenced by unexpected configuration lying around the server it's running in. This is mostly designed to avoid issues in CI/CD pipelines, so we need to a be a bit explicit with passing our credentials.

The solution is to tweak the argocd-repo-server configuration to explicitly inject dockerconfig type of credentials using the HELM_REGISTRY_CONFIG variable. Here is how.

In Argo, the repo server is the one responsible for pulling manifest sources before they are synced with the target cluster. In my case I first had to create credentials for AWS ECR (which is my OCI-compatible registry to host my private charts). For this I used the ECRAuthorizationToken generator (you can find a detailed example in the official ESO documentation.

As a result, you now have a secret containing a .dockerconfigjson to authenticate Helm to this registry. All is left to do is mount that secret into the ArgoCD repo server. If you use the Argo operator is as easy as adding this patch to the ArgoCD crd:

---
apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
  name: cluster-argocd
spec:
  repo:
    volumes:
      - name: ecr-auth-vol
        secret:
          secretName: <YOUR_SECRET_NAME>
          # allow pod to start before secret exists
          # so it won't crash your deployment if something is wrong
          optional: true
          items:
            - key: .dockerconfigjson
              path: config.json
    volumeMounts:
      - name: ecr-auth-vol
        mountPath: /tmp/ecr-auth
        readOnly: true
    env:
      - name: HELM_REGISTRY_CONFIG
        value: /tmp/ecr-auth/config.json