argocd-helm-migration

Audit both environments with diff to find drift, extract shared defaults into a base values.yaml, create values-stg.yaml and values-prod.yaml overlays containing only differences, and merge templates using conditionals for env-specific resources. Validate with helm lint and helm template for each environment.

ApplicationSets pass values files through the HELM_ARGS environment variable of the argocd-vault-plugin, for example -f values.yaml -f values-prod.yaml. Helm merges left to right, so the environment overlay listed last overrides the base values.

Base values.yaml holds shared defaults like image repository, resource limits, probes, and security contexts, with empty placeholders for env-specific fields. Overlays contain only what differs per environment, such as cluster.environment, aws.region, image tag, and vaultPath.

The chart defines a Secret with an avp.kubernetes.io/path annotation pointing to a Vault path from values, and uses stringData with lowercase_snake_case placeholder keys. AVP replaces the placeholder tokens with real Vault values at deploy time.

Keeping app.tag out of base values prevents accidentally deploying a wrong or default version to an environment. Each environment overlay sets its own tag explicitly, making version promotion deliberate and auditable.

The single-chart pattern fits when environments share the same resource structure and differ mainly in configuration values. If environments require fundamentally different architectures or template logic, maintaining separate charts may be clearer than heavy conditional branching.