argocd-cm.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
data:
  configManagementPlugins: |
    - name: argocd-vault-plugin
      generate:
        command: ["argocd-vault-plugin"]
        args: ["generate", "./"]

    - name: argocd-vault-plugin-helm
      generate:
        command: ["sh", "-c"]
        args: ['helm template "$ARGOCD_APP_NAME" -n "$ARGOCD_APP_NAMESPACE" . | argocd-vault-plugin generate -']

    # This lets you pass args to the Helm invocation as described here: https://argocd-vault-plugin.readthedocs.io/en/stable/usage/#with-helm
    # IMPORTANT: passing $helm_args effectively allows users to run arbitrary code in the Argo CD repo-server.
    # Only use this when the users are completely trusted. If possible, determine which Helm arguments are needed by 
    # your users and explicitly pass only those arguments.
    - name: argocd-vault-plugin-helm-with-args
      generate:
        command: ["sh", "-c"]
        args: ['helm template "$ARGOCD_APP_NAME" -n "$ARGOCD_APP_NAMESPACE" ${helm_args} . | argocd-vault-plugin generate -']

    # This lets you pass a values file as a string as described here:
    # https://argocd-vault-plugin.readthedocs.io/en/stable/usage/#with-helm
    - name: argocd-vault-plugin-helm-with-values
      generate:
        command: ["bash", "-c"]
        args: ['helm template "$ARGOCD_APP_NAME" -n "$ARGOCD_APP_NAMESPACE" -f <(echo "$ARGOCD_ENV_HELM_VALUES") . | argocd-vault-plugin generate -']

    - name: argocd-vault-plugin-kustomize
      generate:
        command: ["sh", "-c"]
        args: ["kustomize build . | argocd-vault-plugin generate -"]