fix

environment-provisioner/workflow-template.yaml

@@ -342,35 +342,40 @@ spec:
                 done
               fi
 
-              # Initialize INLINE_VALUES with ingress annotations
-              # Dotted annotation keys (like nginx.ingress.kubernetes.io/ssl-redirect) must use
-              # the values block, not parameters. Helm's --set interprets dots as nested paths.
-              INLINE_VALUES="
-              values: |
-                ingress:
-                  annotations:
-                    nginx.ingress.kubernetes.io/force-ssl-redirect: \"true\"
-                    nginx.ingress.kubernetes.io/ssl-redirect: \"true\"
-                    cert-manager.io/cluster-issuer: letsencrypt-prod"
-
-              # Check for edited values content - merge with base annotations
+              # Check for edited values content and create separate values files
+              # Using separate files avoids YAML indentation issues with inline values blocks
               EDITED_CONTENT=$(echo "$VALUES_CONTENT_EDITS" | jq -r ".\"$service\" // empty")
+              EXTRA_VALUES_FILES=""
+
               if [ -n "$EDITED_CONTENT" ] && [ "$EDITED_CONTENT" != "null" ]; then
                 echo "  Writing edited values content to override file..."
-                # Write the edited content to a values override file
                 VALUES_OVERRIDE_FILE="values-override-${SANITIZED_SERVICE}.yaml"
-                echo "$EDITED_CONTENT" > "manifests/$VALUES_OVERRIDE_FILE"
+
+                # Write ingress annotations + user edits to a single file
+                cat > "manifests/$VALUES_OVERRIDE_FILE" <<OVERRIDE_EOF
+        ingress:
+          annotations:
+            nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+            nginx.ingress.kubernetes.io/ssl-redirect: "true"
+            cert-manager.io/cluster-issuer: letsencrypt-prod
+        $EDITED_CONTENT
+        OVERRIDE_EOF
+
                 echo "  Created: manifests/$VALUES_OVERRIDE_FILE"
-                # Set inline values for ArgoCD - merge user edits with base ingress annotations
-                INDENTED_CONTENT=$(echo "$EDITED_CONTENT" | sed 's/^/                /')
-                INLINE_VALUES="
-              values: |
-                ingress:
-                  annotations:
-                    nginx.ingress.kubernetes.io/force-ssl-redirect: \"true\"
-                    nginx.ingress.kubernetes.io/ssl-redirect: \"true\"
-                    cert-manager.io/cluster-issuer: letsencrypt-prod
-        $INDENTED_CONTENT"
+                EXTRA_VALUES_FILES="
+                - $VALUES_OVERRIDE_FILE"
+              else
+                # No user edits - still need ingress annotations in a separate file
+                INGRESS_FILE="ingress-annotations-${SANITIZED_SERVICE}.yaml"
+                cat > "manifests/$INGRESS_FILE" <<INGRESS_EOF
+        ingress:
+          annotations:
+            nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+            nginx.ingress.kubernetes.io/ssl-redirect: "true"
+            cert-manager.io/cluster-issuer: letsencrypt-prod
+        INGRESS_EOF
+                EXTRA_VALUES_FILES="
+                - $INGRESS_FILE"
               fi
 
               # Process external params for disabled Helm dependencies (e.g., external database config)
@@ -413,7 +418,7 @@ spec:
             path: $HELM_PATH
             helm:
               valueFiles:
-                - $HELM_VALUES$INLINE_VALUES
+                - $HELM_VALUES$EXTRA_VALUES_FILES
               parameters:
                 - name: mysql.enabled
                   value: "$MYSQL_ENABLED"