I have yet to find a good solution that accomplishes both these goals. 1. Have a central location for our helm charts so that we have one copy of our charts with separate values for our various environments. 2. Have tight controls around who is allowed push what where (allow devs to push to the dev environment, allow team leads push to QA, etc.) Separately each goal is easy to accomplish, but if you want both, it see…
IIRC, Argo CD now allows to get your values.yaml from a different repo than the one you're using for the chart. So you create a very restricted repo for the charts, and then one repo por every environment that only (or mostly) contains a values.yaml.
You deploy then X applications or application sets, all pointing to the same chart, but pulling the values from different repos.