从Helm图表中的deployment.yaml访问密封的秘密。

huangapple go评论71阅读模式
英文:

Access sealed secret from deployment.yaml in helm chart

问题

I'm trying to use a helm chart to deploy my secrets as sealed secret, I have created a template for the sealed secret

apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: {{ include "api.fullname" . }}
  namespace: api

spec:
  template:
    metadata: 
      name: {{ include "api.fullname" . }}
  encryptedData:
    {{- range $key, $val := .Values.encryptedData }}
    {{ $key }}: {{ $val }}
    {{- end }}

and in my deployment I'm setting the secret values as env variables

env:        
{{- range $key, $val := .Values.encryptedData }}
- name: {{ $key }}
  valueFrom:
    secretKeyRef:
      name: {{ include "sealedsecret.bitnami.com/api.fullname" $ }}
      key: {{ $key }}
{{- end }} 

The problem is when I install the chart the sealed secret file is in sealedsecret.bitnami.com/api

how can reference that in the include part of the secretKeyRef

The error I'm getting when installing the chart

Error: template: joe-api/templates/deployment.yaml:42:25: executing "api/templates/deployment.yaml" at <include "sealedsecret.bitnami.com/api.fullname" $>: error calling include: template: no template "sealedsecret.bitnami.com/api.fullname" associated with template "gotpl"

any help would be appreciated
英文:

I'm trying to use a helm chart to deploy my secrets as sealed secret, I have created a template for the sealed secret

apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: {{ include &quot;api.fullname&quot; . }}
  namespace: api
  
spec:
  template:
    metadata: 
      name: {{ include &quot;api.fullname&quot; . }}
  encryptedData:
    {{- range $key, $val := .Values.encryptedData }}
    {{ $key }}: {{ $val }}
    {{- end }}

and in my deployment I'm setting the secret values as env variables

env:        
{{- range $key, $val := .Values.encryptedData }}
- name: {{ $key }}
  valueFrom:
    secretKeyRef:
      name: {{ include &quot;sealedsecret.bitnami.com/api.fullname&quot; $ }}
      key: {{ $key }}
{{- end }} 

The problem is when I install the chart the sealed secret file is in sealedsecret.bitnami.com/api

how can reference that in the include part of the secretKeyRef

The error I'm getting when installing the chart

Error: template: joe-api/templates/deployment.yaml:42:25: executing &quot;api/templates/deployment.yaml&quot; at &lt;include &quot;sealedsecret.bitnami.com/api.fullname&quot; $&gt;: error calling include: template: no template &quot;sealedsecret.bitnami.com/api.fullname&quot; associated with template &quot;gotpl&quot;

any help would be appreciated

答案1

得分: 0

SealedSecret 在您的集群中创建与其名称相同的 Secret,请参阅 https://github.com/bitnami-labs/sealed-secrets#overview

您的 SealedSecret 名称来自图表 fullname 模板 - {{ include &quot;api.fullname&quot; . }},但在部署中,您包含了未定义的模板,名称为 sealedsecret.bitnami.com/api.fullname(如果需要,您可以在 templates/_helpers.tpl 文件中查看可用的模板)

因此,下面的片段应该有效:

env:
{{- range $key, $val := .Values.encryptedData }}
- name: {{ $key }}
  valueFrom:
    secretKeyRef:
      name: {{ include &quot;api.fullname&quot; $ }}
      key: {{ $key }}
{{- end }}
英文:

SealedSecret creates Secret in your cluster with the same name as itself, see https://github.com/bitnami-labs/sealed-secrets#overview

Your SealedSecret name comes from chart fullname template - {{ include &quot;api.fullname&quot; . }}, but in deployment you are including undefined template, named sealedsecret.bitnami.com/api.fullname (you can check available templates in templates/_helpers.tpl file if you want)

So the snippet below should work:

env:        
{{- range $key, $val := .Values.encryptedData }}
- name: {{ $key }}
  valueFrom:
    secretKeyRef:
      name: {{ include &quot;api.fullname&quot; $ }}
      key: {{ $key }}
{{- end }} 

huangapple
  • 本文由 发表于 2023年4月4日 17:43:45
  • 转载请务必保留本文链接:https://go.coder-hub.com/75927871.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定