hashicorp / vault-secrets-operator

The Vault Secrets Operator (VSO) allows Pods to consume Vault secrets natively from Kubernetes Secrets.

Home Page:https://hashicorp.com

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

VSO Secret Data Transformation with Helm

alexdga opened this issue · comments

I keep facing a problem with secret data transformation in Helm Charts.

For example :

spec:
  destination:
    create: true
    name: app-secret
    transformation:
      excludes:
       - .*
      templates:
        url:
          text: |
            {{- $host := get .Annotations "myapp.config/postgres-host" -}}
            {{- printf "postgresql://%s:%s@%s/postgres?sslmode=disable" (get .Secrets "username") (get .Secrets "password") $host -}}
  path: creds/dev-postgres

In the transformation text field, '{{-' forces helm rendering go template wich leads to errors.

I can't find any character escape or file loading tricks with helm to solve this problem.

Does anybody have a solution with helm for this ?

Another solution could be allowing implicit go template syntax for lines in transformation text field, so we could write the lines without specifying '{{-' and '-}}'.

Hi @alexdga, I think the solution you are looking for is here: #619 (comment) - Please let us know if you require any further assistance.