AKS与Key Vault集成Helm升级失败问题求助

问题概述 #

执行Helm升级命令时触发报错：

Error: UPGRADE FAILED: rendered manifests contain a resource that already exists. Unable to continue with update: SecretProviderClass "azure-keyvault-integration" in namespace "project1" exists and cannot be imported into the current release: invalid ownership metadata; label validation error: missing key "app.kubernetes.io/managed-by": must be set to "Helm"; annotation validation error: missing key "meta.helm.sh/release-name": must be set to "project1-dev"; annotation validation error: missing key "meta.helm.sh/release-namespace": must be set to "project1"

核心原因是集群中已存在的azure-keyvault-integration SecretProviderClass缺少Helm要求的所有权标签和注释，导致Helm无法将其纳入当前Release的管理范围。

相关配置 #

Helm升级脚本：

ENV=$1
NAMESPACE=$2
HELM_RELEASE=$3

output=$(helm upgrade --install \
  -f ./values/${ENV}/values.${ENV}.yaml \
  -f ./values/${ENV}/values.${ENV}.autoscaling.yml \
  -f secrets://values/${ENV}/secrets.${ENV}.enc.yaml \
  ${HELM_RELEASE} charts/project1 \
  --create-namespace --namespace ${NAMESPACE} \
  --dry-run --debug 2>&1)

当前SecretProviderClass模板：

{{- if .Values.keyvault.enabled }}
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: azure-keyvault-integration # needs to be unique per namespace
spec:
  provider: azure
  parameters:
    usePodIdentity: "false"
    userAssignedIdentityID: <userAssignedIdentityID>
    keyvaultName: <keyvaultName>
    useVMManagedIdentity: <useVMManagedIdentity>
    tenantId: <tenantId>
    subscriptionId: <subscriptionId>
    objects:  |
      array:
        - |
          objectName: OBJNAME1-VSC
          objectType: secret
          objectVersion: "4475eb5e1790e"
        - |
          objectName: OBJNAME2-VSC
          objectType: secret
          objectVersion: "d94449a99e9"

  secretObjects:
    - data:
      - key: API1_KEY
        objectName: OBJNAME1-VSC
      - key: API2_KEY
        objectName: OBJNAME2-VSC
      type: Opaque
      secretName: service1-secrets
{{- end}}

Service1的正确元数据参考：

labels:
  app.kubernetes.io/instance: project1-cloud-dev
  app.kubernetes.io/managed-by: Helm
  app.kubernetes.io/name: service1
  app.kubernetes.io/version: 1.16.0
  helm.sh/chart: service1-0.1.0
annotations:
  deployment.kubernetes.io/revision: '5'
  meta.helm.sh/release-name: project1-cloud-dev
  meta.helm.sh/release-namespace: project1-cloud

解决方案 #

1. 手动修复现有SecretProviderClass的元数据 #

直接给集群中已存在的资源补全缺少的标签和注释，执行以下命令：

# 添加Helm管理标签
kubectl label secretproviderclass azure-keyvault-integration app.kubernetes.io/managed-by=Helm -n project1

# 添加Release归属注释
kubectl annotate secretproviderclass azure-keyvault-integration meta.helm.sh/release-name=project1-dev meta.helm.sh/release-namespace=project1 -n project1

执行完成后重新运行Helm升级命令即可。

2. 修改Helm模板，自动生成正确元数据 #

为避免后续部署重复出现该问题，修改secret-provider-class.yaml的metadata部分，添加Helm自动注入的变量：

{{- if .Values.keyvault.enabled }}
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: azure-keyvault-integration # needs to be unique per namespace
  labels:
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/name: service1
    helm.sh/chart: service1-0.1.0 # 与Service1的chart版本保持一致
  annotations:
    meta.helm.sh/release-name: {{ .Release.Name }}
    meta.helm.sh/release-namespace: {{ .Release.Namespace }}
spec:
  # 原spec内容保持不变
{{- end}}

后续通过Helm部署时，会自动为SecretProviderClass添加上符合要求的所有权元数据。

3. 可选：删除现有资源让Helm重新创建 #

如果业务允许短暂中断，可直接删除现有资源，让Helm重新生成带正确元数据的实例：

kubectl delete secretproviderclass azure-keyvault-integration -n project1

删除后重新运行Helm升级命令即可。

注意事项 #

• 手动修复元数据后，后续对该资源的修改需通过Helm执行，避免元数据再次不一致。
• 使用Helm内置变量（如.Release.Name、.Release.Namespace）可保证不同环境下的元数据自动适配，无需手动调整。

内容的提问来源于stack exchange，提问作者user826323