使用Vault ConfigMap注入器时Helm模板报错：secret函数未定义

测试基于Vault注入器的ConfigMap时出现解析错误，报错信息显示app-chart/templates/vault-configmap.yaml第29行的函数secret未定义。

报错日志 #

install.go:214: [debug] Original chart version: ""
install.go:231: [debug] CHART PATH: D:\code\app-chart

Error: parse error at (app-chart/templates/vault-configmap.yaml:29): function "secret" not defined
helm.go:84: [debug] parse error at (app-chart/templates/vault-configmap.yaml:29): function "secret" not defined

ConfigMap配置 #

apiVersion: v1
kind: ConfigMap
metadata:
  name: my-configmap
data:
  config.hcl: |-
    "auto_auth" = {
      "method" = {
        "config" = {
          "role" = "approle"
        }
        "type" = "approle"
      }

      "sink" = {
        "config" = {
          "path" = "/home/vault/.token"
        }

        "type" = "file"
      }
    }

    "exit_after_auth" = false
    "pid_file" = "/home/vault/.pid"

    "template" = {
      "contents" = |
        {{- with secret "app-secrets/app-chart" -}}DB_PASSWORD: {{ .Data.DB_PASSWORD }}{{- end }}
      "destination" = "/vault/secrets/db-creds"
    }

    "vault" = {
      "address" = "https://vault-test.com"
      "tls_skip_verify" = true
    }
  config-init.hcl: |
    "auto_auth" = {
      "method" = {
        "config" = {
          "role" = "approle"
        }
        "type" = "approle"
      }

      "sink" = {
        "config" = {
          "path" = "/home/vault/.token"
        }

        "type" = "file"
      }
    }

    "exit_after_auth" = true
    "pid_file" = "/home/vault/.pid"

    "template" = {
      "contents" = |
        {{- with secret "app-secrets/app-chart" -}}DB_PASSWORD: {{ .Data.DB_PASSWORD }}{{- end }}
      "destination" = "/vault/secrets/db-creds"
    }

    "vault" = {
      "address" = "https://vault-test.com"
      "tls_skip_verify" = true
    }

Helm Chart目录结构 #

app-chart> tree ./ /F
Listado de rutas de carpetas para el volumen Datos
El número de serie del volumen es 0000008F 306D:61EC
D:\CODE\APP-CHART
│   .helmignore
│   Chart.yaml
│   values.yaml
│
└───templates
    │   deployment.yaml
    │   hpa.yaml
    │   ingress.yaml
    │   NOTES.txt
    │   service.yaml
    │   serviceaccount.yaml
    │   vault-configmap.yaml
    │   _helpers.tpl
    │
    └───tests
            test-connection.yaml

怀疑需要对Vault ConfigMap中的模板进行转义，求正确解决方法。

问题根源是Helm会尝试解析ConfigMap中的{{ ... }}模板语法，但secret是Vault Agent模板的专属函数，并非Helm模板函数，因此Helm解析时会报错。需要让Helm忽略这部分内容，不对其进行解析，以下是两种实用解决方法：

方法1：使用Helm的raw模板函数 #

将Vault模板部分用{{ raw }}和{{ endraw }}包裹，Helm会直接输出中间内容，不解析其中的模板语法：

"contents" = |
  {{- raw -}}
  {{- with secret "app-secrets/app-chart" -}}DB_PASSWORD: {{ .Data.DB_PASSWORD }}{{- end }}
  {{- endraw -}}

方法2：转义模板标签 #

把Vault模板中的{{替换为Helm转义写法{{ "{{" }}，}}替换为{{ "}}" }}，同时转义内部的双引号避免YAML语法冲突：

"contents" = |
  {{- "{{ with secret \"app-secrets/app-chart\" }}" -}}DB_PASSWORD: {{ "{{ .Data.DB_PASSWORD }}" }}{{- "{{ end }}" -}}

验证方式 #

修改后执行helm template .命令，查看渲染后的ConfigMap内容，确认Vault的模板标签{{- with secret ... -}}被完整保留，未被Helm解析。

内容的提问来源于stack exchange，提问作者Andres Cabrera