如何让Terraform适配含Helm Secrets加密内容的Helm包部署

我们现有一套基于GitHub Actions的Helm仓库CI/CD流程，以及Terraform部署流程，运行正常。现在引入了基于sops的Helm Secrets加密凭证内容，本地部署正常，但需要调整Terraform的helm_release配置以适配该加密场景。

现有CI/CD流程 #

Helm仓库CI/CD Workflow #

name: STAGING-ci-helm
permissions:
  contents: read
  id-token: write
on:
  push:
    branches:
      - staging
  pull_request:
env:
  CHART_NAME: aaaa
  IMAGE_TAG: 0.0.1
jobs:
  job:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: helm lint
        run: |
          helm lint -f aaaa/values-staging.yaml ./aaaa
      - uses: google-github-actions/auth@v0
        with:
          workload_identity_provider: '${{ secrets.WI_POOL_PROVIDER_ID }}'
          service_account: '${{ secrets.PACKAGER_GSA_ID }}'
          token_format: 'access_token'
      - uses: google-github-actions/setup-gcloud@v0
        with:
          version: latest
      - name: login to artifact registry
        run: |
          gcloud auth configure-docker ${{ secrets.ARTIFACT_REGISTRY_HOST_NAME }} --quiet
      - name: helm package
        run: |
          helm package ./aaaa --version $IMAGE_TAG --app-version $IMAGE_TAG
      - name: helm push
        if: ${{ github.event_name == 'push' }}
        run: |
          helm push aaaa-$IMAGE_TAG.tgz oci://${{ secrets.ARTIFACT_REGISTRY_HOST_NAME }}/${{ secrets.PROJECT_ID }}/${{ secrets.ARTIFACT_REGISTRY_REPOSITORY }}

Terraform部署Workflow #

name: "Terraform Staging Apply"

on:
  push:
    branches:
      - staging
  pull_request:
    types:
        - closed
    branches:
      - staging

jobs:
  terraform:
    name: "Terraform Apply"
    runs-on: ubuntu-latest
    permissions: write-all
    env:
      AWS_ACCESS_KEY_ID: ${{ secrets.STAGING_AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.STAGING_AWS_SECRET_ACCESS_KEY }}
    defaults:
      run:
        working-directory: ./ci
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v1
        with:
          cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

      - name: Terraform Init
        id: init
        run: terraform init

      - name: Terraform Apply
        if: github.ref == 'refs/heads/staging' && github.event_name == 'push'
        run: terraform apply -auto-approve -input=false -refresh=false

Terraform helm_release资源配置 #

resource "helm_release" "aaaa" {
  count = var.install_aaaa_helm_release ? 1 : 0

  # Chart information.
  repository = var.aaaa_repository
  version    = var.aaaa_version
  chart      = "aaaa"

  name              = "aaaa"
  namespace         = var.k8s_namespace
  create_namespace  = !local.is_namespace_default
  dependency_update = true
  force_update      = false
  lint              = true
  recreate_pods     = false
  wait              = false

  values = [
    local_file.helm_values.content
  ]
}

新增Helm Secrets加密配置 #

我们使用Helm Secrets（基于sops）加密了凭证类内容，加密后的values示例：

dockerconfigjson: ENC[AES256_GCM,data:hNWO6G/lMGT0Swkf11kpQjW/VCs40KHWpLgha13cxQ==,iv:vIkA4FXh1iYBYVoH5Xtyp2SNo5XzPatiVlAxnfhcpSA=,tag:rNXGgovTC+VdkpwOkfUrjQ==,type:str]
sops:
    kms:
        - arn: arn:aws:kms:ca-central-1:8888888888:key/0555555-abcd-4444-5555-xxxxxxxx
          created_at: "2023-10-12T18:17:08Z"
          enc: AQICAHhlPQ/aFcm7KLIoh1yCQAUgRDt67BhGjRw1f/mkc8yXaQFqweLYkq2dRj9BAgEQgDvYaldhb3vQrH5T4vOvdl6t4p+PHRFYCSo55YiEFWNeYTT1S3d1ufVeBvK9RLlq268FDDLul+FxA1pXfQ==
          aws_profile: ""
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age: []
    lastmodified: "2023-10-12T20:35:14Z"
    mac: ENC[AES256_GCM,data:lOcdqVQOxTJvYN9dhPLncIOlSDan8RZ2M4zcyoMZqAmO8bWLzlOiiezKGofC9s9+/sRVXONr4l8HcWo9pYGMfn3DM3YA9zE=,iv:Ht9i1ou+xJ0le2QqlNllKUPgMC3utKkKHPE2jibugrM=,tag:cz1R7TDbM39vMwuqsMFTuQ==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.8.0

Helm模板中引用该加密字段的方式：

apiVersion: v1
kind: Secret
metadata:
  name: dockercredential
  namespace: {{ .Release.Namespace | quote }}
data:
    .dockerconfigjson: {{ .Values.dockerconfigjson }}
type: kubernetes.io/dockerconfigjson

待解决问题 #

本地执行helm secrets install可正常部署，但现有CI流程中Helm包是通过helm package直接打包的，不清楚如何修改Terraform的helm_release资源配置，使其适配包含加密内容的Helm包并成功部署。

内容的提问来源于stack exchange，提问作者Joe