如何用Helm命名模板构建AWS负载均衡器证书ARN字符串

需求概述 #

需要为aws-load-balancer-controller的alb.ingress.kubernetes.io/certificate-arn注解生成逗号分隔的ACM证书ARN列表：

• 基础值为默认的ACM证书ARN
• 用户通过ingress.additional_certs配置额外证书时，将对应ARN追加到默认值后
• 同时要在ingress.spec.rules中枚举所有证书对应的域名

values.yaml配置规范 #

默认配置：

# values.yaml
ingress:
  default_cert_arn: "arn:aws:acm:us-west-2:xxxxxxxxxxx:certificate/357ac969-643b-4424-a028-57183e02a761"
  additional_certs: {}

用户覆盖示例：

ingress:
  additional_certs:
    - arn: "arn:aws:acm:us-west-2:xxxxxxxxxxx:certificate/357ac969-643b-4424-a028-57183e02a765"
      host: "somedomain.sub.com"
    - arn: "arn:aws:acm:us-west-2:xxxxxxxxxxx:certificate/357ac969-643b-4424-a028-57183e02a764"
      host: "someotherdomain.foo.com"

实现方案 #

方案1：无需命名模板，直接用Helm内置函数拼接 #

利用Helm内置函数一行完成字符串拼接，简洁高效：

# 在ingress模板的annotations段中使用
annotations:
  alb.ingress.kubernetes.io/certificate-arn: >-
    {{ list .Values.ingress.default_cert_arn | concat (.Values.ingress.additional_certs | default list | pluck "arn") | join "," }}

• default list确保additional_certs为默认{}时转为空列表，避免报错
• pluck "arn"从额外证书列表中提取所有ARN值
• concat合并默认ARN与额外ARN列表
• join ","将合并后的列表转为逗号分隔字符串

方案2：用命名模板封装逻辑（适用于复杂场景） #

如果需要复用拼接逻辑或后续扩展规则，可在_templates/helpers.tpl中定义模板：

{{/* 生成证书ARN的逗号分隔字符串 */}}
{{- define "my-chart.certificate-arns" -}}
{{- $defaultArn := .Values.ingress.default_cert_arn -}}
{{- $additionalArns := .Values.ingress.additional_certs | default list | pluck "arn" -}}
{{- if $additionalArns -}}
{{- printf "%s,%s" $defaultArn (join "," $additionalArns) -}}
{{- else -}}
{{- $defaultArn -}}
{{- end -}}
{{- end -}}

在ingress模板中引用：

annotations:
  alb.ingress.kubernetes.io/certificate-arn: {{ include "my-chart.certificate-arns" . }}

补充：ingress.spec.rules的域名枚举 #

遍历additional_certs中的host字段，追加到规则列表：

spec:
  rules:
    # 默认域名规则
    - host: {{ .Values.ingress.default_host }}
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: {{ include "my-chart.serviceName" . }}
                port:
                  number: 80
    # 追加额外域名规则
    {{- range .Values.ingress.additional_certs | default list }}
    - host: {{ .host }}
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: {{ include "my-chart.serviceName" $ }}
                port:
                  number: 80
    {{- end }}

• range中用$引用根上下文，确保全局模板调用正确

内容的提问来源于stack exchange，提问作者GenuineNoam