Helm Chart模板lookup函数失效问题排查求助

尝试通过Helm的lookup函数读取K8s Secret数据时触发空指针错误，相关信息如下：

目标Secret配置 #

apiVersion: v1
data:
  adminPassword: VG9wU2VjcmV0UGFzc3dvcmQxIQ==
  adminUser: YWRtaW4=
kind: Secret
metadata:
  annotations:
    sealedsecrets.bitnami.com/cluster-wide: "true"
  name: activemq-artemis-broker-secret
  namespace: common
type: Opaque

Helm模板代码 #

apiVersion: broker.amq.io/v1beta1
kind: ActiveMQArtemis
metadata:
  name: {{ .Values.labels.app }}
  namespace: common
spec:
  {{ $secret := lookup "v1" "Secret" .Release.Namespace "activemq-artemis-broker-secret" }}
  adminUser: {{ $secret.data.adminUser }}
  adminPassword: {{ $secret.data.adminPassword }}

部署错误信息 #

failed exit status 1: Error: template: broker/templates/deployment.yaml:7:23:
executing "broker/templates/deployment.yaml" at <$secret.data.adminUser>:
nil pointer evaluating interface {}.adminUser Use --debug flag to render out invalid YAML

验证信息 #

通过kubectl可正常获取该Secret：

kubectl get secret activemq-artemis-broker-secret -n common -o json

返回结果：

{
    "apiVersion": "v1",
    "data": {
        "adminPassword": "VG9wU2VjcmV0UGFzc3dvcmQxIQ==",
        "adminUser": "YWRtaW4="
    },
    "kind": "Secret",
    "metadata": {
        "annotations": {
            "sealedsecrets.bitnami.com/cluster-wide": "true"
        },
        "creationTimestamp": "2022-10-10T14:40:49Z",
        "name": "activemq-artemis-broker-secret",
        "namespace": "common",
        "ownerReferences": [
            {
                "apiVersion": "bitnami.com/v1alpha1",
                "controller": true,
                "kind": "SealedSecret",
                "name": "activemq-artemis-broker-secret",
                "uid": "edff38fb-a966-47a6-a706-cb197ac1797d"
            }
        ],
        "resourceVersion": "127303988",
        "uid": "0679fc5c-7465-4fe1-9197-b483073e93c2"
    },
    "type": "Opaque"
}

当前环境：Helm 3.8.1，Go 1.17（注：原描述中1.75应为笔误）

核心原因：ArgoCD默认渲染模式不支持lookup函数 #

ArgoCD默认使用helm template在本地渲染模板，该过程不会连接K8s API服务器，因此lookup函数无法获取任何资源，返回nil，访问$secret.data.adminUser时触发空指针错误。

解决方案 #

1. 切换到ArgoCD Server-Side渲染模式

在ArgoCD Application配置中启用Server-Side渲染（使用helm install/upgrade而非helm template），让Helm在集群内执行，可正常调用K8s API完成lookup。

修改ArgoCD Application的spec部分：

spec:
  source:
    helm:
      skipCrds: false
    repoURL: <你的Helm仓库地址>
    targetRevision: <版本号>
    chart: <Chart名称>
  destination:
    server: https://kubernetes.default.svc
    namespace: common
  syncPolicy:
    syncOptions:
      - ServerSideApply=true

也可在ArgoCD UI中找到对应Application，进入「App Details」→「Edit」，在Helm设置中开启Server-Side渲染。

2. 避免使用lookup，改用Secret直接引用

如果无法切换渲染模式，可让ActiveMQArtemis资源直接引用Secret，而非在模板中读取：

# 修改后的Helm模板
apiVersion: broker.amq.io/v1beta1
kind: ActiveMQArtemis
metadata:
  name: {{ .Values.labels.app }}
  namespace: common
spec:
  adminUserSecret:
    name: activemq-artemis-broker-secret
    key: adminUser
  adminPasswordSecret:
    name: activemq-artemis-broker-secret
    key: adminPassword

（注：具体字段名需参考ActiveMQArtemis CRD定义，确保支持Secret引用方式）

3. 验证Release.Namespace正确性

确认.Release.Namespace的值确实为common，也可直接硬编码namespace到lookup函数中避免变量错误：

{{ $secret := lookup "v1" "Secret" "common" "activemq-artemis-broker-secret" }}

4. 检查ArgoCD服务账号权限

若已启用Server-Side渲染仍报错，需确保ArgoCD的ServiceAccount拥有common namespace下Secret的读取权限，创建Role和RoleBinding：

# role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: common
  name: argocd-secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list"]
---
# rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: argocd-secret-reader-binding
  namespace: common
subjects:
- kind: ServiceAccount
  name: argocd-application-controller
  namespace: argocd # ArgoCD的安装namespace
roleRef:
  kind: Role
  name: argocd-secret-reader
  apiGroup: rbac.authorization.k8s.io

内容的提问来源于stack exchange，提问作者Mikael Nyborg