Helm chart遍历values.yaml渲染SecretProviderClass失败解决

问题对应的values.yaml配置 #

keyvault:
  name: mykv
  tenantId: ${tenantId}$
  clientid: "#{spid}#"
  clientsecret: "#{spsecret}#"
  secrets:
    - secret1
    - secret2
    - secret3

原有渲染失败的模板 #

{{- define "commonobject.secretproviderclass.tpl" -}}
{{- if eq .Values.secret.enabled true }}
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: {{ $.Release.Name }}-secretproviderclass
  labels:
    app: {{ $.Release.Name }}
    chart: "{{ $.Release.Name }}-{{ .Chart.Version }}"
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  provider: azure
  secretObjects:
  - data:
      {{- range $key, $value := .Values.keyvault }}
      {{- range $value.secret }}
    - key: { . }
      {{- end }}
      {{- end }}
    secretName: {{ .Values.secret.keyvault.name }}
    type: opaque
  parameters:
    usePodIdentity: "false"
    useVMManagedIdentity: "false"
    userAssignedIdentityID: ""
    keyvaultName: {{ .Values.keyvault.name }}
    objects: |
      array:
        {{- range $key, $value := .Values.keyvault }}
        {{- range $value.secret }}
        - |
          objectName: {{ . }}
          objectType: secret
        {{- end }}
        {{- end }}
    tenantId: {{ .Values.keyvault.tenantid }}
{{- end }}
{{- end -}}
{{- define "commonobject.secretproviderclass" -}}
{{- template "commonobject.util.merge" (append . "commonobject.secretproviderclass.tpl") -}}
{{- end -}}

错误原因 #

• 遍历逻辑冗余：外层遍历.Values.keyvault会遍历keyvault下所有字段（name、tenantId、clientid等），这些字段不存在secret子属性，直接触发渲染错误
• 语法错误：key: { . }不符合Helm模板语法，变量输出必须使用双大括号包裹
• 字段拼写错误：values中定义的密钥列表字段是secrets，模板中错写为secret，无法匹配到对应值
• 格式错误：YAML缩进不匹配，Kubernetes Secret类型Opaque首字母未大写，tenantId字段大小写和values中定义不一致
• 引用路径错误：secretName字段错写为.Values.secret.keyvault.name，实际keyvault配置在根级.Values.keyvault下

修正后可用模板 #

{{- define "commonobject.secretproviderclass.tpl" -}}
{{- if eq .Values.secret.enabled true }}
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: {{ $.Release.Name }}-secretproviderclass
  labels:
    app: {{ $.Release.Name }}
    chart: "{{ $.Release.Name }}-{{ .Chart.Version }}"
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
spec:
  provider: azure
  secretObjects:
  - data:
    {{- range .Values.keyvault.secrets }}
    - key: {{ . }}
    {{- end }}
    secretName: {{ .Values.keyvault.name }}
    type: Opaque
  parameters:
    usePodIdentity: "false"
    useVMManagedIdentity: "false"
    userAssignedIdentityID: ""
    keyvaultName: {{ .Values.keyvault.name }}
    objects: |
      array:
        {{- range .Values.keyvault.secrets }}
        - |
          objectName: {{ . }}
          objectType: secret
        {{- end }}
    tenantId: {{ .Values.keyvault.tenantId }}
{{- end }}
{{- end -}}
{{- define "commonobject.secretproviderclass" -}}
{{- template "commonobject.util.merge" (append . "commonobject.secretproviderclass.tpl") -}}
{{- end -}}

内容的提问来源于stack exchange，提问作者Vowneee