Helm get value from secret - kubernetes-helm

Question

I was wondering if there is any workaround to set a value in a secret and let helm render it before install. The use case is this, I'm using the bitnami chart for rabbitmq and I want to add SSO with my azure active directory, there is the variable advancedConfiguration: |- ... for that purpose but I have to put the configuration in plain text and add it to version control. As you can imagine, I don't want to do that.
The SSO config is like the following json:
advancedConfiguration: |-
[
{rabbit, [
{auth_backends, [rabbit_auth_backend_oauth2, rabbit_auth_backend_internal]}
]},
{rabbitmq_auth_backend_oauth2, [
{resource_server_id, <<"CLIENT_ID">>},
{extra_scopes_source, <<"roles">>},
{key_config, [
{jwks_url, <<"https://login.microsoftonline.com/PROVIDER_ID/discovery/v2.0/keys">>}
]}
]},
{rabbitmq_management, [
{oauth_enabled, true},
{oauth_client_id, "CLIEND_ID"},
{oauth_client_secret, "CLIENT_SECRET"},
{oauth_provider_url, "https://login.microsoftonline.com/PROVIDER_ID"}
]}
].
The PROVIDER_ID, CLIEND_ID and CLIENT_SECRET are the values that I want to hide.
I have read about helm --post-renderer flag, but I am using argocd for deploys and it seems that it is not compatible with that flag.
What options do I have to solve this correctly? Thanks in advance.
This is what the chart does with the value:
apiVersion: v1
kind: Secret
metadata:
name: {{ printf "%s-config" (include "common.names.fullname" .) }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- end }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: Opaque
data:
rabbitmq.conf: |-
{{- include "common.tplvalues.render" (dict "value" .Values.configuration "context" $) | b64enc | nindent 4 }}
{{- if .Values.advancedConfiguration }}
advanced.config: |-
{{- include "common.tplvalues.render" (dict "value" .Values.advancedConfiguration "context" $) | b64enc | nindent 4 }}
{{- end }}

Answer 1

As I said, I update the chart and submit a PR. This is solved in the version 11.3.0 using the key advancedConfigurationExistingSecret instead of the previous key.
If you are curious about this here are the details:
Docs: https://artifacthub.io/packages/helm/bitnami/rabbitmq/11.3.0
PR: https://github.com/bitnami/charts/pull/14071