Vault is integrated with K8s cluster as side car and this cluster is deployed by using helm chart.
As a part of helm chart below is code :
vault.hashicorp.com/agent-inject-template-dbsecret: |
{{`{{- with secret "path" -}}
export USER="{{ .Data.data.user }}"
export PASSWORD="{{ .Data.data.password }}"
{{- end }}`}}
Now it is required to use same helm chart for different environment and per environment path can be different so planning to store it in values file and use it here.
Tried with {{ .Values.secretPath }} but value is not getting populated.
vault.hashicorp.com/agent-inject-template-dbsecret: |
{{`{{- with secret "{{ .Values.secretPath }}" -}}
export USER="{{ .Data.data.user }}"
export PASSWORD="{{ .Data.data.password }}"
{{- end }}`}}
I would like to know how can i keep this path values as dynamic and pass it from values file so same chart can be used in different environment.
Thanks in advance.
Here's what's going on with the template: that annotation's value is itself a Go text/template template – Vault is using the same underlying templating engine as Helm – and so wrapping the template text in curly braces and backticks causes the template text itself to be written out.
# looks up "some" in `.`, then looks up "expression" in that
{{ .some.expression }}
# the string "{{ .some.string }}"
{{`{{ .some.string }}`}}
There are other syntaxes to include double curly braces in the output, beyond quoting the entire string, for example
# also outputs "{{ .some.string }}"
{{ "{{" }} .some.string }}
which starts with a template expression outputting a double open curly brace, and then the rest is text.
That means you can combine this with other template expressions; for example
# also outputs "{{ .some.string }}"
{{ $variable := ".some.string" -}}
{{ "{{" }} {{ $variable }} }}
Similar but longer and possibly easier to read,
# also outputs "{{ .some.string }}"
{{ $open := "{{" -}}
{{ $variable := ".some.string" -}}
{{ $close := "}}" -}}
{{ $open }} {{ $variable }} {{ $close }}
You can combine this technique with your original template to include double curly braces in the output, but use a Helm template expression to reference the Helm .Values structure.
vault.hashicorp.com/agent-inject-template-dbsecret: |
{{ "{{" }}- with secret "{{ .Values.secretPath }}" -}}
export USER="{{ "{{" }} .Data.data.user }}"
export PASSWORD="{{ "{{" }} .Data.data.password }}"
{{ "{{" }}- end }}
This form converts every {{ expected in the output to {{ "{{" }}, and then leaves the Helm-level expression {{ .Values.secretPath }} as-is.
Related
I need to reduce my 'if else code' in my helm chart template
How can I do that ?.
{{- if .Values.global }}
{{- if .Values.global.namespace }}
namespace: {{ .Values.global.namespace }}
{{- else }}
namespace: {{ .Values.namespace }}
{{- end }}
{{- else }}
namespace: {{ .Values.namespace }}
{{- end}}
name: {{.Values.name}}
You could use a variable and also {{with}} (which sets the dot), e.g.:
{{- $ns := .Values.namespace -}}
{{- with .Values.global }}{{ with.namespace }}{{ $ns = . }}{{end}{{ end -}}
namespace: {{ $ns }}
name: {{.Values.name}}
"If x is truthy, then use its value, otherwise use y" is what the Helm (Sprig) default function does. You could replace the inner conditional with
namespace: {{ .Values.global.namespace | default .Values.namespace }}
The outer conditional is trickier. The problem you're trying to work around here is, if .Values.global isn't defined, it will evaluate to nil, and then .Values.global.namespace is an error. The usual approach I use here is to again use default to get an empty dictionary if it isn't defined, at which point you can successfully do a lookup.
So you should be able to replace the entire block with
{{- $global := .Values.global | default dict }}
namespace: {{ $global.namespace | default .Values.namespace }}
Having such Helm code snippet.
{{ if .Values.configOverrides }}
# Overrides
{{- range $key, $value := .Values.configOverrides }}
# {{ $key }}
{{ tpl $value $ }}
{{- end }}
{{- end }}
What is $ sign in {{ tpl $value $ }}?
From the documentation:
However, there is one variable that is always global - $ - this variable will
always point to the root context. This can be very useful when you are
looping in a range and you need to know the chart's release name.
So the expression you show in your question...
{{ tpl $value $ }}
...is passing root context as the set of values to be used when expanding the template in $value.
I am wondering if there is a more efficient way to exclude any yaml keys which do not have a value set.
My current approach is to wrap each key in an if statement...
container:
spec:
{{- if values.spec.x }}
x: {{ values.spec.x }}
{{- end}}
{{- if values.spec.y }}
y: {{ values.spec.y }}
{{- end}}
{{- if values.spec.z }}
z: {{ values.spec.z }}
{{- end}}
e.g.
for each child of container.spec:
if the value != null:
include as child of spec
else:
exclude from spec
I thought about wrapping the above in a _helper.tpl function to try to keep the main template tidy, but it would still include writing multiple if statements.
Is there a better way of doing the above?
Thanks!
You can directly translate that pseudocode into Helm chart logic. The trick is that a Go template range loop is basically equivalent to a "for" loop in most languages. So:
container:
spec:
{{- range $key, $value := .Values.spec }}
{{- if ne $value nil }}
{{ $key }}: {{ $value }}
{{- end }}
{{- end }}
If you can just omit the unused keys from the values, then this becomes simpler and safer. Helm includes a lightly-documented toYaml function that will render an arbitrary structure as YAML, but you can't really do any filtering or other preprocessing before writing it out.
container:
spec:
{{ .Values.spec | toYaml | indent 4 }}
We use helm charts to deploy to kubernetes and helm to generate those charts. Unfortunately I'm not familiar with helm or helm templates (and only moderately familiar with kubernetes) so in asking the question below I may use incorrect terminology (in fact I may have done already in this paragraph) so please bear with me as I get up to speed.
I have a helm template, foo.yaml, that resembles the following:
{{- define "env.variables" }}
echo "--- Setting env variables ---"
export foo={{ .Values.global_vars.foo }}
{{- end }}
apiVersion: v1
kind: Secret
type: Opaque
metadata:
name: "{{ .Values.global_vars.bar }}-set-env-vars"
data:
set-env-vars.sh: {{ include "env.variables" . | b64enc }}
As you can see it defines a script that creates some environment variables. I am working on a requirement to only create those variables where some condition is true (.Values.global_vars.baz == 1)
I suppose I could achieve this by doing something like:
{{- define "env.variables" }}
if [ {{ .Values.global_vars.baz }} = 1 ]
then
echo "--- Setting env variables ---"
export foo={{ .Values.global_vars.foo }}
fi
{{- end }}
apiVersion: v1
kind: Secret
type: Opaque
metadata:
name: "{{ .Values.global_vars.bar }}-set-env-vars"
data:
set-env-vars.sh: {{ include "env.variables" . | b64enc }}
but that doesn't feel like a very elegant way of doing it. Can I put a conditional expression into data that only includes the script where the condition is met. Something like this:
{{- define "env.variables" }}
echo "--- Setting env variables ---"
export foo={{ .Values.global_vars.foo }}
{{- end }}
{{- define "no.env.variables" }}
echo "--- No env variables to set ---"
{{- end }}
apiVersion: v1
kind: Secret
type: Opaque
metadata:
name: "{{ .Values.global_vars.bar }}-set-env-vars"
data:
set-env-vars.sh: {{ if {{ .Values.global_vars.bar }} = 1 then include "env.variables" else include "no.env.variables" . | b64enc }}
Hope that makes sense. This is literally my first ever excursion into helm so am looking for some noob guidance.
The fancy {{ }} things in the helm files are GO templates. They have several built-in features, one of them are control structures, like if-else. They allow you to render part of the template conditionally.
You can add a condition to the env.variables named template:
{{ define "env.variables" }}
{{ if eq .Values.global_vars.baz "1" }}
echo "--- Setting env variables ---"
export foo={{ .Values.global_vars.foo }}
{{ else }}
echo "--- No env variables to set ---"
{{ end }}
{{ end }}
data:
set-env-vars.sh: {{ include "env.variables" . | b64enc }}
or to the set-env-vars.sh value:
{{- define "env.variables" }}
echo "--- Setting env variables ---"
export foo={{ .Values.global_vars.foo }}
{{- end }}
{{- define "no.env.variables" }}
echo "--- No env variables to set ---"
{{- end }}
data:
set-env-vars.sh: {{ if eq .Values.global_vars.baz "1" }}
{{- include "env.variables" . | b64enc }}
{{- else }}
{{- include "env.variables" . | b64enc }}
{{- end }}
The effect would be the same.
One confusing thing may be the if eq .Values.global_vars.baz "1" syntax. The eq is a function, and the next values are its arguments (GO templates do not have equals operator).
I have a directory structure like this:
helm
|-->mappings
|--> foo
foo1.yaml foo2.yaml
|-->templates
mapping.yaml
values.yaml
where values.yaml
has a value that I need to be a variable due to environment like {{ .Values.data.hostname }}
and in mapping.yaml
{{- $files := .Files }}
{{- range .Values.mappings.foo }}
{{- $genericfilepath := printf "mappings/foo/%s.yaml" . }}
{{ $files.Get $genericfilepath }}
{{- end }}
Currently the mapping.yaml file loops through the designated directory and load the yaml file however I am unable to access the Values variable.
I have also attempted subchart where values.yaml file would be under helm/mappings/foo/values.yaml but it also doesn't resolve or I am not 100% understanding if subchart would be the correct solution to resolve the file path
In the Go text/template language, . is a special "context" variable, and references like .Files or .Values are actually retrieving fields from .. For example, you could write a sample template:
{{- $dot := . -}}
# These both print the same value
dot-values-foo: {{ .Values.foo }}
dollars-dot-values-foo: {{ $dot.Values.foo }}
One of the ways . is special is that the range statement sets . to each item as it iterates through a collection. In your example:
{{/* . is the top item; .Values is valid */}}
{{- range .Values.mappings.foo }}
{{/* . is one of the items in `mappings.foo` */}}
{{- end }}
{{/* . is the top item again */}}
If I need to use . for some special purpose like this, I tend to save the original top item in a variable, and then I can refer to fields in that.
{{- $top := . }}
{{- range .Values.mappings.foo }}
{{- $genericfilepath := printf "mappings/foo/%s.yaml" . }}
{{ $top.Files.Get $genericfilepath }}
{{ index $top.Values.enabled . }}
{{- end }}