Secret value not referenced if upstream chart doesn't use tpl function

[megakoresh]

In a use-case where I have my secrets.yaml like this

postgresPassword: !vault secrets/superset#postgresPassword

and then I am trying to deploy superset chart and in my values I set

postgresql:
  postgresqlPassword: '{{ .Values.postgresPassword }}'

for the dependency chart, the generated secret is

# Source: superset/charts/postgresql/templates/secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: superset-postgresql
  labels:
    app.kubernetes.io/name: postgresql
    helm.sh/chart: postgresql-10.2.0
    app.kubernetes.io/instance: superset
    app.kubernetes.io/managed-by: Helm
type: Opaque
data:
  postgresql-password: "e3sgLlZhbHVlcy5wb3N0Z3Jlc1Bhc3N3b3JkIH19"

which corresponds literally to {{ .Values.postgresPassword }}. This is because the dependency chart doesn't use tpl to refer to this value and of course I can't control it. Same issue exists for the superset chart itself. Where the chart templates refer to values via tpl function, the value from secret is correctly rendered.

I am using the following command to check:

helm secrets -d vault upgrade --install superset .tmp/superset-master/helm/superset -f superset/prod/secrets.yaml -f superset/prod/values.yaml --dry-run

Am I just doing something wrong or is this an issue with the plugin?

[megakoresh]

Seems this is a problem with Helm in general - helm/helm#6876

I found a workaround: in the secrets file you have to precisely repeat the structure of the values.yaml to get the secret values:

With secrets.yaml like that

postgresql:
  postgresqlPassword: !vault secrets/superset#postgresPassword

I was able to get it working. This is very inconvenient and will probably not work with lists, but I guess the plugin developers shouldn't be the ones trying to fix such issues.

[jkroepke]

in the secrets file you have to precisely repeat the structure of the values.yaml

Thats correct. I guess thats the only way no matter if you are using plugins or not.

A better workaround:

This is because the dependency chart

Try to fix there dependency charts by doing pull requests ;-)

[megakoresh]

Try to fix there dependency charts by doing pull requests ;-)

It is not feasible to fix every single upstream chart by replacing every reference to a user variable with a tpl version, not to mention that many maintainers will not be willing to accept such changes for the sake of one plugin. But I think this current approach is fine if it could be also made to work with lists.

[jkroepke]

@megakoresh

Take a look at https://github.com/variantdev/vals, It may helps.