Error: failed parsing key

Hi there,

currently I´m trying to set the annotations for the Vault agent sidecar injector in a helm release with Terraform.

However when setting the vault.hashicorp.com/agent-inject-template annotation I´m getting the error:

Error: failed parsing key “grafana.podAnnotations.vault\.hashicorp\.com/agent-inject-template-tls\.cer” with value {{- with secret “tm-euc1-dev-kube-prometheus-stack-grafana-pki/issue/tm-euc1-dev-kube-prometheus-stack-grafana-pki” “common_name=grafana.tm-npe.mydomain.top” -}}{{ .Data.certificate }}{{- end }}, key map "}{{ " has no value

The set block in the “helm_release” is configured this way:

dynamic "set" {
  for_each = var.grafana_enable_ssl_via_injection ? local.grafana_vault_inject_ssl_annotation : {}
  content {
    name  = "grafana.podAnnotations.${replace(set.key, ".", "\\.")}"
    value = set.value
  }
}

The local “grafana_vault_inject_ssl_annotation”’ has the following content:

  grafana_vault_inject_ssl_annotation = {
    "vault.hashicorp.com/agent-inject"                  = "true"
    "vault.hashicorp.com/agent-inject-secret-tls.key"   = "${module.standard_label.id}-grafana-pki/issue/${module.standard_label.id}-grafana-pki"
    "vault.hashicorp.com/agent-inject-template-tls.key" = "{{- with secret \"${module.standard_label.id}-grafana-pki/issue/${module.standard_label.id}-grafana-pki\" \"common_name=${replace(var.grafana_addr, "https://", "")}\" -}}{{ .Data.private_key }}{{- end }}"
    "vault.hashicorp.com/agent-inject-secret-tls.cer"   = "${module.standard_label.id}-grafana-pki/issue/${module.standard_label.id}-grafana-pki"
    "vault.hashicorp.com/agent-inject-template-tls.cer" = "{{- with secret \"${module.standard_label.id}-grafana-pki/issue/${module.standard_label.id}-grafana-pki\" \"common_name=${replace(var.grafana_addr, "https://", "")}\" -}}{{ .Data.certificate }}{{- end }}"
    "vault.hashicorp.com/role"                          = "${module.standard_label.id}-grafana-pki"
}

Any hint on what I´m missing would be greatly appreaciated :slight_smile:

Hi, did you find a solution for this @timkra ? I’m experiencing similar error with another helm chart.

@timkra Your technique works for me without any errors using Terraform v1.6.4 and Helm provider v2.11.0 to set annotations on pods of External Secrets deployment:

locals {
  pod_annotations = {
    "example.com/created-at"      = "2023-11-27T16:59:24Z"
    "example.com/created-by"      = "xxx-xxx-xxx"
    "example.com/managed-by"      = "terraform"
    "example.com/owner"           = "mloskot"
  }
}

resource "helm_release" "external_secrets" {
  name        = "external-secrets"
  namespace   = "external-secrets"

  chart      = "external-secrets"
  repository = "https://charts.external-secrets.io"
  version    = "0.9.9"

  dynamic "set" {
    for_each = local.pod_annotations
    content {
      name  = "podAnnotations.${replace(set.key, ".", "\\.")}"
      value = set.value
    }
  }
}

No parsing errors. Terraform is happy to plan and apply.