Helm template with agent template

Vault
1

Hello folks,

I’m using vault-agent to inject secrets in my application and trying to make the annotation as dynamic as I can , I have an array of keys and wanted to iterate over them … what I did was below:

      annotations:
        {{- if  $vaultKeysEnabled }}
        vault.hashicorp.com/agent-inject: 'true'
        vault.hashicorp.com/agent-inject-status: "update"
        vault.hashicorp.com/agent-init-first: "true"
        vault.hashicorp.com/role: services-role
        vault.hashicorp.com/agent-inject-secret: "path/data/to/secret/"
        {{- range $vaultKeys.keys }} # to loop over array
        vault.hashicorp.com/agent-inject-file-{{ . }}: {{ . }}-encoded # WORKING FINE
        vault.hashicorp.com/agent-inject-template-{{ . }}: |-
          {{ "{{- with secret "}} "{{ $vaultEnv.environment }}/data/{{ $root.Release.Namespace }}/{{ $root.Release.Name }}" {{ ` -}} `}}
              {{ "{{index .Data.data"}} "{{ . }}"{{ `}} 
          {{- end }} `}}
        vault.hashicorp.com/agent-inject-command-{{ . }}: /bin/sh -c "base64 -d /vault/secrets/{{ . }}-encoded > /vault/secrets/{{ . }}"
        {{- end }}
        {{- end }}

the template annotation has an issue with this {{ "{{index .Data.data"}} "{{ . }}"{{ }}`
what I’m trying to achive here is to index multiple keys for example:
keys:

  • test1
  • test2

I wanted to have an index for test1 and another for test2 , above was RENDERED FINE as manifest by helm template command but it’s not fetching anything from vault and when changed it to {{index .Data.data "key_name"}} it worked! but I don’t want to hard code the name

Here is how it is rendered

image
image2986×756 204 KB

I would appricate your thoughts!

2

Hello again,

I managed to fix this after I had my coffee … It was two small silly mistakes :smiley:

  1. some of the keys names are having a dots , so I replaced the dots by dashes like this {{ . | replace "." "-"}}
  2. the vault.hashicorp.com/agent-inject-secret annotation move inside the range loop.

Now, everything worked as expected :wink: