helm - provide file as a cert

Question

I am defining the path to the certs: root path

• certs (folder)
• templates (folder)

value.yaml

tlsSecret:
  enabled: true
  secrets:
    - name: ca-secret
      key: values.schema.json
      certificate: ./certs/client-ca.crt
    - name: envoy-secret
      key: ./certs/server.key
      certificate: ./certs/server.crt

sec.yaml

{{- if .Values.tlsSecret.enabled }}
{{- range .Values.tlsSecret.secrets }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ .name }}
  labels:
    {{- include "envoy-edge.labels" $ | nindent 4 }}
type: kubernetes.io/tls
data:
  tls.crt: {{ .certificate | b64enc }}
  tls.key: |-
    {{ $.Files.Get .key | b64enc }}
---
{{- end }}
{{- end }}

I am not able to use the file. Seems that files.get doesn't import the file.

Answer 1

A few questions:

1. Is values.schema.json also a file? Is it a file in the root directory?
2. Does tls.crt in sec want to read the content of the file and then encode it or directly encode the input string?

---

Notice:

1. If values.schema.json is a file in the root directory, then this file cannot be accessed by File.Get, because it contains the keyword values, so it will be ignored. If you want to access, you need to change its file name, such as changing to schema.json
2. Do not add ./ when writing the path, just write the relative path directly. For example, ./certs/server.crt should be written as certs/server.crt.

---

Demo:

tree:

.
??? Chart.yaml
??? certs
?   ??? client-ca.crt
?   ??? server.crt
?   ??? server.key
??? schema.json
??? templates
?   ??? NOTES.txt
?   ??? _helpers.tpl
?   ??? configmap.yaml
?   ??? deployment.yaml
?   ??? sec.yaml
??? values.yaml

values.yaml

tlsSecret:
  enabled: true
  secrets:
    - name: ca-secret
      key: schema.json
      certificate: certs/client-ca.crt
    - name: envoy-secret
      key: certs/server.key
      certificate: ./certs/server.crt

sec.yaml

---
{{- if .Values.tlsSecret.enabled }}
{{- range .Values.tlsSecret.secrets }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ .name }}
type: kubernetes.io/tls
data:
  k: {{ .key }}
  tls.crt: {{ .certificate | b64enc }}
  tls.key: |-
    {{ $.Files.Get .key | b64enc }}
---
{{- end }}
{{- end }}

certs/server.key

123

schema.json

{"1":1}

output:

---
apiVersion: v1
kind: Secret
metadata:
  name: ca-secret
type: kubernetes.io/tls
data:
  tls.crt: Y2VydHMvY2xpZW50LWNhLmNydA==
  tls.key: |-
    eyIxIjoxfQ==
---
apiVersion: v1
kind: Secret
metadata:
  name: envoy-secret
type: kubernetes.io/tls
data:
  tls.crt: Li9jZXJ0cy9zZXJ2ZXIuY3J0
  tls.key: |-
    MTIz