How to add a sealed-secret.yaml file in a Helm chart?

Question

I have a custom helm chart that I wrote which has a deployment.yaml, service.yaml and other yamls. Now, I want to included a sealed-secret.yaml template file such as following in it:

{{- if .Values.sealedSecrets -}}
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  creationTimestamp: null
  name: {{ include "mychart.fullname" . }}-sealedsecret  
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "mychart.labels" . | nindent 4 }}
  annotations:
    "helm.sh/hook": pre-install    
spec:
  encryptedData:
    {{- range .Values.sealedSecrets }}
    {{ .key }}: {{ .value }}
    {{- end }}     
  template:
    data: null
    metadata:
      creationTimestamp: null
      name: {{ include "mychart.fullname" . }}-sealedsecret  
      namespace: {{ .Release.Namespace }}
{{- end }}

However, when I install my app using the Helm chart I don't see the secret being generated. I also checked the Helm manifest for the deployed app and I don't see the sealed-secret.yaml file in it.

Do I need to do something special for a sealed secret?

Answer 1

I hope this example helps to you :) @Katlock

create a new chart:

$ cd /tmp
$ helm create mychart

see original chart files

$ find mychart/

mychart/
mychart/charts
mychart/templates
mychart/templates/tests
mychart/templates/tests/test-connection.yaml
mychart/templates/_helpers.tpl
mychart/templates/NOTES.txt
mychart/templates/hpa.yaml
mychart/templates/serviceaccount.yaml
mychart/templates/service.yaml
mychart/templates/deployment.yaml
mychart/templates/ingress.yaml
mychart/.helmignore
mychart/values.yaml
mychart/Chart.yaml

remove unnecessary files for testing

$ rm -rf mychart/templates/test
$ rm -f mychart/templates/*.yaml

create SealedSecret helm template file

$ cat <<EOF > mychart/templates/sealedsecret.yaml
> {{- if .Values.sealedSecrets -}}
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  creationTimestamp: null
  name: {{ include "mychart.fullname" . }}-sealedsecret  
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "mychart.labels" . | nindent 4 }}
  annotations:
    "helm.sh/hook": pre-install    
spec:
  encryptedData:
    {{- range .Values.sealedSecrets }}
    {{ .key }}: {{ .value }}
    {{- end }}     
  template:
    data: null
    metadata:
      creationTimestamp: null
      name: {{ include "mychart.fullname" . }}-sealedsecret  
      namespace: {{ .Release.Namespace }}
{{- end }}
EOF

create a values.yaml file for key-value secrets

$ cat <<EOF > values.yaml
> sealedSecrets:
  - key: my_key
    value: my_value
  - key: my_second_key
    value: my_second_value
EOF

see last file status

$ find mychart/

mychart/
mychart/charts
mychart/templates
mychart/templates/sealedsecret.yaml
mychart/templates/NOTES.txt
mychart/templates/_helpers.tpl
mychart/.helmignore
mychart/values.yaml
mychart/Chart.yaml

run helm template command to see created SealedSecret k8s object

helm template my-chart mychart/ -f values.yaml 

---
# Source: mychart/templates/sealedsecret.yaml
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  creationTimestamp: null
  name: my-chart-mychart-sealedsecret  
  namespace: my-namespace
  labels:
    helm.sh/chart: mychart-0.1.0
    app.kubernetes.io/name: mychart
    app.kubernetes.io/instance: my-chart
    app.kubernetes.io/version: "1.16.0"
    app.kubernetes.io/managed-by: Helm
  annotations:
    "helm.sh/hook": pre-install    
spec:
  encryptedData:
    my_key: my_value
    my_second_key: my_second_value     
  template:
    data: null
    metadata:
      creationTimestamp: null
      name: my-chart-mychart-sealedsecret  
      namespace: my-namespace