Access sealed secret from deployment.yaml in helm chart

Question

I'm trying to use a helm chart to deploy my secrets as sealed secret, I have created a template for the sealed secret

apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: {{ include "api.fullname" . }}
  namespace: api
  
spec:
  template:
    metadata: 
      name: {{ include "api.fullname" . }}
  encryptedData:
    {{- range $key, $val := .Values.encryptedData }}
    {{ $key }}: {{ $val }}
    {{- end }}

and in my deployment I'm setting the secret values as env variables

env:        
{{- range $key, $val := .Values.encryptedData }}
- name: {{ $key }}
  valueFrom:
    secretKeyRef:
      name: {{ include "sealedsecret.bitnami.com/api.fullname" $ }}
      key: {{ $key }}
{{- end }} 

The problem is when I install the chart the sealed secret file is in sealedsecret.bitnami.com/api

how can reference that in the include part of the secretKeyRef

The error I'm getting when installing the chart

Error: template: joe-api/templates/deployment.yaml:42:25: executing "api/templates/deployment.yaml" at <include "sealedsecret.bitnami.com/api.fullname" $>: error calling include: template: no template "sealedsecret.bitnami.com/api.fullname" associated with template "gotpl"

any help would be appreciated

Answer 1

SealedSecret creates Secret in your cluster with the same name as itself, see https://github.com/bitnami-labs/sealed-secrets#overview

Your SealedSecret name comes from chart fullname template - {{ include "api.fullname" . }}, but in deployment you are including undefined template, named sealedsecret.bitnami.com/api.fullname (you can check available templates in templates/_helpers.tpl file if you want)

So the snippet below should work:

env:        
{{- range $key, $val := .Values.encryptedData }}
- name: {{ $key }}
  valueFrom:
    secretKeyRef:
      name: {{ include "api.fullname" $ }}
      key: {{ $key }}
{{- end }}