No way to disable vals's `ref+` strings evaluation #2057

lucasfcnunes · 2025-05-27T21:41:13Z

lucasfcnunes
May 27, 2025

There's a great risk of leaking raw secrets to GitOps when working with https://github.com/digitalis-io/vals-operator.
Pave a way to disable the evaluation of ref+ using flags, env vars, yaml keys, etc.

*I feel that it would've been great if I had brought this up when this project was still v0. 😅

Example

# helmfile.yaml.gotmpl
repositories:
  - name: bedag
    url: https://bedag.github.io/helm-charts
---
DISABLE-VALS-EVALUATION: true # <<< NEEDED FLAG
releases:
  - chart: bedag/raw
    name: helmfile-vals-ref
    namespace: lucasfcnunes-test
    values:
      - resources:
          # INFO: https://github.com/digitalis-io/vals-operator?tab=readme-ov-file#usage
          - apiVersion: digitalis.io/v1
            kind: ValsSecret
            metadata:
              name: helmfile-vals-ref
            spec:
              data:
                VALS_REF_PLAIN:
                  ref: ref+echo://VALS_REF # <<< SHOULD BE KEPT THIS WAY
                  encoding: text
                VALS_REF_ESCAPED:
                  ref: ref+echo://ref++echo://VALS_REF # <<< KNOWN WAY TO SCAPE
                  encoding: text

$ helmfile template
Adding repo bedag https://bedag.github.io/helm-charts
"bedag" has been added to your repositories

Templating release=helmfile-vals-ref, chart=bedag/raw
---
# Source: raw/templates/resources.yaml
apiVersion: digitalis.io/v1
kind: ValsSecret
metadata:
  labels:
    app.kubernetes.io/instance: helmfile-vals-ref
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: helmfile-vals-ref-raw
    app.kubernetes.io/version: 1.0.0
    helm.sh/chart: raw-2.0.0
  name: helmfile-vals-ref
spec:
  data:
    VALS_REF_ESCAPED:
      encoding: text
      ref: ref+echo://VALS_REF
    VALS_REF_PLAIN:
      encoding: text
      ref: VALS_REF

lucasfcnunes · 2025-05-27T21:44:33Z

lucasfcnunes
May 27, 2025
Author

Just noticed that maybe it's a https://github.com/jkroepke/helm-secrets thing that I can solve by reading 😐

3 replies

lucasfcnunes May 29, 2025
Author

@yxxhero, do you know how to disable?

yxxhero Jun 12, 2025
Collaborator

disable? you can not use that.

lucasfcnunes Jun 12, 2025
Author

so... no way to disable all ref+ rendering in a specific helmfile.yaml.gotmpl?

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

No way to disable vals's `ref+` strings evaluation #2057

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment 3 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

No way to disable vals's ref+ strings evaluation #2057

Uh oh!

Uh oh!

lucasfcnunes May 27, 2025

Example

Replies: 1 comment · 3 replies

Uh oh!

lucasfcnunes May 27, 2025 Author

Uh oh!

lucasfcnunes May 29, 2025 Author

Uh oh!

yxxhero Jun 12, 2025 Collaborator

Uh oh!

lucasfcnunes Jun 12, 2025 Author

No way to disable vals's `ref+` strings evaluation #2057

lucasfcnunes
May 27, 2025

Replies: 1 comment 3 replies

lucasfcnunes
May 27, 2025
Author

lucasfcnunes May 29, 2025
Author

yxxhero Jun 12, 2025
Collaborator

lucasfcnunes Jun 12, 2025
Author