How can I load Kubernetes Secret values into a ConfigMap with fallback defaults using Helm?

Below is one way to achieve your goal using Helm templating. The idea is to try to retrieve a Kubernetes Secret (provided optionally by the customer) and, if it’s missing, fall back to the default values defined in your values.yaml.

Note: Retrieving a Secret from within a Helm template often uses the built-in lookup function. In your configmap template you can then combine lookup with conditional defaults.

Below is an example that combines both:

---

1. Define the Secret Template

This is your secret file (using Helm templating):

YAMLCopied
apiVersion: v1
kind: Secret
metadata:
  name: {{ .Values.keycloak.serviceName }}-smtp-secret
  namespace: {{ .Release.Namespace }}
type: Opaque
data:
  smtp-host: "{{ .Values.keycloak.smtp.host  | b64enc }}"
  smtp-from: "{{ .Values.keycloak.smtp.from  | b64enc }}"
  smtp-fromDisplayName: "{{ .Values.keycloak.smtp.fromDisplayName  | b64enc }}"
  smtp-port: "{{ .Values.keycloak.smtp.port | quote | b64enc }}"
  smtp-ssl: "{{ .Values.keycloak.smtp.ssl  | quote | b64enc }}"
  smtp-auth: "{{ .Values.keycloak.smtp.auth | quote | b64enc }}"
  smtp-username: "{{ .Values.keycloak.smtp.username | b64enc }}"
  smtp-password: "{{ .Values.keycloak.smtp.password  | b64enc }}"
  smtp-starttls: "{{ .Values.keycloak.smtp.starttls | quote | b64enc }}"

---

2. Retrieve the Secret in the ConfigMap Template

In your configmap template, add a lookup call at the top to fetch the Secret if it exists. Then use the retrieved values, applying a fallback to your default settings from values.yaml. For example:

YAMLCopied
{{- /*
  Retrieve the secret; Note that the lookup function returns an object.
  The secret name is constructed similarly to the secret template filename.
*/ -}}
{{- $secretName := printf "%s-smtp-secret" .Values.keycloak.serviceName -}}
{{- $secret := lookup "v1" "Secret" .Release.Namespace $secretName -}}

apiVersion: v1
kind: ConfigMap
metadata:
  name: keycloak-realm-configmap
  namespace: {{ .Release.Namespace }}
data:
  realm.json: |
    {
      "smtpServer": {
        "host": "{{ if and $secret (hasKey $secret.data "smtp-host") }}{{ $secret.data.smtp-host | b64dec }}{{ else }}{{ .Values.keycloak.smtp.host }}{{ end }}",
        "from": "{{ if and $secret (hasKey $secret.data "smtp-from") }}{{ $secret.data.smtp-from | b64dec }}{{ else }}{{ .Values.keycloak.smtp.from }}{{ end }}",
        "fromDisplayName": "{{ if and $secret (hasKey $secret.data "smtp-fromDisplayName") }}{{ $secret.data.smtp-fromDisplayName | b64dec }}{{ else }}{{ .Values.keycloak.smtp.fromDisplayName }}{{ end }}",
        "port": "{{ if and $secret (hasKey $secret.data "smtp-port") }}{{ $secret.data.smtp-port | b64dec }}{{ else }}{{ .Values.keycloak.smtp.port }}{{ end }}",
        "ssl": "{{ if and $secret (hasKey $secret.data "smtp-ssl") }}{{ $secret.data.smtp-ssl | b64dec }}{{ else }}{{ .Values.keycloak.smtp.ssl }}{{ end }}",
        "auth": "{{ if and $secret (hasKey $secret.data "smtp-auth") }}{{ $secret.data.smtp-auth | b64dec }}{{ else }}{{ .Values.keycloak.smtp.auth }}{{ end }}",
        "username": "{{ if and $secret (hasKey $secret.data "smtp-username") }}{{ $secret.data.smtp-username | b64dec }}{{ else }}{{ .Values.keycloak.smtp.username }}{{ end }}",
        "password": "{{ if and $secret (hasKey $secret.data "smtp-password") }}{{ $secret.data.smtp-password | b64dec }}{{ else }}{{ .Values.keycloak.smtp.password }}{{ end }}",
        "starttls": "{{ if and $secret (hasKey $secret.data "smtp-starttls") }}{{ $secret.data.smtp-starttls | b64dec }}{{ else }}{{ .Values.keycloak.smtp.starttls }}{{ end }}"
      }
    }

---

Explanation

• lookup Function:
  The lookup function fetches an existing resource (in this case, your Secret). If the customer has provided their own secret, it will be returned; otherwise, $secret will be empty.

• Conditional Access:
  For each SMTP parameter, the template checks using an if statement whether the secret exists and has the specific key. If it does, the value is extracted (and decoded if needed, using b64dec). Otherwise, it falls back to the value defined in .Values.keycloak.smtp.

• Base64 Handling:
  Since Secrets store data in base64-encoded format, the template decodes the value with the b64dec function so that the actual value is used in the configuration.

This approach allows your customers to supply a custom secret if desired. If not, the templates directly pull the default values from the values.yaml file.

Feel free to adjust the error handling or logging as necessary for your deployment workflow.