Commit e55cd778 authored by xuwang's avatar xuwang
Browse files

fix(render.sh): make vault-kv format field optional, default to text 



Secrets stored in Vault without a `format` field (e.g. legacy entries
created before the format convention was adopted) caused gomplate to
panic with "map has no entry for key format", silently writing an empty
Kubernetes Secret to the cluster.

Use `coll.Has` to check for the key before accessing it, falling back to
"text" when absent. Behaviour is unchanged for secrets that already carry
a `format` field.

Changelog: fix
Co-Authored-By: default avatarClaude Sonnet 4.6 <noreply@anthropic.com>
parent 9e6a3238

scripts/render.sh

+4 −2
Original line number Diff line number Diff line
@@ -42,7 +42,8 @@ if [ $(ver2num ${gomplate_version} ) -ge $(ver2num "4.0.0") ] && [ "${VAULT_SEC_ 
    read -r -d '' gomplate_func <<'EOF'

    {{- define "vault-kv" }}

    {{- $response := (datasource "vault" .) }}

    {{- if eq $response.format "base64" }}{{ base64.Decode $response.value }}

    {{- $format := coll.Has $response "format" | ternary $response.format "text" }}

    {{- if eq $format "base64" }}{{ base64.Decode $response.value }}

    {{- else }}{{ $response.value }}{{ end }}{{ end -}}

EOF

else
@@ -50,7 +51,8 @@ else 
    read -r -d '' gomplate_func <<'EOF'

    {{- define "vault-kv" }}

    {{- $response := (datasource "vault" (strings.ReplaceAll "secret/" "secret/data/" . )).data }}

    {{- if eq $response.format "base64" }}{{ base64.Decode $response.value }}

    {{- $format := coll.Has $response "format" | ternary $response.format "text" }}

    {{- if eq $format "base64" }}{{ base64.Decode $response.value }}

    {{- else }}

    {{- $response.value }}{{ end }}{{ end -}}

EOF