Pass json strings with --set / --set-string

[namelessvoid]

Inside our CI piepline, I try to pass a google service account key (JSON format, contained in an environment variable) to the helm chart. It should end up as base64 encoded string within a secret:

# secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: secret
  labels:
    app: application
    chart: {{ .Chart.Name }}
    heritage: {{ .Release.Service }}
type: Opaque
data:
  credentials.json: {{ .Values.googleServiceAccount.credentials | b64enc | quote }}

However, passing it via --set/--set-string I get

$ helm template ./chart --set-string googleServiceAccount.credentials='{"foo": "bar", "baroo": "baz"}' 
Error: render error in "chart/templates/secret.yaml": template: chart/templates/secret.yaml:11:66: executing "chart/templates/secret.yaml" at <b64enc>: wrong type for value; expected string; got []interface {}

It only works if I escape everything like this:

$ helm template ./chart --set-string googleServiceAccount.credentials='\{\"foo\": \"bar\"\, \"baroo\": \"baz\"\}'
---
# Source: chart/templates/secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: secret
  labels:
    app: applicatoin
    chart: chart
    heritage: Tiller
type: Opaque
data:
  credentials.json: "eyJmb28iOiAiYmFyIiwgImJhcm9vIjogImJheiJ9"

$echo eyJmb28iOiAiYmFyIiwgImJhcm9vIjogImJheiJ9 | base64 -d
{"foo": "bar", "baroo": "baz"}

But inside our CI pipeline I do not want to have some magical escaping on environment variables.

Other solutions would be to manually base64 encoded credentials and pass them as a environment variable. But since we're using b64enc for everything else, I'd like to stick to that habit.

Is there any way to achieve what I want, i.e. passing strings containing json to helm without helm performing some type conversion on them? Or is the "aggressively-escape-everything" solution the only one?

Thanks for your help and input on this! :)

Somewhat related issues: #1556 #3155

Output of helm version:
Client: &version.Version{SemVer:"v2.12.3", GitCommit:"eecf22f77df5f65c823aacd2dbd30ae6c65f186e", GitTreeState:"clean"}

I looked into issues and changelogs and it seems to me that there are no relevant changes made in higher versions.

[namelessvoid]

For now I'm using a workaround by passing unencoded json as environment variable and encoding it to base64 inside the pipeline script. Than the encoded string is passed to helm via --set.

However, our developers now have to know when to use b64enc in the helm chart (for everything that can be passed via --set/--set-string without complication) and when not (e.g. for json strings).

[bacongobbler]

I'm going to close this ticket due to inactivity, but please re-open if this still needs to be addressed. Thanks!

[jorgecarleitao]

I would say that this is still relevant: there is no way to pass json strings as values in helm without escaping the whole string.

Is this by design, or is an unintended feature? Specifically, helm trying to interpret strings as json, and having no way to "turn off" this behavior. It is not very obvious nor explicit.

[andrenarchy]

This is still an issue and isn't this a bug since --set-string should just take the string as is?

[JeroenVanOort]

I'm experiencing this same problem. I use --set-string to explicitly tell Helm to just process the string as-is, but either there's a bug with that or there's an undocumented design choice.

[christianhuening]

just found the same with helm 3.6.0. when passing a JSON via --set-string the result is an array where after each comma it cuts of the line and create a new array element. this is not what I would expect.

[bacongobbler]

There’s an open ticket requesting for a -set-literal flag, which would help with your use case. I’d search the ticket queue and follow that discussion.