Terraform Helm: How to add sqlproxy Container with values

[sp71]

I want to attach the sqlproxy as a sidecar container to the keto release. Below is my initial attempt. The documentation for keto showed it offers a deployment:extraContainers field where I can set the name and the image for a container; however, unsure how to pass the additional values needed for sqlproxy configuration (e.g. cloudsql.instances)

locals {
  db_username = "postgres"
  sql_port = "5432"
}

resource "helm_release" "keto" {
  name       = "ory"
  repository = "https://k8s.ory.sh/helm/charts"
  chart      = "keto"

  values = [
    <<EOT
    serviceAccount:
      create: false
      name: ${module.service_account.value.id}
    job:
      serviceAccount:
        create: false
        name: ${module.service_account.value.id}
    keto:
      config:
        dsn: postgres://${local.db_username}:${random_password.password.result}@pg-sqlproxy-gcloud-sqlproxy:${local.sql_port}/db
    deploy:
      extraContainers:
        name: gcloud-sqlproxy
        image: # what to place here? how to add extra values here?
    EOT
  ]
}

[sp71]

You can pass any YAML to extraContainers. Here's an example with cloudsql-proxy sidecar containers

      extraContainers: |
        - name: cloud-sql-proxy
          image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.2.0
          imagePullPolicy: Always
          args:
          - "--structured-logs"
          - "--health-check"
          - "--http-address=0.0.0.0"
          - "--port=5432"
          - "--private-ip"
          - <INSTANCE>
          securityContext:
            runAsNonRoot: true
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
          livenessProbe:
            httpGet:
              path: /liveness
              port: 9090
            initialDelaySeconds: 0
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 2
          readinessProbe:
            httpGet:
              path: /readiness
              port: 9090
            initialDelaySeconds: 0
            periodSeconds: 10
            timeoutSeconds: 5
            successThreshold: 1
            failureThreshold: 2
          startupProbe:
            httpGet:
              path: /startup
              port: 9090
            periodSeconds: 1
            timeoutSeconds: 5
            failureThreshold: 20
          resources:
            requests:
              memory: 128Mi
              cpu: 50m
            limits:
              memory: 512Mi
              cpu: 250m

Did the same for job.extraContainers