Helm / Intermediate: authoring and lifecycle contracts / Lesson 10

Files, configuration and secret boundaries

Embed small packaged configuration safely while keeping templating, encoding, access control and application reload behavior distinct.

About 5 min readContent reviewed 2026-10-28

On this page

Lesson goals

Explain which files are available through the Files object.
Embed multiline configuration with deliberate indentation.
Separate base64 representation from secrecy and lifecycle ownership.

Understand packaged file access

The Files object reads eligible files already included in the chart. It is not a general filesystem reader and cannot pull arbitrary host files during rendering. Templates, ignored files and files outside an application subchart’s accessible boundary are not ordinary Files inputs. Place a tiny synthetic configuration asset under a deliberate path such as files/catalog.ini, then verify that packaging includes it. File access and file existence are different questions: a missing or excluded asset may yield empty content and still leave a plausible-looking ConfigMap. Add an explicit content contract instead of relying on visual familiarity.

Embed multiline content

A YAML block scalar allows a text file to become one ConfigMap data value. The indicator |- keeps line breaks inside the content while stripping the final newline. nindent aligns every file line under that scalar. The first fragment assumes the file contains only synthetic nonsecret settings and that a surrounding ConfigMap supplies metadata. The application still needs to understand the embedded INI syntax. Valid outer YAML cannot establish that an inner configuration file is valid. When both formats matter, review the embedded bytes and the receiving application contract separately.

gotemplate ConfigMap data fragment

data:
  catalog.ini: |-
    {{- .Files.Get "files/catalog.ini" | nindent 4 }}

For a file containing mode=demo followed by pageSize=5, both lines belong to one string value. The chart fragment was not rendered.

Treat tpl as template evaluation

Files.Get returns content without evaluating embedded template syntax. The tpl function can evaluate a supplied string as a template using a chosen context, but that changes the trust boundary: configurable text becomes code-like template input. Do not apply tpl automatically to arbitrary user-controlled configuration. Review which functions and objects become available and whether the application actually needs dynamic generation. For a small static catalog settings file, literal inclusion is simpler and easier to reproduce. If templating is necessary, document the accepted syntax and test failures deliberately rather than letting untrusted expressions surprise consumers.

Encoding is not confidentiality

Kubernetes Secret data uses base64 representation; base64 does not encrypt the value. The second example encodes and decodes the word synthetic entirely in memory, proving how reversible the representation is. Real confidentiality depends on access control, transport, storage protection, exposure in release records and operational practices. Never embed real credentials in a public chart or print them in debug output. An existingSecret input can separate application references from secret creation, but it does not grant the workload permission to read a Secret or guarantee that the referenced object exists in the target namespace.

python Reversible synthetic encoding

import base64
text = "synthetic"
encoded = base64.b64encode(text.encode()).decode()
print(encoded)
print(base64.b64decode(encoded).decode())

Expected output

c3ludGhldGlj
synthetic

The program uses no credentials. Decoding recovers the original public word, illustrating why encoding is not encryption.

Design update and reload contracts

A changed ConfigMap does not automatically mean every application process reads new settings. Environment variables are captured at process start, mounted-file behavior has its own update timing and an application may cache configuration. A Pod-template checksum can trigger a rollout when packaged configuration changes, but it does not validate the new content or protect availability by itself. State whether the chart expects restart, live reload or external configuration management. Also keep packaged files small and review object and release storage limits; Helm charts are not a distribution mechanism for large datasets or binary application bundles.

Common errors and fixes

A packaged settings file is empty at render time

Why it happens: The path is wrong or the asset was excluded from the chart.
How to fix it: Inspect the reviewed package and correct the file contract before changing application code.
Prevent it next time: Validate expected file presence and nonempty synthetic content.

Base64 data is treated as a safe public secret

Why it happens: Encoding was confused with encryption and access control.
How to fix it: Remove real credentials and use a separately authorized secret-management design.
Prevent it next time: Use synthetic values and review release/debug exposure paths.

Configuration changes but the process keeps old settings

Why it happens: The chart lacked a documented reload or restart mechanism.
How to fix it: Align the application reload behavior and Pod-template change strategy.
Prevent it next time: Include configuration propagation in application acceptance criteria.

Check your understanding

1. A value contains {{ .Release.Name }} inside an included file. Does Files.Get evaluate it?

Show worked solution

No. Files.Get returns literal file content. Evaluation requires an intentional tpl call with a supplied context, which expands the input’s trust and complexity. First ask whether the application needs dynamic text at all. Literal inclusion may be the safer, clearer contract, especially when configuration is user supplied or must reproduce exactly across reviews.

2. Why can an existingSecret reference still fail although the chart renders successfully?