使用 Shell 脚本在 ConfigMap 中创建 Secret

Question

我正在尝试使用以下命令从 ConfigMap 创建一个秘密：

apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ .Release.Name }}-single-ca-script
  labels:
    app.kubernetes.io/name: {{ include "couchbase-cluster.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    helm.sh/chart: {{ include "couchbase-cluster.chart" . }}
  annotations:
    "helm.sh/hook": pre-install
    "helm.sh/hook-weight": "-5"
    "helm.sh/hook-delete-policy": before-hook-creation
data:
  single-ca-script.sh: |
    #!/bin/bash
    kubectl create secret generic {{ include "couchbase-cluster.pki.secret.tls" . }}-trf \
      --from-file=chain.pem=/var/run/certs/tls.crt --from-file=pkey.key=/var/run/certs/tls.key
    WORKDIR=/tmp/
    cd $WORKDIR
    csplit -f ca_- /var/run/certs/ca.crt '/-----BEGIN CERTIFICATE-----/' '{*}'
    for x in `ls $WORKDIR/ca_*`; do
     echo "checking ca: $x"
     openssl verify -verbose -CAfile $x /var/run/certs/tls.crt
     if [[ $? -eq 0 ]]; then
      CORRECT_CA_FILE=$x
      break;
     fi
    done
    if [[ -z $CORRECT_CA_FILE ]]; then
     echo "NO correct CA file found"
     exit 99
    fi
    mv $CORRECT_CA_FILE $WORKDIR/ca.crt
    kubectl create secret generic {{ include "couchbase-cluster.pki.secret.tls" . }}-single-ca \
     --from-file=$WORKDIR/ca.crt

cat <<EOF | kubectl apply -f -\
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "couchbase-cluster.fullname" . }}
  labels:
  app.kubernetes.io/name: {{ include "couchbase-cluster.name" . }}
  app.kubernetes.io/instance: {{ .Release.Name }}
  app.kubernetes.io/managed-by: {{ .Release.Service }}
  helm.sh/chart: {{ include "couchbase-cluster.chart" . }}

但我遇到了错误

错误：YAML 解析错误 平台-couchbase-cluster/templates/configMap-single-ca.yaml：错误 将 YAML 转换为 JSON：yaml：第 39 行：找不到预期的“：”

如果我遗漏了什么，请告诉我吗？

谢谢

Answer 1

1. cat <<EOF | kubectl apply -f -\ 看起来不需要
2. labels: 后的秘密缩进被破坏