Unable to enforce (single) quote around yml string value

[tormodmacleod]

Terraform, Provider, Kubernetes and Helm Versions

$ terraform -v
Terraform v1.4.6
on linux_amd64
+ provider registry.terraform.io/gavinbunney/kubectl v1.14.0
+ provider registry.terraform.io/hashicorp/aws v4.67.0
+ provider registry.terraform.io/hashicorp/cloudinit v2.3.2
+ provider registry.terraform.io/hashicorp/helm v2.11.0
+ provider registry.terraform.io/hashicorp/http v3.4.0
+ provider registry.terraform.io/hashicorp/kubernetes v2.19.0
+ provider registry.terraform.io/hashicorp/time v0.9.1
+ provider registry.terraform.io/hashicorp/tls v4.0.4

Affected Resource(s)

• helm_release

Terraform Configuration Files

resource "helm_release" "newrelic_infrastructure" {
  name      = "newrelic-infrastructure"
  namespace = "newrelic-infrastructure"

  repository = "https://newrelic.github.io/nri-kubernetes"
  chart      = "newrelic-infrastructure"
  version    = "3.25.0"

  # this value was added just to allow creation using dummy values
  wait = false

  dynamic "set" {
    for_each = {
      "cluster"                                                  = "my-cluster"
      "integrations.redis.integrations[0].name"                  = "nri-redis"
      "integrations.redis.integrations[0].env.HOSTNAME"          = "replica.my-redis-cluster.cache.amazonaws.com"
      "integrations.redis.integrations[0].env.PORT"              = 6379
      "integrations.redis.integrations[0].env.REMOTE_MONITORING" = true
      "integrations.redis.integrations[0].env.USE_TLS"           = true
    }
    content {
      name  = set.key
      value = set.value
    }
  }

  dynamic "set_sensitive" {
    for_each = {
      "licenseKey"                                      = "newrelic-license-key"
      "integrations.redis.integrations[0].env.PASSWORD" = "redis-password"
      "integrations.redis.integrations[0].env.USERNAME" = "redis-username"
    }
    content {
      name  = set_sensitive.key
      value = set_sensitive.value
    }
  }

  set {
    name  = "integrations.redis.integrations[0].env.KEYS"
    value = "'something'"
    type  = "string"
  }
}

Debug Output

NOTE: In addition to Terraform debugging, please set HELM_DEBUG=1 to enable debugging info from helm.

https://gist.githubusercontent.com/tormodmacleod/9aaaa64610858c3298f89c57014b2c37/raw/5e5cb78f8acfc5917b16a51b889e15c29b35f2d5/debug.txt

Panic Output

Steps to Reproduce

1. terraform apply -var-file ../../configs/${ENVIRONMENT}/${STACK}.tfvars -var environment=${ENVIRONMENT} -var project=${PROJECT} -target helm_release.newrelic_infrastructure

Expected Behavior

$ kubectl -n newrelic-infrastructure get configmaps newrelic-infrastructure-nrk8s-integrations-cfg -o yaml | grep KEYS
        KEYS: 'something'

Actual Behavior

$ kubectl -n newrelic-infrastructure get configmaps newrelic-infrastructure-nrk8s-integrations-cfg -o yaml | grep KEYS
        KEYS: '''something'''

Important Factoids

i've tried many of the things that @t638403 did in #341. i've tried to see whether we really need to wrap this in single quotes and it seems we do. when you remove the quotes it doesn't connect to redis

see example of how to set the KEYS value here

for what it's worth, it's retained correctly in the state

$ terraform state show helm_release.newrelic_infrastructure | grep KEYS
                                        KEYS              = "'something'"

i can work around this by using a values.yaml file with the KEYS set within that. i can automate this by running sed against it before i run terraform but i'd really like to not have to maintain values.yaml.

i think there ought to be a way to control the behaviour of the provider when it encounters single quotes. helm's own documentation suggests using two '' but this doesn't work either

when i set KEYS as

  set {
    name  = "integrations.redis.integrations[0].env.KEYS"
    value = "''something''"
    type  = "string"
  }

i get

$ kubectl -n newrelic-infrastructure get configmaps newrelic-infrastructure-nrk8s-integrations-cfg -o yaml | grep KEYS
        KEYS: '''''something'''''

Single-quoted strings are "literal" strings, and do not use the \ to escape characters. The only escape sequence is '', which is decoded as a single '.

i should point out that i am trying to end up with the value as json within single quotes. i can achieve this using a --set parameter with the helm command as below

$ helm install -n newrelic-infrastructure tormod ./newrelic-infrastructure/ --set integrations.redis.integrations[0].env.KEYS='\{"2":["something"]\}'

$ kubectl -n newrelic-infrastructure get configmaps tormod-nrk8s-integrations-cfg -o yaml | grep KEYS
        KEYS: '{"2":["something"]}'

References

• Unable to enforce (single) quote around yml string value #341
• Unable to enforce (single) quote around yml string value terraform#22847

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[BBBmau]

Thank you for opening this issue @tormodmacleod, I attempted this myself since the first thing that came to mind was adding an escape character to ' since it's required to add that due to the helm parser and for it to also be parsed by Terraform. However after adding it the same error still appears. This will need some more investigation due to determine why this is happening.

This is what I refer to by the double escape:

  set {
    name  = "integrations.redis.integrations[0].env.KEYS"
    value = "\\'something\\'"
    type  = "string"
  }