<p>I have defined value in a json file.</p>

<pre><code>cat templates/encrypt.json
{"encrypt": "cg8StVXbQJ0gPvMd9o7yrg=="}
</code></pre>

<p>The value has to be passed to the yaml file as below</p>

<pre><code>-config-file={{ tpl (.Files.Get "encrypt.json") . | b64enc }}  \
</code></pre>

<p>Below is the helm chart snippet</p>

<pre><code>exec /bin/consul agent \
            -node="${NODE}" \
            -advertise="${POD_IP}" \
            -bind=0.0.0.0 \
            -client=0.0.0.0 \
            {{- if .Values.client.grpc }}
            -hcl="ports { grpc = 8502 }" \
            {{- end }}
            -config-dir=/consul/config \
            {{- range .Values.client.extraVolumes }}
            {{- if .load }}
            -config-dir=/consul/userconfig/{{ .name }} \
            {{- end }}
            {{- end }}
            -datacenter={{ .Values.global.datacenter }} \
            -data-dir=/consul/data \
            -config-file={{ tpl (.Files.Get "encrypt.json") . | b64enc }}  \
            {{- if (.Values.client.join) and (gt (len .Values.client.join) 0) }}
</code></pre>

<p>When I run my health charts, I get the below error.</p>

<pre><code>Error: unable to decode "": Object 'Kind' is missing in '{"encrypt":"cg8StVXbQJ0gPvMd9o7yrg=="}'
</code></pre>

<p>What you're injecting with <code>{{ tpl (.Files.Get "encrypt.json") . | b64enc }}</code> is the content of the json i.e. <code>{"encrypt": "cg8StVXbQJ0gPvMd9o7yrg=="}</code>. But I don't think that is what that parameter expects. It seems to expect a filename for a file that should be available in the Pod, which can be done by mounting the configmap. That is <a href="https://github.com/helm/charts/blob/735b3cc5079c599738e5a4cb0aaab4183018177d/stable/consul/templates/consul-statefulset.yaml#L115" rel="nofollow noreferrer">how the consul helm chart in the official kubernetes charts handles it</a>:</p>

<pre><code>            {{- if .Values.Gossip.Encrypt }}
            if [ -e /etc/consul/secrets/gossip-key ]; then
              echo "{\"encrypt\": \"$(base64 /etc/consul/secrets/gossip-key)\"}" &gt; /etc/consul/encrypt.json
              GOSSIP_KEY="-config-file /etc/consul/encrypt.json"
            fi
            {{- end }}
</code></pre>

<p>It <a href="https://github.com/helm/charts/blob/d18382c23dbe20d668a9af908604056866895e99/stable/consul/values.yaml#L55" rel="nofollow noreferrer">lets the user set a gossip key in the values file</a> and <a href="https://github.com/helm/charts/blob/f49709ff52dc25f7772f6a9baefbf784e734a359/stable/consul/templates/gossip-secret.yaml#L13" rel="nofollow noreferrer">sets that in a secret</a> which is <a href="https://github.com/helm/charts/blob/f49709ff52dc25f7772f6a9baefbf784e734a359/stable/consul/templates/consul-statefulset.yaml#L93" rel="nofollow noreferrer">mounted into</a> the Pods <a href="https://github.com/helm/charts/blob/f49709ff52dc25f7772f6a9baefbf784e734a359/stable/consul/templates/consul-statefulset.yaml#L167" rel="nofollow noreferrer">as a volume</a>. I'd suggest following the approach of that chart if you can.</p>

<p>I guess what you are doing is building on top of <a href="https://github.com/hashicorp/consul-helm/blob/7c9eb5c90b6efd66bfe8a8fb70f92f7bb33a7e36/templates/client-daemonset.yaml#L75" rel="nofollow noreferrer">the consul helm chart that Hashicorp provides</a> as the code you include is similar to that. So presumably you can't use the one from the kubernetes repo but you should be able to follow the approach taken by that chart for this config file.</p>
