<p>How to force to specify --set option on <code>helm install|upgrade</code>?</p>

<p>in my case, some required environment variables. (e.g. "database.password")</p>

<p><strong>Files</strong></p>

<pre><code>.
|-- Chart.yaml
|-- templates
|   |-- NOTES.txt
|   |-- _helpers.tpl
|   |-- deployment.yaml
|   |-- ingress.yaml
|   |-- secret.yaml
|   `-- service.yaml
`-- values.yaml
</code></pre>

<p><strong>values.yaml (snip)</strong></p>

<pre><code>#...
database:
  useExternal: no
  host: "pgsql"
  port: "5432"
  name: "myapp"
  userName: "myapp_user"
  # password shouldn't write here.
  # I want to be inject this value to secret.
  password: ""
#...
</code></pre>

<p><strong>templates/secrets.yaml</strong></p>

<pre><code>apiVersion: v1
kind: Secret
metadata:
  name: myapp-secrets
type: Opaque
data:
  app-database-password: {{required .Values.database.password | b64enc | quote }}
</code></pre>

<p><strong>templates/deployment.yaml (snip)</strong></p>

<pre><code>#...
env:
  - name: APP_DATABASE_HOST
    value: {{ .Values.database.host | quote }}
  - name: APP_DATABASE_PORT
    value: {{ .Values.database.port | quote }}
  - name: APP_DATABASE_NAME
    value: {{ .Values.database.name | quote }}
  - name: APP_DATABASE_USERNAME
    value: {{ .Values.database.username | quote }}
  - name: APP_DATABASE_PASSWORD
    valueFrom:
      secretKeyRef:
        name: myapp-secrets
        key: app-database-password
#...
</code></pre>

<p><strong>command</strong></p>

<pre><code># Retrieve from GCP KMS(prod) or define directly(dev)
DATABASE_PASSWORD=$( ... )

# Deploy.
helm upgrade --install \
  -f ./values.yaml \
  --set database.password=$DATABASE_PASSWORD \
  myapp-dev ./ --dry-run --debug
</code></pre>

<p>It's failed with error.</p>

<pre><code>Error: render error in "myapp/templates/secret.yaml": template: myapp/templates/secret.yaml:7:28: executing "myapp/templates/secret.yaml" at &lt;required&gt;: wrong number of args for required: want 2 got 1
</code></pre>

<p>It seems the <code>required</code> function is evaluate template file statically when parsing.</p>

<p>I need matters below:</p>

<ul>
<li><code>database.password</code> is switchable by env such as "prod" or "stage".</li>
<li><code>database.password</code> should store to secret.</li>
<li>I want to set the actual <code>database.password</code> value using env vars on command execution.</li>
</ul>

<p>Any ideas?</p>

hidekuro
<p>The Helm-specific <code>required</code> macro <a href="https://docs.helm.sh/developing_charts/#know-your-template-functions" rel="nofollow noreferrer">takes two parameters</a>: the error message if the value isn't present, and the value that you're checking for.  This syntax also lets it be used in pipeline form.  In your example, the secret value could be</p>

<pre><code>app-database-password: {{.Values.database.password | required "database password is required" | b64enc | quote }}
</code></pre>
