<p>I currently have a helm template for a deployment defined as</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo
  labels:
    {{- include &quot;demo.labels&quot; . | nindent 4 }}
    app.kubernetes.io/component: &quot;server&quot;
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      app.kubernetes.io/name: demo
      app.kubernetes.io/instance: {{ .Release.Name }}
      app.kubernetes.io/component: &quot;server&quot;
  template:
    metadata:
      {{- with .Values.deployment.annotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
</code></pre>
<p>For the annotations, it works fine as we can pass in annotations from our values.yml. However, now I also want to add in a set of vault annotations that have predefined values into the template:</p>
<pre><code>{{- if .Values.vault.enabled -}}
vault.hashicorp.com/agent-inject: {{ .Values.vault.enabled | quote }}
vault.hashicorp.com/agent-cache-enable: &quot;true&quot;
vault.hashicorp.com/agent-cache-use-auto-auth-token: &quot;force&quot;
vault.hashicorp.com/role: {{ .Values.vault.role | quote }}
vault.hashicorp.com/ca-cert: &quot;/run/secrets/kubernetes.io/serviceaccount/ca.crt&quot;
vault.hashicorp.com/agent-init-first: &quot;true&quot;
traffic.sidecar.istio.io/excludeOutboundPorts: &quot;8200&quot;
{{- $systemcontext := .Values.vault.systemcontext -}}
{{- $releasename := .Release.Name -}}
{{- range .Values.vault.secretkeys}}
{{- $secretpath := printf &quot;kv/%s/restricted/%s/%s&quot; $systemcontext $releasename . }}
{{- $annotatefilename := printf &quot;vault.hashicorp.com/agent-inject-secret-%s.yaml&quot; . }}
{{ $annotatefilename }}: {{ $secretpath }}
{{ $annotatefilename }}: |
  {{ printf &quot;%s%s%s&quot; `{{- with secret ` ($secretpath | quote) ` -}}{{ range $k, $v := .Data.data }}{{ $k }}: {{ $v }}
  {{ end }}{{- end -}}`}}
{{- end -}}
</code></pre>
<p>How can I define the template so that it can render both sets of annotations, even if vault.enabled=false, or deployment.annotations is of empty value?</p>
<p>Example our values.yml:</p>
<pre><code>deployment:
  annotations:
    test-annotation: &quot;hello world&quot;
    test2-annotations: &quot;foo&quot;

vault:
  enabled: true
  role: myrole
  systemcontext: &quot;foo&quot;
</code></pre>
<p>Thanks</p>

popopanda
<p>You can define the additional set of annotations as a named template, that emits <code>key: value</code> pairs, aligned at the first column.</p>
<pre class="lang-yaml prettyprint-override"><code>{{- define &quot;annotations.vault&quot; }}
{{- if .Values.vault.enabled -}}
vault.hashicorp.com/agent-inject: {{ .Values.vault.enabled | quote }}
...
{{ end -}}
{{ end -}}
</code></pre>
<p>Then when you need to use it, you can use the Helm <code>include</code> extension to invoke it.  This returns a string, and so you can combine it with <code>indent</code> to indent it appropriately.</p>
<p>Your original template code uses <code>with</code> to skip the <code>annotations:</code> block entirely if nothing is present, so you can use this same technique at the top level.  (You need to be careful that the template emits nothing, not even a new line, if the control is disabled.)</p>
<pre class="lang-yaml prettyprint-override"><code>metadata:
  labels: { as: above }
{{- with include &quot;annotations.vault . }}
{{- . | indent 4 }}
{{- end }}
</code></pre>
<p>Inside the pod spec, there are two possibly places the annotations could come from.  The easiest way to create a syntactically valid <code>annotations:</code> block is to include an artificial <code>key: value</code> pair:</p>
<pre><code>spec:
  template:
    metadata:
      annotations:
        _: '' # meaningless, but forces a YAML dictionary
{{- with .Values.deployment.annotations }}
{{- toYaml . | indent 8 }}
{{- end }}
{{- with include &quot;annotations.vault&quot; . }}
{{- indent 8 . }}
{{- end }}
</code></pre>
<p>Or, you could capture both annotation sets into variables, and do logic based on that.</p>
<pre><code>spec:
  template:
    metadata:
{{- $a := .Values.deployment.annotations }}
{{/*           if $a    then   (toYaml $a) else &quot;&quot; end */}}
{{- $manual :=    $a | ternary (toYaml $a)      &quot;&quot; }}
{{- $vault := include &quot;annotations.vault&quot; . }}
{{- $annotations := printf &quot;%s%s&quot; $manual $vault }}
{{- with $annotations }}
      annotations: {{- nindent 8 . }}
{{- end }}
</code></pre>
