fix: Allow annotation templates for services that need them

traefik/templates/_podtemplate.tpl

@@ -3,7 +3,11 @@
     metadata:
       annotations:
       {{- if .Values.deployment.podAnnotations }}
-        {{- tpl (toYaml .Values.deployment.podAnnotations) . | nindent 8 }}
+        {{- if .Values.deployment.templateAnnotations }}
+          {{- tpl (toYaml .Values.deployment.podAnnotations) . | nindent 8 }}
+        {{- else }}
+          {{- toYaml .Values.deployment.podAnnotations | nindent 8 }}
+        {{- end }}
       {{- end }}
       {{- if .Values.metrics }}
       {{- if and (.Values.metrics.prometheus) (not (.Values.metrics.prometheus.serviceMonitor).enabled) }}

traefik/tests/deployment-config_test.yaml

@@ -89,6 +89,33 @@ tests:
       - equal:
           path: spec.template.metadata.annotations.traefik/type
           value: 'internal'
+  - it: should error when annotations themselves contain a template
+    set:
+      deployment:
+        podAnnotations:
+          vault.hashicorp.com/agent-inject-template-test: |
+            {{- with secret 'kv/data/path/to/secret' -}}
+            {{ index .Data.data "secret" }}
+            {{- end }}
+    asserts:
+      - failedTemplate:
+          errorPattern: "[cannot parse template]+"
+  - it: should not error when templated annotations have templating disabled
+    set:
+      deployment:
+        podAnnotations:
+          vault.hashicorp.com/agent-inject-template-test: |
+            {{- with secret 'kv/data/path/to/secret' -}}
+            {{ index .Data.data "secret" }}
+            {{- end }}
+        templateAnnotations: false
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations["vault.hashicorp.com/agent-inject-template-test"]
+          value: |
+            {{- with secret 'kv/data/path/to/secret' -}}
+            {{ index .Data.data "secret" }}
+            {{- end }}
   - it: should have labels with specified values
     set:
       deployment:

traefik/values.yaml

@@ -51,6 +51,8 @@ deployment:
   # -- Additional pod annotations (e.g. for mesh injection or prometheus scraping)
   # It supports templating. One can set it with values like traefik/name: '{{ template "traefik.name" . }}'
   podAnnotations: {}
+  # -- Whether or not to run tpl function for annotations
+  templateAnnotations: true
   # -- Additional Pod labels (e.g. for filtering Pod by custom labels)
   podLabels: {}
   # -- Additional containers (e.g. for metric offloading sidecars)