helm random secret with persistence and optional override

helm-secret-lookup-manual.yaml

{{- if empty .Values.manualSecretName }}
apiVersion: v1
kind: Secret
metadata:
  name: "jwt-secret"
  annotations:
    "helm.sh/resource-policy": "keep"
type: Opaque
data:
  # retrieve the secret data using lookup function and when not exists, return an empty dictionary / map as result
  {{- $secretObj := (lookup "v1" "Secret" .Release.Namespace "jwt-secret") | default dict }}
  {{- $secretData := (get $secretObj "data") | default dict }}
  # set $jwtSecret to existing secret data or generate a random one when not exists
  {{- $jwtSecret := (get $secretData "jwt-secret") | default (randAlphaNum 32 | b64enc) }}
  jwt-secret: {{ $jwtSecret | quote }}
{{- end }}