Template k8s manifest with yq

sopssecret-cert-template.txt

$  cat /tmp/cert.pem                                                                           
-------BEGIN CERTIFICATE-------
asdoqijepoqjwe1i49i120941p2j4omslasdajsdqweqwe
qwelqjwkasdlajsölkjasldkjakljsdlkjasdasdpiqwe
-------END CERTIFICATE--------

$ CERT=$(cat /tmp/cert.pem)

$  cat /tmp/test0.yaml                                                                
apiVersion: isindir.github.com/v1alpha2
kind: SopsSecret
metadata:
  name: apigw-client-cert-sops-secret
  namespace: traefik
spec:
  secretTemplates:
    - name: apigw-client-cert
      labels:
        monitor-cert: true
      data:
        tls.crt: |
          xxx
        tls.key: |
          yyy
      type: Opaque

$  yq  '(.spec.secretTemplates[0].data."tls.crt" |= "'"$(< /tmp/cert.pem)"'") | (.spec.secretTemplates[0].data."tls.key" |= "'"${CERT}"'")' /tmp/test0.yaml

apiVersion: isindir.github.com/v1alpha2
kind: SopsSecret
metadata:
  name: apigw-client-cert-sops-secret
  namespace: traefik
spec:
  secretTemplates:
    - name: apigw-client-cert
      labels:
        monitor-cert: true
      data:
        tls.crt: |-
          -------BEGIN CERTIFICATE-------
          asdoqijepoqjwe1i49i120941p2j4omslasdajsdqweqwe
          qwelqjwkasdlajsölkjasldkjakljsdlkjasdasdpiqwe
          -------END CERTIFICATE--------
        tls.key: |-
          -------BEGIN CERTIFICATE-------
          asdoqijepoqjwe1i49i120941p2j4omslasdajsdqweqwe
          qwelqjwkasdlajsölkjasldkjakljsdlkjasdasdpiqwe
          -------END CERTIFICATE--------
      type: Opaque