 Getting "map has no entry for key" for some secrets files when using kms encryption #2179 

### Operating system

Ubuntu 18.04.6 LTS

### Helmfile Version

0.155.1

### Helm Version

3.12.3

### Bug description

I have a project with the following hierarchy:

```
home/
    realm/
        namespaces/
            _defaults.yaml
            myNs/
                services/
                    my-release.yaml    
        values/
            env/
                myEnv/
                    secrets.yaml
                    values.yaml


```
I'll also list all the file contents:

**my-release.yaml**:
```
bases:
  - ../../_defaults.yaml

values:
  - app: kafka

---
templates:

  kafka: &kafka
    chart: bitnami/kafka
    installed: true

releases:
  - name: kafka
    <<: *kafka
```

**_defaults.yaml**:

```
# Default values to set for args along with dedicated keys that can be set by contributors, cli args take precedence over these.
# In other words, unset values results in no flags passed to helm.
# See the helm usage (helm SUBCOMMAND -h) for more info on default values when those flags aren't provided.
helmDefaults:
  args:
    - "--no-hooks"
    - "-amonitoring.coreos.com/v1"

values:
  - aDependentValue: "{{.Values.myValue}}"

environments:
  myEnv:
    values:
      - ../../../values/env/myEnv/values.yaml
    secrets:
      - ../../../values/env/myEnv/secrets.yaml
```

**secrets.yaml**:

```
masked1:
    masked2: ENC[ALGO,data:cK4ZmQSgTgj8oQ==,iv:by/uT7RpJmEfmGkO7wmbDs2ggqQ+ls2HKG/4vGwl/jI=,tag:/tMnx5j8KuXjetT5deBe2A==,type:str]
    masked3: ENC[ALGO,data:LaYO5CVGEHkEbw==,iv:G+wpY9XQWf7tHtmvpkY0NN9J4t9KfMzWolsVStroJJ0=,tag:DTPefE51Y4i3l+EERIZPoQ==,type:str]
masked4:
    masked5: ENC[ALGO,data:XsDrre91e9lq2A==,iv:CSe9BpQ1bJpMk5KOgBAHazU/Hmn1CKnW6juc3vS3NfA=,tag:p2WTTE8vEEW21WyMl90T2A==,type:str]
    masked6: ENC[ALGO,data:c2ZG4JOuc5btvw==,iv:kA+JYIa1nBd/Vme7Fw9kHP3os4NFxrBnhi0jU0oklxM=,tag:NN+6SrJe2Kq3wc61EIcduw==,type:str]
    masked7: ENC[ALGO,data:I08MC73n59d0QA==,iv:lbTEdLkFzJSYcqNPPkDf4EoAuAhftETSG6Ji47h6hr0=,tag:zhWxW5i8En8ODBTGdaVE/Q==,type:str]
    masked8: ENC[ALGO,data:6HK8C0KOeSZ9CQ==,iv:cLQpyP+/AhJhIDFT+doxgsqg4D+cuUGMYapim3dwB+o=,tag:BqbjvX5pKpuo0FT5gsD4SQ==,type:str]
masked9:
    masked10: ENC[ALGO,data:sTy0rzPQOTFlFg==,iv:qjyuc7UItp2ofdRI6RowxoxI3/cF79So+Xkl5qoV8zQ=,tag:4mL9K0tI3VQVdL7wjSLedg==,type:str]
    masked11:
        masked12: ENC[ALGO,data:YmaMc1TNSAzLIg==,iv:h5xyOs17r6u1UD4W7ZP1cdnwSeTJQp2FKLUaPAXL/mE=,tag:TtBOFt0rcCGsjA6YKOshZQ==,type:str]
        masked13: ENC[ALGO,data:zi/Z4WYOPw1ixQ==,iv:82fzUBL4qwHUQOuGOiX00TWQ9DBqqIrh8I8Nw+qVf2I=,tag:nVoiFaaZosBcHrJ+XFdNSQ==,type:str]
        masked14: ENC[ALGO,data:9+dp1gTtBxFmcA==,iv:Fj6SH8m8l943XIs6SrFCheGzvSAN+xj7XLM+Is5eu58=,tag:NKNcjh2r2NEVlh1ty0I2Xg==,type:str]
        masked15: ENC[ALGO,data:ETiLj1qr2ytbew==,iv:d6sKAg6W8gDCrwYaaeRrCCtL+/BzTStgfbRiog+i2Jw=,tag:5sLCpDzq6j7JV1/VK/Rc7w==,type:str]
        masked16: ENC[ALGO,data:cfbH1OFt+DUxmw==,iv:KkLXeUgOwficKp6ApDFEhOMV5oRgjmaWqIe/m4UDG3I=,tag:az3wjW4obmaObijHX49r9g==,type:str]
        masked17: ENC[ALGO,data:Iu0vbTi3JgNszQ==,iv:w2vaRXTg2orEjqkOWnMNzIDBV6b1yc1or6KKN5tP0gY=,tag:AD5lYi1tFT5SL7LYk9CKmg==,type:str]
        masked18: ENC[ALGO,data:y0hyajRhUhgNmA==,iv:EyVNAz6WpvsooE8F6N06U3dIbEh2SKPBd/47DXWFhwY=,tag:suwXMhuABn8PRE9w8q8tjw==,type:str]
        masked19: ENC[ALGO,data:ZP6r4kqnKmus9g==,iv:UwfQRPXDArGoVE686LrvfVSAtya9nhVBazmR4SBzAuc=,tag:/OJd+hFu03ybh2jxmsOSgw==,type:str]
        masked21: ENC[ALGO,data:WixZEiA/JIJzlQ==,iv:lDY1YaV+jRmLF0kyZXvR8C4wOVdYp8tb8gJZ5n/9kLc=,tag:CACev7n200Z/qSe3QpvNCA==,type:str]
        masked22: ENC[ALGO,data:Wek6uyoZlflXyQ==,iv:Qc3uU20JakpC/7HRE01fixivoJdYxsrC6Ah0FSxr84Q=,tag:NSaHRBfC7xKyUk1tMggZhg==,type:str]
        masked23: ENC[ALGO,data:w1OfKXyl6eSgyg==,iv:vON4cGRG0PxTcv3K7MFsDInhaZVdmACv4VX7oB3EGBM=,tag:yXD0rj2xGQVvui8iZix+yg==,type:str]
        masked24: ENC[ALGO,data:dT25v9yjz5HeNg==,iv:k5rADTorf6RYQOCujVq6LNvyXABZJLCEYq59AEKXwG0=,tag:1Z9ac+bpyRd8I55qOJ2n7A==,type:str]
        masked25: ENC[ALGO,data:Tn4DKQ8FUfFbOA==,iv:04B82391g+m31mMiBWkv0vAyv4z2mrvKbwqvVcNfcfE=,tag:mIX0rw9HK+XPHvWRk3Edjw==,type:str]
        masked26: ENC[ALGO,data:DIMWVL3cAELiew==,iv:ArHV8VtwICiQqQprhLd3tLYzOobSnmO/bBv0ZITu83I=,tag:rRtoS32bJ7sZFGorA2isJQ==,type:str]
        masked27: ENC[ALGO,data:ztKiYqUu3i2rvA==,iv:UzlBiqgdFLhu6y8QUXZYZpr7Etbpd6vhMpZzRM0n7e0=,tag:j0ap5ljF6ojMO61C0GZN8w==,type:str]
masked28: ENC[ALGO,data:CPW61IFMUVjh5Q==,iv:60ZU3MOluF+eNcJQs3MtvO9UBcbrzgz5rh6QNQWxLEM=,tag:VGFVb4ZhJLtjIxeHvAsRsw==,type:str]
masked29: ENC[ALGO,data:6zmAhRyqaJ1MCg==,iv:04DlWbgXbnyx/1dan/YzYTNRNBZiNyj7bxWlXJVMYhg=,tag:Fko4cVf/36wehGqc+/CZQQ==,type:str]
masked30: ENC[ALGO,data:Pwda1iE8daOQ4g==,iv:sQJMCV1ZTzYddEQymXl/fWzJRiu3xnWawRgvole4G5k=,tag:g64dRvLySFZjmZpIqwGOQA==,type:str]
masked31: ENC[ALGO,data:UvCxkFgWdKl9cw==,iv:8N8rT5xYtEtUNPEXAGbCc1331xLUBl0nx8bixkCsKcg=,tag:mTA9MOqsq8GvIq8hZOLa8A==,type:str]
masked32: ENC[ALGO,data:t1cg6n8UHijIow==,iv:BxFRHUhbthFkuRcfwmED/gsfarAVtsc5626g6XwYjbI=,tag:fbSWz9Alfdn9dKwGsKw5iw==,type:str]
masked33: ENC[ALGO,data:alZf6WF8sBjcVg==,iv:JsW0lCC5IY4wJWTnthRQiH/z2aKXSW+G7SEe/DklACE=,tag:lwFewnFSyxKoq7N53AvY2Q==,type:str]
masked34: ENC[ALGO,data:xqpA2ew6JEfHTQ==,iv:l8Rghm3c0YBrQCKR6hJznN8HbgiqaekMQUZec2NXsak=,tag:JdD8+E2lz5h7VhdxstCzQw==,type:str]
masked35: ENC[ALGO,data:v+BdD1WSoDihCA==,iv:inI9Okl/YqdgpTD6lvwvcfY7O6wAqPIx6CHNrMv9YqU=,tag:2+syJcxiLEFkF1H5yHc7tA==,type:str]
masked36: ENC[ALGO,data:lmZttJLasGO0lg==,iv:AqKUVX7W/0U1UKGGknPe8hxlulqey6mopMgUb8Hv/y8=,tag:K2+mHsi/zwAEFfSTeYhL5A==,type:str]
masked37: ENC[ALGO,data:ieY1iO9D3nQ3kg==,iv:TFWNIwI07rWHd8u09xffj9uTQpdQoim+FPP1d4uD54o=,tag:wdwS7DIh0JAYjEtjidj8Ng==,type:str]
masked38: ENC[ALGO,data:CNlRuEAjJMAizg==,iv:HXjhlY4sSC1iWk9jbj7MKhAG/kGpgXb9QCxpm4IQdGU=,tag:asMagURqmFTFByNVVZWXFQ==,type:str]
masked39: ENC[ALGO,data:AG793poXNqNAJg==,iv:1rAfjicAb54bWLci0/qe5Rijlpp+q6mzUCL7zeg68UI=,tag:IUIs/S3zOQvh10dLmoYjDg==,type:str]
masked40:
    masked41: ENC[ALGO,data:muhqH6ulwkmqYA==,iv:/z2Npzf4ytsPkp1xQKyo6zatQNemOuS44OOqMmQFHpQ=,tag:AOhVdtKpqLALYFoTb3kf8A==,type:str]
    masked42: ENC[ALGO,data:+4WbReIux3xOTg==,iv:dBfTtk/NXZiNnoyEZgwheMLBOxKHNS389K5WyRk6Hwg=,tag:nRYsUo78Xu6Ut1OuviCnvg==,type:str]
    masked43: ENC[ALGO,data:a9pYMEhwf7HLaw==,iv:0lVZ16VV+kzCjRZBzqN/4T/XRf7kyS+JS0NkkTfhUeQ=,tag:qcMNGmohcz0YpQw6/SRjHQ==,type:str]
    masked44:
        masked45: ENC[ALGO,data:mXuvDN3fWL1QvQ==,iv:q9rVRNr0hjuJ+P2jeRSt5a+kGznO0ry2sV2NOv+hTuQ=,tag:FbFD90fSTRINYZgXmds5fA==,type:str]
masked46:
    masked47: ENC[ALGO,data:msi2jtYP5Y7ZMw==,iv:fWKBpYKdm2aVCpTJUMY5VRscaC+VNTVo3yfrubB9IpI=,tag:IflQjQ/0sKiPyQ142YDU6A==,type:str]
    masked48: ENC[ALGO,data:w7/dbw7AhnHQRw==,iv:V37H3epINsMfF/kdp28/7DoG+mvMbpyxC6saD+qZtJo=,tag:+UFX3+f3XWqWtbFMWTCC2w==,type:str]
    masked49: ENC[ALGO,data:+JDf/5/Un+ymZQ==,iv:EgHpNjzRhv+qbY4+lXMTPG11vsRuHh3m2WqmfjfXOHQ=,tag:sRwTSwGPPyc+MKB9DBaI2A==,type:str]
    masked50: ENC[ALGO,data:w7O/ZhE1QuJ1rQ==,iv:O2h90SIlsvIwNFqHXxtZwW7l7thQRGB41cb5YrReI0o=,tag:okBiH9ulUFAiXrFs5IqlqA==,type:str]
    masked51: ENC[ALGO,data:YxFcXJF9n0Zs5g==,iv:i8u2jyHUxQ6GfmG/1aZpemZc80ylDHol90xO5VIf5fg=,tag:TzUp+0Cq+/hZCMVbwXpALQ==,type:str]
    masked52: ENC[ALGO,data:C7uID5H+wXf8Jg==,iv:uVsLpZKKCUjz4EpFcQC9O9O+EbYi/uk4z2M6wZ64IaA=,tag:0VHI2YO4F8EsCig+gwHeDQ==,type:str]
masked53:
    masked54: ENC[ALGO,data:NfUvXYcIGIsX3w==,iv:7qSS4Pq/6bgiMPNpIPTT8Zadz+Z3Rjt9Gqd35+lJIXQ=,tag:h3KGF424rB/GhCvPORJtfQ==,type:str]
    masked55: ENC[ALGO,data:PPBeIyHPv6MsNA==,iv:hJL23KsrvcBLKsUFU3BRvLHh2GpZ1s31B6obTax4rPc=,tag:CZ4bnjdIDD9mWOpRIA1tlA==,type:str]
    masked56: ENC[ALGO,data:CwKaOZ/PCiQMlQ==,iv:KO8GAxVYPRa1ZaY/M6vkvOIsMfx7+jPa2yxKPq9iW3Y=,tag:2AWd68Ll//vXOV6WKdDeLw==,type:str]
    masked57: ENC[ALGO,data:/NUOl4L10gGRCA==,iv:PwGi1/m0EZkcrpEVS19l+XGY4M/jun+6QqanUSSzIZ4=,tag:5okxhOCEvOj4mNlTPOfIIw==,type:str]
    masked58: ENC[ALGO,data:gsCZU41uNu6EOA==,iv:c/PU+aUeGu7rSV2YtR0bSalgL19cche2BiN4d4TzzDw=,tag:d92VZ0oYN/vk9zqA0XaneA==,type:str]
masked59:
    masked60:
        masked61: ENC[ALGO,data:xf0XSChc6pwkCw==,iv:Uy+yyGlysxJ9KXHkGl86QlAr9Ii4BSwmuWO9qy9w1Pg=,tag:YAeB2wvvguiI/mJapJNuZw==,type:str]
masked62:
    masked63: ENC[ALGO,data:FYTB91+YOb2heg==,iv:DlTy3dmHJMTXj0tdT9gz2hzVPRrA9ug57BCRdtPRHSY=,tag:tew20p1bGCRBfhtLzbfa6Q==,type:str]
    masked64: ENC[ALGO,data:DmKm366/9DYoYw==,iv:VHMVWnorXZxhMrnAqVjgwx4ych0lPXvySTzW8dcNPQg=,tag:s41ycc6p9HV6WljQ7UE/mA==,type:str]
masked65:
    masked66: ENC[ALGO,data:wUheEhpgEuGP7w==,iv:T0YSzl839gDC2lxoXtnugP2SstOo7OllhXljxIOhJpc=,tag:82fYcZPVGfp8ijrjYOGFyg==,type:str]
    masked67: ENC[ALGO,data:eJs4JjUmEYqchw==,iv:cIQFrzag0JP1Dpx0AG7GVn//xEv5TAZkSbLJNTUhdHA=,tag:FmAe2zgK5O4KdVOMx0v1vg==,type:str]
masked68: ENC[ALGO,data:ykbH1/a8R8WgJQ==,iv:XfGzu7Fnt9SyJC9WHQ1aQhIL1+QVAntPRBK++BQSedI=,tag:WedCfRbfdZYvEoKNnE7XrQ==,type:str]
masked69: ENC[ALGO,data:OZojw7Z40c+N+w==,iv:vs0eUAs42TnM7gLUv1fQxzaQOH33Q4bpovARkAeV0y8=,tag:pDsvoAP2CRY5qZto86oCYw==,type:str]
masked70:
    masked71:
        masked72: ENC[ALGO,data:seNS5VUP0HPPUQ==,iv:VW1V/i5ry5G7L9Gt3Y8RYrBP1aOZ/O3uR8N4H+jmunA=,tag:90yy7H+r4Vud7oHsyjYAGQ==,type:str]
        masked73: ENC[ALGO,data:Nhsq3GT6eWym8Q==,iv:unQx8FxeZ8tuFNNx+t2Z0BGkHzaezIJrHr9YAF108eY=,tag:pBhF6WB2y1PlJDDlwT3C7Q==,type:str]
        masked74: ENC[ALGO,data:wQiu8rU70ruBjg==,iv:14lNaXgGT2zjrGLDP4t/NGhdXMtfvZfcp+UD2p4jA6I=,tag:lXj8D+9HgO2NrlE0pG+Vfg==,type:str]
masked75:
    masked76:
        masked77:
            masked78: ENC[ALGO,data:5jKp33CuVZfHew==,iv:I1KwtNM+dFW+vDLMHNWj/mWKnpLhAXCP7C+WdeMG7+o=,tag:fQX3+sLh6LcO610kf+fxjA==,type:str]
            masked79: ENC[ALGO,data:eIOT0XOIdoTcsA==,iv:uWzSpJJEby0NgazH2SWkQC7BeA5YzwlVQ5NoUYLID/o=,tag:5LDL5uZYGN2Up1OAGwKkVg==,type:str]
masked80:
    masked81: ENC[ALGO,data:aBN9GFIFycn3fg==,iv:sPzPDrsqC1bsisbiant0+Ab3waE0cZCP1En2F9kXM+E=,tag:TxNWV/QrX1gftowRhLuaAg==,type:str]
masked82:
    masked83: ENC[ALGO,data:WufZkwtrppI1YQ==,iv:bqcc6A9ICwp9/g/e0oXYkmtUdKSSJCtMuRWXY6t8p48=,tag:xRGDVb+eWpXXHOKJnTmD3w==,type:str]
    masked84: ENC[ALGO,data:C9LmHJAn/c+XaQ==,iv:YcB/eQH6xkaKIchx3lng2mLJ7Rhb0KTjdf4MHfU+lqo=,tag:wZx4J5UIfgapqer/aAMv+Q==,type:str]
masked85:
    masked86:
        masked87: ENC[ALGO,data:PurskdE1WZkqGQ==,iv:BTHM56fQF/u0kBCKPoP56NZKuiKuX0a/R+4JJ4n9qZ4=,tag:JKgweRgivLkn6FJfMpIysw==,type:str]
    masked88:
        masked89: ENC[ALGO,data:NmKELUzuO1hx5J2ktUHDuEaRsN0=,iv:Sz9K3P7ecL4d/edaJVcwMDkd2V+m8ThuBL31krsaWV0=,tag:Uj1b1tvpMqnyEgI3iJ2Dew==,type:str]
sops:
    kms:
        - arn: my_key_arn
          created_at: "2023-08-14T16:39:13Z"
          enc: AQICAHjy6h5BC0yY60q92N9nKMcQuOtj5XvbgIz9dB33AklIpwHAFUAipvuX4jyHo7FpDj1BAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMOQ+prX0jAaSyNB1zAgEQgDswl2HOnW9GgEFIAhFITTbo558IO2JS4fHSBcr27PVNy3bGfDFjTfTnBBKM2Wm83ar1MimoSTLa0R1unA==
          aws_profile: ""
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age: []
    lastmodified: "2023-08-14T16:39:13Z"
    mac: ENC[ALGO,data:3DIPdNjJ9JLZFyJqabMEhAkLH+Tp8fzqyZGsW8ZhfpAzpS8pE9fJeGYGPaAnjTSUq4ZQPEJjvzxA5sinWu7rVzuPDhtpIBSJAIzjKFDOMs5ZzFU03oaEJFCWjPdTyTZ2auP4MuXQi8+F/Wgrx2WLYY4mPDRR2aBzBwToUCe+8Sk=,iv:rcT705cj0+RLtKSzLw5xDzCm1VBL5d9Ccln1N4PJDxc=,tag:KmMg8ZrqSKYtnBP5IAwgmw==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.7.1

```

**secrets.yaml** DECRYPTED:

```
masked1:
    masked2: xxxxxxxxxx
    masked3: xxxxxxxxxx
masked4:
    masked5: xxxxxxxxxx
    masked6: xxxxxxxxxx
    masked7: xxxxxxxxxx
    masked8: xxxxxxxxxx
masked9:
    masked10: xxxxxxxxxx
    masked11:
        masked12: xxxxxxxxxx
        masked13: xxxxxxxxxx
        masked14: xxxxxxxxxx
        masked15: xxxxxxxxxx
        masked16: xxxxxxxxxx
        masked17: xxxxxxxxxx
        masked18: xxxxxxxxxx
        masked19: xxxxxxxxxx
        masked21: xxxxxxxxxx
        masked22: xxxxxxxxxx
        masked23: xxxxxxxxxx
        masked24: xxxxxxxxxx
        masked25: xxxxxxxxxx
        masked26: xxxxxxxxxx
        masked27: xxxxxxxxxx
masked28: xxxxxxxxxx
masked29: xxxxxxxxxx
masked30: xxxxxxxxxx
masked31: xxxxxxxxxx
masked32: xxxxxxxxxx
masked33: xxxxxxxxxx
masked34: xxxxxxxxxx
masked35: xxxxxxxxxx
masked36: xxxxxxxxxx
masked37: xxxxxxxxxx
masked38: xxxxxxxxxx
masked39: xxxxxxxxxx
masked40:
    masked41: xxxxxxxxxx
    masked42: xxxxxxxxxx
    masked43: xxxxxxxxxx
    masked44:
        masked45: xxxxxxxxxx
masked46:
    masked47: xxxxxxxxxx
    masked48: xxxxxxxxxx
    masked49: xxxxxxxxxx
    masked50: xxxxxxxxxx
    masked51: xxxxxxxxxx
    masked52: xxxxxxxxxx
masked53:
    masked54: xxxxxxxxxx
    masked55: xxxxxxxxxx
    masked56: xxxxxxxxxx
    masked57: xxxxxxxxxx
    masked58: xxxxxxxxxx
masked59:
    masked60:
        masked61: xxxxxxxxxx
masked62:
    masked63: xxxxxxxxxx
    masked64: xxxxxxxxxx
masked65:
    masked66: xxxxxxxxxx
    masked67: xxxxxxxxxx
masked68: xxxxxxxxxx
masked69: xxxxxxxxxx
masked70:
    masked71:
        masked72: xxxxxxxxxx
        masked73: xxxxxxxxxx
        masked74: xxxxxxxxxx
masked75:
    masked76:
        masked77:
            masked78: xxxxxxxxxx
            masked79: xxxxxxxxxx
masked80:
    masked81: xxxxxxxxxx
masked82:
    masked83: xxxxxxxxxx
    masked84: xxxxxxxxxx
masked85:
    masked86:
        masked87: xxxxxxxxxx
    masked88:
        masked89: ~masked:ab#7i7!;{'".

```

**values.yaml**:

```
myValue: "valueOfMyValue"
```

When running `helmfile --environment myEnv --file my-release.yaml template`, I get the following output:

```
Decrypting secret /home/sahand/cust/helmfile-nest-example/realm/values/env/myEnv/secrets.yaml
in ./my-release.yaml: error during ../../_defaults.yaml.part.0 parsing: template: stringTemplate:10:31: executing "stringTemplate" at <.Values.myValue>: map has no entry for key "myValue"

```

If I remove the last line of the decrypted secrets file and encrypt again, the error disappears and everything templates properly. 

**secrets.yaml with the last line removed**:

```
masked1:
    masked2: xxxxxxxxxx
    masked3: xxxxxxxxxx
masked4:
    masked5: xxxxxxxxxx
    masked6: xxxxxxxxxx
    masked7: xxxxxxxxxx
    masked8: xxxxxxxxxx
masked9:
    masked10: xxxxxxxxxx
    masked11:
        masked12: xxxxxxxxxx
        masked13: xxxxxxxxxx
        masked14: xxxxxxxxxx
        masked15: xxxxxxxxxx
        masked16: xxxxxxxxxx
        masked17: xxxxxxxxxx
        masked18: xxxxxxxxxx
        masked19: xxxxxxxxxx
        masked21: xxxxxxxxxx
        masked22: xxxxxxxxxx
        masked23: xxxxxxxxxx
        masked24: xxxxxxxxxx
        masked25: xxxxxxxxxx
        masked26: xxxxxxxxxx
        masked27: xxxxxxxxxx
masked28: xxxxxxxxxx
masked29: xxxxxxxxxx
masked30: xxxxxxxxxx
masked31: xxxxxxxxxx
masked32: xxxxxxxxxx
masked33: xxxxxxxxxx
masked34: xxxxxxxxxx
masked35: xxxxxxxxxx
masked36: xxxxxxxxxx
masked37: xxxxxxxxxx
masked38: xxxxxxxxxx
masked39: xxxxxxxxxx
masked40:
    masked41: xxxxxxxxxx
    masked42: xxxxxxxxxx
    masked43: xxxxxxxxxx
    masked44:
        masked45: xxxxxxxxxx
masked46:
    masked47: xxxxxxxxxx
    masked48: xxxxxxxxxx
    masked49: xxxxxxxxxx
    masked50: xxxxxxxxxx
    masked51: xxxxxxxxxx
    masked52: xxxxxxxxxx
masked53:
    masked54: xxxxxxxxxx
    masked55: xxxxxxxxxx
    masked56: xxxxxxxxxx
    masked57: xxxxxxxxxx
    masked58: xxxxxxxxxx
masked59:
    masked60:
        masked61: xxxxxxxxxx
masked62:
    masked63: xxxxxxxxxx
    masked64: xxxxxxxxxx
masked65:
    masked66: xxxxxxxxxx
    masked67: xxxxxxxxxx
masked68: xxxxxxxxxx
masked69: xxxxxxxxxx
masked70:
    masked71:
        masked72: xxxxxxxxxx
        masked73: xxxxxxxxxx
        masked74: xxxxxxxxxx
masked75:
    masked76:
        masked77:
            masked78: xxxxxxxxxx
            masked79: xxxxxxxxxx
masked80:
    masked81: xxxxxxxxxx
masked82:
    masked83: xxxxxxxxxx
    masked84: xxxxxxxxxx
masked85:
    masked86:
        masked87: xxxxxxxxxx
    masked88:

```

Output of the command `helmfile --environment myEnv --file my-release.yaml template` with the last line of the secrets file removed (as directly above):

```
Decrypting secret /home/sahand/cust/helmfile-nest-example/realm/values/env/myEnv/secrets.yaml
Templating release=kafka, chart=bitnami/kafka
---
# Source: kafka/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kafka
  namespace: "itoring.coreos.com/v1"
  labels:
    app.kubernetes.io/name: kafka
    helm.sh/chart: kafka-23.0.7
    app.kubernetes.io/instance: kafka
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: kafka
  annotations:
automountServiceAccountToken: true
---
# Source: kafka/templates/scripts-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: kafka-scripts
  namespace: "itoring.coreos.com/v1"
  labels:
    app.kubernetes.io/name: kafka
    helm.sh/chart: kafka-23.0.7
    app.kubernetes.io/instance: kafka
    app.kubernetes.io/managed-by: Helm
data:
  setup.sh: |-
    #!/bin/bash

    ID="${MY_POD_NAME#"kafka-"}"
    # If process.roles is not set at all, it is assumed to be in ZooKeeper mode.
    # https://kafka.apache.org/documentation/#kraft_role

    if [[ -f "/bitnami/kafka/data/meta.properties" ]]; then
        if [[ $KAFKA_CFG_PROCESS_ROLES == "" ]]; then
            export KAFKA_CFG_BROKER_ID="$(grep "broker.id" "/bitnami/kafka/data/meta.properties" | awk -F '=' '{print $2}')"
        else
            export KAFKA_CFG_NODE_ID="$(grep "node.id" "/bitnami/kafka/data/meta.properties" | awk -F '=' '{print $2}')"
        fi
    else
        if [[ $KAFKA_CFG_PROCESS_ROLES == "" ]]; then
            export KAFKA_CFG_BROKER_ID="$((ID + 0))"
        else
            export KAFKA_CFG_NODE_ID="$((ID + 0))"
        fi
    fi

    if [[ $KAFKA_CFG_PROCESS_ROLES == *"controller"* && -z $KAFKA_CFG_CONTROLLER_QUORUM_VOTERS ]]; then
        node_id=0
        pod_id=0
        while :
        do
            VOTERS="${VOTERS}$node_id@kafka-$pod_id.kafka-headless.itoring.coreos.com/v1.svc.cluster.local:9093"
            node_id=$(( $node_id + 1 ))
            pod_id=$(( $pod_id + 1 ))
            if [[ $pod_id -ge 1 ]]; then
                break
            else
                VOTERS="$VOTERS,"
            fi
        done
        export KAFKA_CFG_CONTROLLER_QUORUM_VOTERS=$VOTERS
    fi

    # Configure zookeeper client

    exec /entrypoint.sh /run.sh
---
# Source: kafka/templates/svc-headless.yaml
apiVersion: v1
kind: Service
metadata:
  name: kafka-headless
  namespace: "itoring.coreos.com/v1"
  labels:
    app.kubernetes.io/name: kafka
    helm.sh/chart: kafka-23.0.7
    app.kubernetes.io/instance: kafka
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: kafka
spec:
  type: ClusterIP
  clusterIP: None
  publishNotReadyAddresses: false
  ports:
    - name: tcp-client
      port: 9092
      protocol: TCP
      targetPort: kafka-client
    - name: tcp-internal
      port: 9094
      protocol: TCP
      targetPort: kafka-internal
    - name: tcp-controller
      protocol: TCP
      port: 9093
      targetPort: kafka-ctlr
  selector:
    app.kubernetes.io/name: kafka
    app.kubernetes.io/instance: kafka
    app.kubernetes.io/component: kafka
---
# Source: kafka/templates/svc.yaml
apiVersion: v1
kind: Service
metadata:
  name: kafka
  namespace: "itoring.coreos.com/v1"
  labels:
    app.kubernetes.io/name: kafka
    helm.sh/chart: kafka-23.0.7
    app.kubernetes.io/instance: kafka
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: kafka
spec:
  type: ClusterIP
  sessionAffinity: None
  ports:
    - name: tcp-client
      port: 9092
      protocol: TCP
      targetPort: kafka-client
      nodePort: null
  selector:
    app.kubernetes.io/name: kafka
    app.kubernetes.io/instance: kafka
    app.kubernetes.io/component: kafka
---
# Source: kafka/templates/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: kafka
  namespace: "itoring.coreos.com/v1"
  labels:
    app.kubernetes.io/name: kafka
    helm.sh/chart: kafka-23.0.7
    app.kubernetes.io/instance: kafka
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: kafka
spec:
  podManagementPolicy: Parallel
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: kafka
      app.kubernetes.io/instance: kafka
      app.kubernetes.io/component: kafka
  serviceName: kafka-headless
  updateStrategy:
    rollingUpdate: {}
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: kafka
        helm.sh/chart: kafka-23.0.7
        app.kubernetes.io/instance: kafka
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/component: kafka
      annotations:
    spec:
      
      hostNetwork: false
      hostIPC: false
      affinity:
        podAffinity:
          
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/name: kafka
                    app.kubernetes.io/instance: kafka
                    app.kubernetes.io/component: kafka
                topologyKey: kubernetes.io/hostname
              weight: 1
        nodeAffinity:
          
      securityContext:
        fsGroup: 1001
      serviceAccountName: kafka
      containers:
        - name: kafka
          image: docker.io/bitnami/kafka:3.5.1-debian-11-r1
          imagePullPolicy: "IfNotPresent"
          securityContext:
            allowPrivilegeEscalation: false
            runAsNonRoot: true
            runAsUser: 1001
          command:
            - /scripts/setup.sh
          env:
            - name: BITNAMI_DEBUG
              value: "false"
            - name: MY_POD_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            - name: MY_POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: KAFKA_CFG_ZOOKEEPER_CONNECT
              value: 
            - name: KAFKA_INTER_BROKER_LISTENER_NAME
              value: "INTERNAL"
            - name: KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP
              value: "INTERNAL:PLAINTEXT,CLIENT:PLAINTEXT,CONTROLLER:PLAINTEXT"
            - name: KAFKA_CFG_LISTENERS
              value: "INTERNAL://:9094,CLIENT://:9092,CONTROLLER://:9093"
            - name: KAFKA_CFG_ADVERTISED_LISTENERS
              value: "INTERNAL://$(MY_POD_NAME).kafka-headless.itoring.coreos.com/v1.svc.cluster.local:9094,CLIENT://$(MY_POD_NAME).kafka-headless.itoring.coreos.com/v1.svc.cluster.local:9092"
            - name: ALLOW_PLAINTEXT_LISTENER
              value: "yes"
            - name: KAFKA_ZOOKEEPER_PROTOCOL
              value: PLAINTEXT
            - name: KAFKA_VOLUME_DIR
              value: "/bitnami/kafka"
            - name: KAFKA_LOG_DIR
              value: "/opt/bitnami/kafka/logs"
            - name: KAFKA_CFG_DELETE_TOPIC_ENABLE
              value: "false"
            - name: KAFKA_CFG_AUTO_CREATE_TOPICS_ENABLE
              value: "true"
            - name: KAFKA_HEAP_OPTS
              value: "-Xmx1024m -Xms1024m"
            - name: KAFKA_CFG_LOG_FLUSH_INTERVAL_MESSAGES
              value: "10000"
            - name: KAFKA_CFG_LOG_FLUSH_INTERVAL_MS
              value: "1000"
            - name: KAFKA_CFG_LOG_RETENTION_BYTES
              value: "1073741824"
            - name: KAFKA_CFG_LOG_RETENTION_CHECK_INTERVAL_MS
              value: "300000"
            - name: KAFKA_CFG_LOG_RETENTION_HOURS
              value: "168"
            - name: KAFKA_CFG_MESSAGE_MAX_BYTES
              value: "1000012"
            - name: KAFKA_CFG_LOG_SEGMENT_BYTES
              value: "1073741824"
            - name: KAFKA_CFG_LOG_DIRS
              value: "/bitnami/kafka/data"
            - name: KAFKA_CFG_DEFAULT_REPLICATION_FACTOR
              value: "1"
            - name: KAFKA_CFG_OFFSETS_TOPIC_REPLICATION_FACTOR
              value: "1"
            - name: KAFKA_CFG_TRANSACTION_STATE_LOG_REPLICATION_FACTOR
              value: "1"
            - name: KAFKA_CFG_TRANSACTION_STATE_LOG_MIN_ISR
              value: "1"
            - name: KAFKA_CFG_NUM_IO_THREADS
              value: "8"
            - name: KAFKA_CFG_NUM_NETWORK_THREADS
              value: "3"
            - name: KAFKA_CFG_NUM_PARTITIONS
              value: "1"
            - name: KAFKA_CFG_NUM_RECOVERY_THREADS_PER_DATA_DIR
              value: "1"
            - name: KAFKA_CFG_SOCKET_RECEIVE_BUFFER_BYTES
              value: "102400"
            - name: KAFKA_CFG_SOCKET_REQUEST_MAX_BYTES
              value: "104857600"
            - name: KAFKA_CFG_SOCKET_SEND_BUFFER_BYTES
              value: "102400"
            - name: KAFKA_CFG_ZOOKEEPER_CONNECTION_TIMEOUT_MS
              value: "6000"
            - name: KAFKA_CFG_AUTHORIZER_CLASS_NAME
              value: ""
            - name: KAFKA_CFG_ALLOW_EVERYONE_IF_NO_ACL_FOUND
              value: "true"
            - name: KAFKA_CFG_SUPER_USERS
              value: "User:admin"
            - name: KAFKA_ENABLE_KRAFT
              value: "true"
            - name: KAFKA_KRAFT_CLUSTER_ID
              value: "kafka_cluster_id_test1"
            - name: KAFKA_CFG_PROCESS_ROLES
              value: "broker,controller"
            - name: KAFKA_CFG_CONTROLLER_LISTENER_NAMES
              value: "CONTROLLER"
          ports:
            - name: kafka-client
              containerPort: 9092
            - name: kafka-internal
              containerPort: 9094
            - name: kafka-ctlr
              containerPort: 9093
          livenessProbe:
            failureThreshold: 3
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
            tcpSocket:
              port: kafka-client
          readinessProbe:
            failureThreshold: 6
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
            tcpSocket:
              port: kafka-client
          resources:
            limits: {}
            requests: {}
          volumeMounts:
            - name: data
              mountPath: /bitnami/kafka
            - name: logs
              mountPath: /opt/bitnami/kafka/logs
            - name: scripts
              mountPath: /scripts/setup.sh
              subPath: setup.sh
      volumes:
        - name: scripts
          configMap:
            name: kafka-scripts
            defaultMode: 0755
        - name: logs
          emptyDir: {}
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes:
          - "ReadWriteOnce"
        resources:
          requests:
            storage: "8Gi"
```

Surely this is a bug?

### Example helmfile.yaml

bases:
  - ../../_defaults.yaml

values:
  - app: kafka

---
templates:

  kafka: &kafka
    chart: bitnami/kafka
    installed: true

releases:
  - name: kafka
    <<: *kafka

### Error message you've seen (if any)

Decrypting secret /home/sahand/Telefonica/helmfile-nest-example/realm/values/env/myEnv/secrets.yaml
in ./my-release.yaml: error during ../../_defaults.yaml.part.0 parsing: template: stringTemplate:10:31: executing "stringTemplate" at <.Values.myValue>: map has no entry for key "myValue"


### Steps to reproduce

https://github.com/Sahand1993/helmfile-bug-small-example/tree/main

### Working Helmfile Version

 0.152.0

### Relevant discussion

_No response_

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Getting "map has no entry for key" for some secrets files when using kms encryption #2179 #973

Operating system

Helmfile Version

Helm Version

Bug description

Example helmfile.yaml

Error message you've seen (if any)

Steps to reproduce

Working Helmfile Version

Relevant discussion

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Uh oh!

Uh oh!

Getting "map has no entry for key" for some secrets files when using kms encryption #2179 #973

Description

Operating system

Helmfile Version

Helm Version

Bug description

Example helmfile.yaml

Error message you've seen (if any)

Steps to reproduce

Working Helmfile Version

Relevant discussion

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions