fix: secretKeyRef name in the extra-secrets loop resolves to the map value, not the release

[omarghatasheh]

Summary

• `charts/default/templates/deployment.yaml`'s env-injection loop over `.Values.secrets` rebinds `.` to each map value inside the `range`, so `{{ template "project.fullname" . }}` for the `secretKeyRef.name` fails as soon as `.Values.secrets` has any entry: `can't evaluate field Values in type string`.
• `$root := .` was already captured one line above for exactly this case but never used. Swapped the stray `.` for `$root`.
• This is why nothing in this repo's own CI has hit it before: the playground deploy's `helm-set-secret-values` never populates `secrets.*`. It surfaced while wiring up `traxis-infolink`'s staging deploy, which sets `secrets.Bitween__SettingsEncryptionKey`.

Test plan

• `helm template` against `charts/default` with `--set-string secrets.Bitween__SettingsEncryptionKey=...` now renders successfully and the resulting env var's `secretKeyRef.name` correctly points at the release name.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: simplify9/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 32fbe513-b7df-4e46-a04a-c69f38f0b3fa

📥 Commits

Reviewing files that changed from the base of the PR and between 007824a and ad5632e.

📒 Files selected for processing (1)

• charts/default/templates/deployment.yaml

---

📝 Walkthrough

Summary

• Fixed secretKeyRef.name rendering in charts/default/templates/deployment.yaml.
• The template now uses $root to resolve project.fullname inside the .Values.secrets loop.
• Risk: risk:low
• Security-sensitive area: Secret reference rendering only. Secret values and storage are unchanged.
• Test coverage: helm template was verified with secrets.Bitween__SettingsEncryptionKey set. The output references the release name.
• No migration is required. Deployment behavior changes only for configurations that define .Values.secrets. Rollback requires reverting the template change.

Walkthrough

The deployment template now resolves secret reference names from the root Helm context during the .Values.secrets loop.

Changes

Helm deployment templating

Layer / File(s)	Summary
Root-context secret name resolution charts/default/templates/deployment.yaml	The secret reference name evaluates project.fullname against $root instead of the loop’s current context.

Estimated code review effort: 2 (Simple) | ~5 minutes

Suggested labels: security, infra, risk:high

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}