# Issue This is probably a bit of a niche use case, but when trying to template the helm chart for external-secrets with null values, it errors out. Use case for this - we are creating a package (with zarf) for the package, which we then feed the actual values to with separate CaC when applied to an environment. This was working fine prior to this change: https://repo1.dso.mil/big-bang/bigbang/-/commit/21b0ce7e5d63e92085696449f7018ca52c0b0213#line_960f568ac_A21 ## Description The error is in this condition: ```{{- if or .Values.addons.externalSecrets.postRenderers $istioEnabled (and dig "upstream" "webhook" "create" false .Values.addons.externalSecrets.values) }}``` That dig call is invalid in Helm/Sprig if the values passed are null as dig expects at least a path and a map, e.g. dig "upstream" "webhook" "create" .Values.addons.externalSecrets.values The template is trying to pass false as a fallback default, but dig does not support a default argument in that position That is why Helm reports: dig needs at least three arguments ## BigBang Version 3.30 ## Steps to reproduce 1. Create values.yaml with: ```yaml addons: externalSecrets: enabled: true values: upstream: webhook: create: false ``` 2. Create a minimal chart directory structure with chart.yaml: ```yaml apiVersion: v2 name: test-chart version: 0.1.0 ``` and a templates/external-secrets/helmrelease.yaml containing at least the offending line: ``` {{- if or .Values.addons.externalSecrets.postRenderers (and dig "upstream" "webhook" "create" false .Values.addons.externalSecrets.values) }} external-secrets-enabled: true {{- else }} external-secrets-enabled: false {{- end }} ``` You will get the error: ``` helm template test-chart ./ -f values.yaml Error: template: test-chart/templates/external-secrets/helmrelease.yaml:4:14: executing "test-chart/templates/external-secrets/helmrelease.yaml" at <dig>: error calling dig: dig needs at least three arguments Use --debug flag to render out invalid YAML ``` ## Current behavior We get this error: Error: unable to template Big Bang Chart: error generating helm chart template: template: bigbang/templates/external-secrets/helmrelease.yaml:21:76: executing "bigbang/templates/external-secrets/helmrelease.yaml" at <dig>: error calling dig: dig needs at least three arguments unable to template Big Bang Chart: error generating helm chart template: template: bigbang/templates/external-secrets/helmrelease.yaml:21:76: executing "bigbang/templates/external-secrets/helmrelease.yaml" at <dig>: error calling dig: dig needs at least three arguments Usage: VERSION [flags] Examples: go run main.go 2.34.0 --values-file-manifests=my-configmap.yaml,my-secret.yaml Flags: --airgap Whether or not this package is targeting an airgap environment (default true) -h, --help help for VERSION --kube-version string Override the default KubeVersion used during the helm template portion of generate (default "1.99.0") --repo string The git repository to use for the Big Bang package (default "https://repo1.dso.mil/big-bang/bigbang") --skip-flux Skip the Flux component in the Big Bang package --values-file-manifests strings A comma separated list of configmap or secret manifests to pass to the Big Bang Helm Release. See https://fluxcd.io/flux/components/helm/helmreleases/#values-references ## Expected behavior Chart templates render (no dig argument error) or the condition resolves false when upstream.webhook.create is absent. ## Proposed solution I know you don't accept forks for MRs and I don't have perms to make a branch, but with a simplified helmrelease.yaml such as mentioned in the steps to reproduce, I was able to fix the error by ensuring Sprig’s dig receives a map as its final argument. If .Values.addons.externalSecrets.values is missing, null, or overwritten by another manifest then the current template evaluates: `dig "upstream" "webhook" "create" false nil` Sprig throws: `dig needs at least three arguments` We need to default the map before calling dig, so this line: ``` {{- if or .Values.addons.externalSecrets.postRenderers $istioEnabled (and dig "upstream" "webhook" "create" false .Values.addons.externalSecrets.values) }} ``` should be replaced with: ``` {{- $vals := .Values.addons.externalSecrets.values | default dict }} {{- if or .Values.addons.externalSecrets.postRenderers $istioEnabled (dig "upstream" "webhook" "create" $vals) }} ``` This guarantees: $vals is always a map dig never receives nil the condition resolves cleanly ```yaml {{- $vals := .Values.addons.externalSecrets.values | default dict }} {{- if or .Values.addons.externalSecrets.postRenderers (and (dig "upstream" "webhook" "create" $vals)) }} external-secrets-enabled: true {{- else }} external-secrets-enabled: false {{- end }} ```