helm/docs/examples/nginx/templates/pre-install-secret.yaml

# This shows a secret as a pre-install hook.
# A pre-install hook is run before the rest of the chart is loaded.
apiVersion: v1
kind: Secret
metadata:
  name: "{{.Release.Name}}-secret"
  # This declares the resource to be a hook. By convention, we also name the
  # file "pre-install-XXX.yaml", but Helm itself doesn't care about file names.
  annotations:
    "helm.sh/hook": pre-install
type: Opaque
data:
  password: {{ b64enc "secret" }}
  username: {{ b64enc "user1" }}