disable post build substitution in HelmRelease

[f-wi-plano]

Hello,

I am getting a "post build failed for 'jenkins-ci': envsubst error: variable substitution failed: missing closing brace" error from flux. I think the problem is that the two variables ${keycloak-clientid} and ${keycloak-clientsecret} do not exist at the time flux applies the HelmRelease.
In this case, the variables come from kubernetes Secrets.

What can I do?

`---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: jenkins-ci
namespace: devops
spec:
interval: 30m
chart:
spec:
chart: jenkins
version: 5.5.8
sourceRef:
kind: HelmRepository
name: jenkins
namespace: flux-system
interval: 30m
values:
controller:
containerEnv:
- name: SECRETS
value: /run/secrets/additional
admin:
# -- The key in the existing admin secret containing the username
userKey: jenkins-admin-user
# -- The key in the existing admin secret containing the password
passwordKey: jenkins-admin-password

    # The default configuration uses this secret to configure an admin user
    # If you don't need that user or use a different security realm, then you can disable it
    # -- Create secret for admin user
    createSecret: false

    # -- The name of an existing secret containing the admin credentials
    existingSecret: "jenkins-app-secrets"

  ingress:
    enabled: true
    # className: internal
    annotations:
      hajimari.io/appName: "Jenkins CI"
      hajimari.io/icon: simple-icons:jenkins
    hostName: &host "jenkins.${SECRET_DOMAIN}"
    hosts:
      - host: *host
        paths:
          - path: /
            pathType: Prefix
    tls:
      - hosts:
          - *host  


# 'name' is a name of an existing secret in the same namespace as jenkins,
# 'keyName' is the name of one of the keys inside the current secret.
# the 'name' and 'keyName' are concatenated with a '-' in between, so for example:
# an existing secret "secret-credentials" and a key inside it named "github-password" should be used in JCasC as ${secret-credentials-github-password}
# 'name' and 'keyName' must be lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-',
# and must start and end with an alphanumeric character (e.g. 'my-name', or '123-abc')
# existingSecret existing secret "secret-credentials" and a key inside it named "github-username" should be used in JCasC as ${github-username}
# When using existingSecret no need to specify the keyName under additionalExistingSecrets.
  existingSecret: jenkins-app-secrets


  installPlugins:
    - kubernetes:latest
    - kubernetes-credentials:latest
    - workflow-aggregator:latest
    - workflow-job:latest
    - credentials-binding:latest
    - git:latest
    - configuration-as-code:latest
    - blueocean:latest
    - prometheus:latest
    - matrix-auth:latest
    - keycloak:latest
    - oic-auth:latest
  JCasC:
    enabled: true
    defaultConfig: false
    overwriteConfiguration: true
    securityRealm: |
      oic:
        clientId: ${keycloak-clientid}
        clientSecret: ${keycloak-clientsecret}
        wellKnownOpenIDConfigurationUrl: "https://sso.${SECRET_DOMAIN}/realms/develop/.well-known/openid-configuration"
        tokenServerUrl: "https://sso.${SECRET_DOMAIN}/realms/develop/protocol/openid-connect/token"
        authorizationServerUrl: "https://sso.${SECRET_DOMAIN}/realms/develop/protocol/openid-connect/auth"
        userInfoServerUrl: "https://sso.${SECRET_DOMAIN}/realms/develop/protocol/openid-connect/userinfo"
        userNameField: "preferred_username"
        fullNameFieldName: "name"
        emailFieldName: "email"
        groupsFieldName: "group-membership"
        scopes: "web-origins address phone openid offline_access profile roles microprofile-jwt email"
        disableSslVerification: false
        logoutFromOpenidProvider: true
        endSessionEndpoint: "https://sso.${SECRET_DOMAIN}/realms/develop/protocol/openid-connect/logout"
        postLogoutRedirectUrl: ""
        escapeHatchEnabled: false
        escapeHatchSecret: ""
    configScripts:
      welcome-message: |
        jenkins:
          systemMessage: Welcome, this Jenkins is configured and managed as code.
      matrix-auth: |
        jenkins:
          authorizationStrategy:
            globalMatrix:
              permissions:
                - "USER:Overall/Read:authenticated"
                - "GROUP:Overall/Administer:DevOps"
                - "GROUP:Overall/Administer:JenkinsAdmins"
                - "GROUP:Overall/Administer:/DevOps"
                - "GROUP:Overall/Administer:/JenkinsAdmins"
      
sidecar:
  configAutoReload:
  # If enabled: true, Jenkins Configuration as Code will be reloaded on-the-fly without a reboot.
  # If false or not-specified, JCasC changes will cause a reboot and will only be applied at the subsequent start-up.
  # Auto-reload uses the http://<jenkins_url>/reload-configuration-as-code endpoint to reapply config when changes to
  # the configScripts are detected.
  # -- Enables Jenkins Config as Code auto-reload
    enabled: true

persistence:
  # -- Enable the use of a Jenkins PVC
  enabled: true
  storageClass: ceph-filesystem

`