I deploy my kubernetes stuff via the excellent kontemplate tool, which allows me to template my kubernetes resource specifications.

I'd like to keep my secrets crypted and only decrypt them at deployment time to hand them over to kubectl.

I imagine achieving my idea like this:

$ cat Secret.foo-secrets.yml
{{ shell("ansible-vault view foo-secrets.ansible-vault") }}

How can I do something like that with Go templates? Or respectively is there a better/more elegant way to do what I intend to do?