The use case is a Helm pre-hook that generates the configuration file for a pod and writes it to a Secret. The Secret is mounted as a file in the pod.
Typically in Helm you would then add an annotation to the Deployment and use lookup() to compute the hash of the Secret, which would then cause a rollout restart when that Secret changes.
One workaround is to compute that hash in code and apply the annotation from the pre-hook code, but it means potentially doing a double rollout restart. I think we will just live with always restarting the service by adding the annotation rollme: {{ uuidv4 }} to the Helm Deployment.