Load Balancer Controller: defaultTags with special YAML characters

[jeff-d]

Describe the bug

The Load Balancer Controller helm deployment.yaml processes .Values.defaultTags :

{{- if .Values.defaultTags }}
        - --default-tags={{ include "aws-load-balancer-controller.convertMapToCsv" .Values.defaultTags | trimSuffix "," }}
        {{- end }}

I'm noticing that default tag values with special yaml characters don't get properly handled when the helm template strips out the quoting.

It doesn't seem to matter that properly-quoted values are passed to the values file (in my case via terraform's yamlencode() function)...

resource "helm_release" "lbc" {
  # ... other config ...

values = [yamlencode({
    defaultTags = { "slackHandle" = "@jd", "createdAt" = "2026-01-19T17:11:15Z" }
  })]

}

...because the template rendering step occurs after, turning valid YAML into invalid YAML.

Steps to reproduce

cat <<'EOF' | helm template test aws-load-balancer-controller --repo https://aws.github.io/eks-charts -f - --debug 2>&1 | grep -A 50 "deployment.yaml" | head -60
clusterName: test
defaultTags:
  Owner: "github: @jeff-d"
  simple: value
EOF
# Source: aws-load-balancer-controller/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-aws-load-balancer-controller
  namespace: default
  labels:
    app.kubernetes.io/managed-by: Helm
    helm.sh/chart: aws-load-balancer-controller-3.0.0
    app.kubernetes.io/name: aws-load-balancer-controller
    app.kubernetes.io/instance: test
    app.kubernetes.io/version: "v3.0.0"
spec:
  
  replicas: 2
  
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/name: aws-load-balancer-controller
      app.kubernetes.io/instance: test
  template:
    metadata:
      labels:
        app.kubernetes.io/name: aws-load-balancer-controller
        app.kubernetes.io/instance: test
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8080"
    spec:
      serviceAccountName: test-aws-load-balancer-controller
      volumes:
      - name: cert
        secret:
          defaultMode: 420
          secretName: aws-load-balancer-tls
      securityContext:
        fsGroup: 65534
      containers:
      - name: aws-load-balancer-controller
        args:
        - --cluster-name=test
        - --ingress-class=alb
        - --default-tags=Owner=github: @jeff-d,simple=value
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          runAsNonRoot: true
        image: "public.ecr.aws/eks/aws-load-balancer-controller:v3.0.0"
        imagePullPolicy: IfNotPresent
        volumeMounts:
--
Error: YAML parse error on aws-load-balancer-controller/templates/deployment.yaml: error converting YAML to JSON: yaml: line 43: found character that cannot start any token

Expected outcome

containers:
      - name: aws-load-balancer-controller
        args:
        - --cluster-name=test
        - --ingress-class=alb
        - "--default-tags=Owner=github: @jeff-d,simple=value"

Environment

• Chart name: aws-load-balancer-controller
• Chart version: 3.0.0 (App version: v3.0.0)
• Kubernetes version: v1.35.0
• Using EKS: yes (EKS version: 1.35)

Additional Context: