diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9a4a438..ee0f141 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@ CHANGELOG
 - Add implicit and explicit caching (#102 / #103)
 - Add `config_file=` in lib mode
 - Add a `--flat` option to the `get-all` command (the new output uses full paths as dictionnary key)
+- Add support of templates when values are dict
 
 0.9.0 (2019-07-11)
 ------------------
diff --git a/vault_cli/client.py b/vault_cli/client.py
index d50508d..74f89d5 100644
--- a/vault_cli/client.py
+++ b/vault_cli/client.py
@@ -422,6 +422,8 @@ class VaultClientBase:
     template_prefix = "!template!"
 
     def _render_template_value(self, secret: types.JSONValue) -> types.JSONValue:
+        if isinstance(secret, dict):
+            return {k: self._render_template_value(v) for k, v in secret.items()}
         if not isinstance(secret, str):
             return secret
 

add support for templates in dict
Currently the "template" feature of vault-cli only works when the value is a string (`{"value": "!template!..."}`

We would like to also support templates when values are dict. For example:
```
{
  "value": {
    "a": "!template!...",
    "b": "!template!...",
    "c": "value",
  }
}
```
diff --git a/tests/unit/test_client_base.py b/tests/unit/test_client_base.py
index d8376e5..1bfff71 100644
--- a/tests/unit/test_client_base.py
+++ b/tests/unit/test_client_base.py
@@ -366,6 +366,14 @@ def test_vault_client_base_render_template_path_not_found(vault):
         ({"a": {"value": "!template!b"}, "b": {"value": "c"}}, "b"),
         # Secret is a template
         ({"a": {"value": "!template!{{ vault('b') }}"}, "b": {"value": "c"}}, "c"),
+        # Secret is a dict with containing a template
+        (
+            {
+                "a": {"value": {"x": "!template!{{ vault('b') }}", "y": "yay"}},
+                "b": {"value": "c"},
+            },
+            {"x": "c", "y": "yay"},
+        ),
         # Finite recursion
         (
             {

pip install -e .[dev,test,lint]
parse_log_pytest
requirements.txt
pytest
3.9
requirements.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
backports.tarfile==1.2.0
black==25.1.0
certifi==2025.1.31
cffi==1.17.1
charset-normalizer==3.4.1
click==8.1.8
coverage==7.8.0
cryptography==44.0.2
docutils==0.21.2
exceptiongroup==1.2.2
flake8==7.2.0
hvac==2.3.0
id==1.5.0
idna==3.10
importlib_metadata==8.6.1
iniconfig==2.1.0
isort==6.0.1
jaraco.classes==3.4.0
jaraco.context==6.0.1
jaraco.functools==4.1.0
jeepney==0.9.0
Jinja2==3.1.6
keyring==25.6.0
markdown-it-py==3.0.0
MarkupSafe==3.0.2
mccabe==0.7.0
mdurl==0.1.2
more-itertools==10.6.0
mypy==1.15.0
mypy-extensions==1.0.0
nh3==0.2.21
packaging==24.2
pathspec==0.12.1
platformdirs==4.3.7
pluggy==1.5.0
pycodestyle==2.13.0
pycparser==2.22
pyflakes==3.3.1
Pygments==2.19.1
pytest==8.3.5
pytest-click==1.1.0
pytest-cov==6.0.0
pytest-mock==3.14.0
PyYAML==6.0.2
readme_renderer==44.0
requests==2.32.3
requests-mock==1.12.1
requests-toolbelt==1.0.0
rfc3986==2.0.0
rich==14.0.0
SecretStorage==3.3.3
tomli==2.2.1
twine==6.1.0
typing_extensions==4.13.0
urllib3==2.3.0
-e git+https://github.com/peopledoc/vault-cli.git@4875b0082411df2e204568165d6f32cb9c365156#egg=vault_cli
zipp==3.21.0

name: vault-cli
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=3.0.16=h5eee18b_0
  - pip=25.0=py39h06a4308_0
  - python=3.9.21=he870216_1
  - readline=8.2=h5eee18b_0
  - setuptools=75.8.0=py39h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - tzdata=2025a=h04d1e81_0
  - wheel=0.45.1=py39h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - backports-tarfile==1.2.0
      - black==25.1.0
      - certifi==2025.1.31
      - cffi==1.17.1
      - charset-normalizer==3.4.1
      - click==8.1.8
      - coverage==7.8.0
      - cryptography==44.0.2
      - docutils==0.21.2
      - exceptiongroup==1.2.2
      - flake8==7.2.0
      - hvac==2.3.0
      - id==1.5.0
      - idna==3.10
      - importlib-metadata==8.6.1
      - iniconfig==2.1.0
      - isort==6.0.1
      - jaraco-classes==3.4.0
      - jaraco-context==6.0.1
      - jaraco-functools==4.1.0
      - jeepney==0.9.0
      - jinja2==3.1.6
      - keyring==25.6.0
      - markdown-it-py==3.0.0
      - markupsafe==3.0.2
      - mccabe==0.7.0
      - mdurl==0.1.2
      - more-itertools==10.6.0
      - mypy==1.15.0
      - mypy-extensions==1.0.0
      - nh3==0.2.21
      - packaging==24.2
      - pathspec==0.12.1
      - platformdirs==4.3.7
      - pluggy==1.5.0
      - pycodestyle==2.13.0
      - pycparser==2.22
      - pyflakes==3.3.1
      - pygments==2.19.1
      - pytest==8.3.5
      - pytest-click==1.1.0
      - pytest-cov==6.0.0
      - pytest-mock==3.14.0
      - pyyaml==6.0.2
      - readme-renderer==44.0
      - requests==2.32.3
      - requests-mock==1.12.1
      - requests-toolbelt==1.0.0
      - rfc3986==2.0.0
      - rich==14.0.0
      - secretstorage==3.3.3
      - tomli==2.2.1
      - twine==6.1.0
      - typing-extensions==4.13.0
      - urllib3==2.3.0
      - zipp==3.21.0
prefix: /opt/conda/envs/vault-cli

tests/unit/test_client_base.py::test_vault_client_base_get_secret[vault_contents4-expected4]
tests/unit/test_client_base.py::test_get_client tests/unit/test_client_base.py::test_get_client_class tests/unit/test_client_base.py::test_vault_client_base_call_init_client tests/unit/test_client_base.py::test_vault_client_base_authenticate[test_kwargs0-expected0] tests/unit/test_client_base.py::test_vault_client_base_authenticate[test_kwargs1-expected1] tests/unit/test_client_base.py::test_vault_client_base_authenticate[test_kwargs2-expected2] tests/unit/test_client_base.py::test_vault_client_base_username_without_password tests/unit/test_client_base.py::test_vault_client_base_login_cert_without_key tests/unit/test_client_base.py::test_vault_client_base_no_auth tests/unit/test_client_base.py::test_vault_client_ca_bundle_verify[True-yay-yay] tests/unit/test_client_base.py::test_vault_client_ca_bundle_verify[True-None-True] tests/unit/test_client_base.py::test_vault_client_ca_bundle_verify[False-yay-False] tests/unit/test_client_base.py::test_vault_client_base_browse_recursive_secrets tests/unit/test_client_base.py::test_vault_client_base_browse_recursive_secrets_single_secret tests/unit/test_client_base.py::test_vault_client_base_get_all_secrets tests/unit/test_client_base.py::test_vault_client_base_get_all_secrets_flat tests/unit/test_client_base.py::test_vault_client_base_get_secrets[a-expected0] tests/unit/test_client_base.py::test_vault_client_base_get_secrets[b-expected1] tests/unit/test_client_base.py::test_vault_client_base_delete_all_secrets_generator tests/unit/test_client_base.py::test_vault_client_base_delete_all_secrets_no_generator tests/unit/test_client_base.py::test_vault_client_base_context_manager tests/unit/test_client_base.py::test_vault_client_set_secret tests/unit/test_client_base.py::test_vault_client_set_secret_overwrite_invalid[True-False] tests/unit/test_client_base.py::test_vault_client_set_secret_overwrite_invalid[True-None] tests/unit/test_client_base.py::test_vault_client_set_secret_overwrite_invalid[False-False] tests/unit/test_client_base.py::test_vault_client_set_secret_overwrite_valid[True-True-c] tests/unit/test_client_base.py::test_vault_client_set_secret_overwrite_valid[False-None-c] tests/unit/test_client_base.py::test_vault_client_set_secret_overwrite_valid[True-None-d] tests/unit/test_client_base.py::test_vault_client_set_secret_when_there_are_existing_secrets_beneath_path tests/unit/test_client_base.py::test_vault_client_set_secret_when_a_parent_is_an_existing_secret tests/unit/test_client_base.py::test_vault_client_set_secret_read_not_allowed tests/unit/test_client_base.py::test_vault_client_set_secret_list_not_allowed tests/unit/test_client_base.py::test_vault_client_set_secret_read_parent_not_allowed tests/unit/test_client_base.py::test_vault_client_move_secrets tests/unit/test_client_base.py::test_vault_client_move_secrets_generator tests/unit/test_client_base.py::test_vault_client_move_secrets_overwrite_safe tests/unit/test_client_base.py::test_vault_client_move_secrets_overwrite_force tests/unit/test_client_base.py::test_vault_client_base_render_template tests/unit/test_client_base.py::test_vault_client_base_render_template_path_not_found tests/unit/test_client_base.py::test_vault_client_base_get_secret[vault_contents0-b] tests/unit/test_client_base.py::test_vault_client_base_get_secret[vault_contents1-expected1] tests/unit/test_client_base.py::test_vault_client_base_get_secret[vault_contents2-b] tests/unit/test_client_base.py::test_vault_client_base_get_secret[vault_contents3-c] tests/unit/test_client_base.py::test_vault_client_base_get_secret[vault_contents5-d] tests/unit/test_client_base.py::test_vault_client_base_get_secret[vault_contents6-<recursive tests/unit/test_client_base.py::test_vault_client_base_get_secret[vault_contents7-<recursive tests/unit/test_client_base.py::test_vault_client_base_get_secret_template_root tests/unit/test_client_base.py::test_vault_client_base_get_secret_no_value tests/unit/test_client_base.py::test_vault_client_base_get_secret_with_dict tests/unit/test_client_base.py::test_vault_client_base_get_secret_not_found tests/unit/test_client_base.py::test_vault_client_base_lookup_token tests/unit/test_client_base.py::test_vault_client_base_get_secrets_error tests/unit/test_client_base.py::test_vault_client_base_absolute_path[get_secret-params0-expected0] tests/unit/test_client_base.py::test_vault_client_base_absolute_path[get_secret-params1-expected1] tests/unit/test_client_base.py::test_vault_client_base_absolute_path[delete_secret-params2-expected2] tests/unit/test_client_base.py::test_vault_client_base_absolute_path[delete_secret-params3-expected3] tests/unit/test_client_base.py::test_vault_client_base_absolute_path[list_secrets-params4-expected4] tests/unit/test_client_base.py::test_vault_client_base_absolute_path[list_secrets-params5-expected5] tests/unit/test_client_base.py::test_vault_client_base_absolute_path[set_secret-params6-expected6] tests/unit/test_client_base.py::test_vault_client_base_absolute_path[set_secret-params7-expected7] tests/unit/test_client_base.py::test_vault_client_base_build_full_path[foo-/base/foo] tests/unit/test_client_base.py::test_vault_client_base_build_full_path[/foo-/foo] tests/unit/test_client_base.py::test_vault_client_base_base_path[foo-/foo/] tests/unit/test_client_base.py::test_vault_client_base_base_path[foo/-/foo/] tests/unit/test_client_base.py::test_vault_client_base_base_path[foo//-/foo/] tests/unit/test_client_base.py::test_vault_client_base_base_path[/foo-/foo/] tests/unit/test_client_base.py::test_vault_client_base_base_path[/foo/-/foo/] tests/unit/test_client_base.py::test_vault_client_base_base_path[/foo//-/foo/] tests/unit/test_client_base.py::test_vault_client_base_get_secret_implicit_cache_ends tests/unit/test_client_base.py::test_vault_client_base_get_secret_implicit_cache_no_race_condition tests/unit/test_client_base.py::test_vault_client_base_get_secrets_implicit_cache_no_race_condition tests/unit/test_client_base.py::test_vault_client_base_get_secret_explicit_cache
vault_cli/client.py CHANGELOG.md
vault_cli/client.py CHANGELOG.md