Upgrade Helm to v4.1.0 #1383
Upgrade Helm to v4.1.0 #1383
Conversation
matheuscscp
force-pushed
the
helm4
branch
2 times, most recently
from
c5d3af6 to
d8f6c12
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
matheuscscp
force-pushed
the
helm4
branch
9 times, most recently
from
3f4094f to
b918924
Compare
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
Add ServerSideApply field to Install, Upgrade, and Rollback specs
allowing users to control server-side apply behavior per action.
- Install.ServerSideApply: *bool (default based on UseHelm3Defaults)
- Upgrade.ServerSideApply: *string ("true", "false", "auto")
- Rollback.ServerSideApply: *string ("true", "false", "auto")
User-specified values take precedence over defaults. When not
specified, the existing default behavior is preserved.
Signed-off-by: cappyzawa <cappyzawa@gmail.com>
Add end-to-end tests to verify the ServerSideApply field works correctly for install, upgrade, and rollback operations. The tests verify that when serverSideApply is set, the Helm release uses the SSA apply method (apply_method: ssa in the release secret). Signed-off-by: cappyzawa <cappyzawa@gmail.com>
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
This adds the `.status.inventory` field to HelmRelease, similar to Kustomization, to expose managed Kubernetes objects. The inventory includes: - Objects from the release manifest (with namespace complement) - CRDs from the chart's crds/ directory Helm hooks are excluded as they are ephemeral resources deleted after execution. Signed-off-by: cappyzawa <cappyzawa@gmail.com>
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
matheuscscp
force-pushed
the
helm4
branch
6 times, most recently
from
b0382d2 to
ac5b312
Compare
matheuscscp
force-pushed
the
helm4
branch
4 times, most recently
from
203b6bb to
4f120a1
Compare
Server-Side Apply (SSA) vs Client-Side Apply (CSA) E2E TestsThis PR adds comprehensive e2e tests to verify the SSA/CSA behavior of Test Overview
How We Verify SSA vs CSAThe tests check the
Upgrades are triggered by patching Test 1: CSA Install with CSA Upgrade (
|
Issue: All HelmReleases upgraded on controller restartWhen upgrading the helm-controller to this branch, all existing HelmReleases are upgraded even though nothing changed in their specs. This is problematic for production environments. Observed BehaviorAfter updating the helm-controller deployment image, the logs show: This appears for all HelmReleases, followed by an upgrade action for each one. Root Cause Analysis1. cur := req.Object.Status.History.Latest()
if err := action.VerifyReleaseObject(cur, rls); err != nil {
if interrors.IsOneOf(err, action.ErrReleaseDigest, action.ErrReleaseNotObserved) {
return ReleaseState{Status: ReleaseStatusUnmanaged, Reason: err.Error()}, nil
}
}2. func VerifyReleaseObject(snapshot *v2.Snapshot, rls *helmrelease.Release) error {
relDig, err := digest.Parse(snapshot.Digest)
verifier := relDig.Verifier()
obs := release.ObserveRelease(rls)
obs.OCIDigest = snapshot.OCIDigest
if err = obs.Encode(verifier); err != nil { ... }
if !verifier.Verified() {
return ErrReleaseNotObserved // <-- This is the error
}
}3.
The ProblemThe controller computes a digest of the Helm release (including the manifest and chart metadata) and compares it to the stored When upgrading from Helm v3 to Helm v4, the release data structure likely changed (different manifest format, chart metadata fields, hook structures, etc.), causing the digest to no longer match. The controller interprets this as:
This is a breaking change when upgrading the helm-controller - all existing releases will be re-upgraded because their digests no longer verify against the stored snapshots. |
Proposed Solution for Digest Verification MigrationProblemWhen upgrading helm-controller from Helm v3 to v4, the digest computation for release snapshots changes due to structural differences in the Helm release objects. This causes Root CauseThe SolutionUse the existing ChangesHow It Works
Migration Behavior
Legacy in-sync releases will continue to skip digest verification until they are upgraded for a legitimate reason (chart version change, values change, etc.). This is acceptable because:
|
|
@matheuscscp when drift detection is enabled, will it trip over the |
Apparently, no! Same behavior as no drift detection. 🟢 |
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
stefanprodan
left a comment
stefanprodan
left a comment
There was a problem hiding this comment.
Please add the SSA field to the API docs
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
Depends on: fluxcd/pkg#1069
Closes: #1300