fix(action): enable server-side validation for dry-run=server

When using --dry-run=server with --server-side=true, Helm now properly
validates manifests against the Kubernetes API server. Previously, the
dry-run would return early without calling the API, missing validation
errors like unknown fields in the spec.

This fix ensures that DryRunServer mode calls KubeClient.Create/Update
with the dry-run option, matching the behavior of kubectl apply
--dry-run=server.

Fixes: helm/helm#31505
Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>

pkg/action/install.go

@@ -394,6 +394,26 @@ func (i *Install) RunWithContext(ctx context.Context, ch ci.Charter, vals map[st
 
 	// Bail out here if it is a dry run
 	if isDryRun(i.DryRunStrategy) {
+		// For server-side dry-run, validate resources against the API server
+		if i.DryRunStrategy == DryRunServer && len(resources) > 0 {
+			if len(toBeAdopted) == 0 {
+				_, err = i.cfg.KubeClient.Create(
+					resources,
+					kube.ClientCreateOptionServerSideApply(i.ServerSideApply, false),
+					kube.ClientCreateOptionDryRun(true),
+				)
+			} else {
+				_, err = i.cfg.KubeClient.Update(
+					toBeAdopted,
+					resources,
+					kube.ClientUpdateOptionServerSideApply(i.ServerSideApply, i.ForceConflicts),
+					kube.ClientUpdateOptionDryRun(true),
+				)
+			}
+			if err != nil {
+				return rel, err
+			}
+		}
 		rel.Info.Description = "Dry run complete"
 		return rel, nil
 	}

pkg/action/install_test.go

@@ -412,6 +412,46 @@ func TestInstallRelease_DryRunClient(t *testing.T) {
 	}
 }
 
+func TestInstallRelease_DryRunServerValidation(t *testing.T) {
+	// Test that server-side dry-run actually calls the Kubernetes API for validation
+	is := assert.New(t)
+
+	// Use a fixture that returns dummy resources so our code path is exercised
+	config := actionConfigFixtureWithDummyResources(t, createDummyResourceList(false))
+
+	instAction := NewInstall(config)
+	instAction.Namespace = "spaced"
+	instAction.ReleaseName = "test-server-dry-run"
+
+	// Set up the fake client to return an error on Create
+	expectedErr := errors.New("validation error: unknown field in spec")
+	config.KubeClient.(*kubefake.FailingKubeClient).CreateError = expectedErr
+	instAction.DryRunStrategy = DryRunServer
+
+	vals := map[string]interface{}{}
+	_, err := instAction.Run(buildChart(withSampleTemplates()), vals)
+
+	// The error from the API should be returned
+	is.Error(err)
+	is.Contains(err.Error(), "validation error")
+
+	// Reset and test that client-side dry-run does NOT call the API
+	config2 := actionConfigFixtureWithDummyResources(t, createDummyResourceList(false))
+	config2.KubeClient.(*kubefake.FailingKubeClient).CreateError = expectedErr
+
+	instAction2 := NewInstall(config2)
+	instAction2.Namespace = "spaced"
+	instAction2.ReleaseName = "test-client-dry-run"
+	instAction2.DryRunStrategy = DryRunClient
+
+	resi, err := instAction2.Run(buildChart(withSampleTemplates()), vals)
+	// Client-side dry-run should succeed since it doesn't call the API
+	is.NoError(err)
+	res, err := releaserToV1Release(resi)
+	is.NoError(err)
+	is.Equal(res.Info.Description, "Dry run complete")
+}
+
 func TestInstallRelease_DryRunHiddenSecret(t *testing.T) {
 	is := assert.New(t)
 	instAction := installAction(t)

pkg/action/upgrade.go

@@ -392,6 +392,19 @@ func (u *Upgrade) performUpgrade(ctx context.Context, originalRelease, upgradedR
 
 	if isDryRun(u.DryRunStrategy) {
 		u.cfg.Logger().Debug("dry run for release", "name", upgradedRelease.Name)
+		// For server-side dry-run, validate resources against the API server
+		if u.DryRunStrategy == DryRunServer {
+			_, err := u.cfg.KubeClient.Update(
+				current,
+				target,
+				kube.ClientUpdateOptionForceReplace(u.ForceReplace),
+				kube.ClientUpdateOptionServerSideApply(serverSideApply, u.ForceConflicts),
+				kube.ClientUpdateOptionDryRun(true),
+			)
+			if err != nil {
+				return upgradedRelease, err
+			}
+		}
 		if len(u.Description) > 0 {
 			upgradedRelease.Info.Description = u.Description
 		} else {

pkg/action/upgrade_test.go

@@ -635,6 +635,63 @@ func TestUpgradeRelease_DryRun(t *testing.T) {
 	req.Error(err)
 }
 
+func TestUpgradeRelease_DryRunServerValidation(t *testing.T) {
+	// Test that server-side dry-run actually calls the Kubernetes API for validation
+	is := assert.New(t)
+	req := require.New(t)
+
+	// Use a fixture that returns dummy resources so our code path is exercised
+	config := actionConfigFixtureWithDummyResources(t, createDummyResourceList(true))
+
+	upAction := NewUpgrade(config)
+	upAction.Namespace = "spaced"
+
+	// Create a previous release
+	rel := releaseStub()
+	rel.Name = "test-server-dry-run"
+	rel.Info.Status = common.StatusDeployed
+	req.NoError(upAction.cfg.Releases.Create(rel))
+
+	// Set up the fake client to return an error on Update
+	expectedErr := errors.New("validation error: unknown field in spec")
+	config.KubeClient.(*kubefake.FailingKubeClient).UpdateError = expectedErr
+	upAction.DryRunStrategy = DryRunServer
+
+	vals := map[string]interface{}{}
+	ctx, done := context.WithCancel(t.Context())
+	_, err := upAction.RunWithContext(ctx, rel.Name, buildChart(), vals)
+	done()
+
+	// The error from the API should be returned
+	is.Error(err)
+	is.Contains(err.Error(), "validation error")
+
+	// Reset and test that client-side dry-run does NOT call the API
+	config2 := actionConfigFixtureWithDummyResources(t, createDummyResourceList(true))
+	config2.KubeClient.(*kubefake.FailingKubeClient).UpdateError = expectedErr
+
+	upAction2 := NewUpgrade(config2)
+	upAction2.Namespace = "spaced"
+
+	// Create a previous release
+	rel2 := releaseStub()
+	rel2.Name = "test-client-dry-run"
+	rel2.Info.Status = common.StatusDeployed
+	req.NoError(upAction2.cfg.Releases.Create(rel2))
+
+	upAction2.DryRunStrategy = DryRunClient
+
+	ctx, done = context.WithCancel(t.Context())
+	resi, err := upAction2.RunWithContext(ctx, rel2.Name, buildChart(), vals)
+	done()
+
+	// Client-side dry-run should succeed since it doesn't call the API
+	is.NoError(err)
+	res, err := releaserToV1Release(resi)
+	is.NoError(err)
+	is.Equal(res.Info.Description, "Dry run complete")
+}
+
 func TestGetUpgradeServerSideValue(t *testing.T) {
 	tests := []struct {
 		name                    string