From 74dc48a3ed5a35c495c54fe317c7df301b4f8a96 Mon Sep 17 00:00:00 2001
From: MrJack <36191829+biagiopietro@users.noreply.github.com>
Date: Mon, 22 Jun 2026 08:29:02 +0200
Subject: [PATCH] Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
---
 pkg/action/install.go | 11 +++++++----
 pkg/action/upgrade.go | 11 ++++++++---
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/pkg/action/install.go b/pkg/action/install.go
index b0dafe0ed..3d6daf759 100644
--- a/pkg/action/install.go
+++ b/pkg/action/install.go
@@ -421,22 +421,25 @@ func (i *Install) RunWithContext(ctx context.Context, ch ci.Charter, vals map[st
 
 	// Bail out here if it is a dry run
 	if isDryRun(i.DryRunStrategy) {
-		// For server-side dry-run, validate resources against the API server
+		// For server-side dry-run, validate resources against the API server.
+		// Force server-side apply in this path because kube dry-run semantics are
+		// only honored by the server-side apply create/update code paths.
 		if i.DryRunStrategy == DryRunServer {
+			serverSideDryRun := true
 			var err error
 			if len(toBeAdopted) == 0 && len(resources) > 0 {
 				_, err = i.cfg.KubeClient.Create(
 					resources,
-					kube.ClientCreateOptionServerSideApply(i.ServerSideApply, false),
+					kube.ClientCreateOptionServerSideApply(serverSideDryRun, false),
 					kube.ClientCreateOptionDryRun(true),
 				)
 			} else if len(resources) > 0 {
-				updateThreeWayMergeForUnstructured := i.TakeOwnership && !i.ServerSideApply
+				updateThreeWayMergeForUnstructured := i.TakeOwnership && !serverSideDryRun
 				_, err = i.cfg.KubeClient.Update(
 					toBeAdopted,
 					resources,
 					kube.ClientUpdateOptionForceReplace(i.ForceReplace),
-					kube.ClientUpdateOptionServerSideApply(i.ServerSideApply, i.ForceConflicts),
+					kube.ClientUpdateOptionServerSideApply(serverSideDryRun, i.ForceConflicts),
 					kube.ClientUpdateOptionDryRun(true),
 					kube.ClientUpdateOptionThreeWayMergeForUnstructured(updateThreeWayMergeForUnstructured),
 					kube.ClientUpdateOptionUpgradeClientSideFieldManager(true),
diff --git a/pkg/action/upgrade.go b/pkg/action/upgrade.go
index bd94ca880..945ff3062 100644
--- a/pkg/action/upgrade.go
+++ b/pkg/action/upgrade.go
@@ -400,12 +400,17 @@ func (u *Upgrade) performUpgrade(ctx context.Context, originalRelease, upgradedR
 		u.cfg.Logger().Debug("dry run for release", "name", upgradedRelease.Name)
 		// For server-side dry-run, validate resources against the API server
 		if u.DryRunStrategy == DryRunServer {
-			upgradeClientSideFieldManager := isReleaseApplyMethodClientSideApply(originalRelease.ApplyMethod) && serverSideApply
+			// Ensure this validation request is strictly non-mutating by always using
+			// server-side apply and disabling force-replace, regardless of the user's
+			// normal upgrade options.
+			dryRunServerSideApply := true
+			dryRunForceReplace := false
+			upgradeClientSideFieldManager := isReleaseApplyMethodClientSideApply(originalRelease.ApplyMethod) && dryRunServerSideApply
 			_, err := u.cfg.KubeClient.Update(
 				current,
 				target,
-				kube.ClientUpdateOptionForceReplace(u.ForceReplace),
-				kube.ClientUpdateOptionServerSideApply(serverSideApply, u.ForceConflicts),
+				kube.ClientUpdateOptionForceReplace(dryRunForceReplace),
+				kube.ClientUpdateOptionServerSideApply(dryRunServerSideApply, u.ForceConflicts),
 				kube.ClientUpdateOptionDryRun(true),
 				kube.ClientUpdateOptionUpgradeClientSideFieldManager(upgradeClientSideFieldManager),
 			)