From 9f1c738027feb041ac4b21b0f03f233b53de75d9 Mon Sep 17 00:00:00 2001
From: MrJack <36191829+biagiopietro@users.noreply.github.com>
Date: Sun, 30 Aug 2026 11:23:04 +0200
Subject: [PATCH] fix(action): error when --dry-run=server is combined with
 --server-side=false on upgrade

Client-side update paths do not honor the dry-run flag, so validating under
SSA semantics when the real upgrade would use CSA gives misleading results.
Return an explicit error instead of silently forcing SSA.

Also use the computed serverSideApply value directly to avoid forcing SSA,
and gate UpgradeClientSideFieldManager on whether the previous release used
CSA (matching the real upgrade path).

Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
---
 pkg/action/upgrade.go | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/pkg/action/upgrade.go b/pkg/action/upgrade.go
index 0ed6ab45c..fc5c7517b 100644
--- a/pkg/action/upgrade.go
+++ b/pkg/action/upgrade.go
@@ -399,17 +399,15 @@ func (u *Upgrade) performUpgrade(ctx context.Context, originalRelease, upgradedR
 		u.cfg.Logger().Debug("dry run for release", "name", upgradedRelease.Name)
 		// For server-side dry-run, validate resources against the API server
 		if u.DryRunStrategy == DryRunServer {
-			// Ensure this validation request is strictly non-mutating by always using
-			// server-side apply and disabling force-replace, regardless of the user's
-			// normal upgrade options.
-			dryRunServerSideApply := true
-			dryRunForceReplace := false
-			upgradeClientSideFieldManager := isReleaseApplyMethodClientSideApply(originalRelease.ApplyMethod) && dryRunServerSideApply
+			if !serverSideApply {
+				return upgradedRelease, errors.New("--dry-run=server requires --server-side=true")
+			}
+			upgradeClientSideFieldManager := isReleaseApplyMethodClientSideApply(originalRelease.ApplyMethod)
 			_, err := u.cfg.KubeClient.Update(
 				current,
 				target,
-				kube.ClientUpdateOptionForceReplace(dryRunForceReplace),
-				kube.ClientUpdateOptionServerSideApply(dryRunServerSideApply, u.ForceConflicts),
+				kube.ClientUpdateOptionForceReplace(false),
+				kube.ClientUpdateOptionServerSideApply(serverSideApply, u.ForceConflicts),
 				kube.ClientUpdateOptionDryRun(true),
 				kube.ClientUpdateOptionUpgradeClientSideFieldManager(upgradeClientSideFieldManager),
 			)