`helm upgrade --dependency-update` built its downloader.Manager without a
RegistryClient, unlike the identical literals in install, dependency update,
and dependency build. Resolving an OCI chart dependency whose version is a
range then dereferenced a nil *registry.Client in registry.(*Client).Tags,
panicking the process. Pass the registry client already constructed for the
command, matching install.
Add a regression test that runs `upgrade --dependency-update` against a chart
with an unresolved OCI dependency and asserts the command returns an error
instead of panicking.
Signed-off-by: Gates Wang <9372086+SetagGnaw@users.noreply.github.com>
* fix: enable concurrent status computation to prevent multi-minute delays
Set StatusComputeWorkers=8 on DefaultStatusWatcher for Wait,
WaitWithJobs, and WatchUntilReady. This opts in to the async status
computation added in fluxcd/cli-utils#20, preventing the informer
notification pipeline from being blocked by slow API calls when many
resources are updated simultaneously.
Without this, status computation for resources like Deployments (which
require additional LIST ReplicaSets/Pods calls) runs serially inside
the informer, causing growing delays of 1-3+ minutes when upgrading
many resources at once (e.g., ~20 Deployments via Helm).
Signed-off-by: maplemiao <maplemiao@tencent.com>
* refactor(kube): expose StatusComputeWorkers as a WaitOption
Replace the package-level DefaultStatusComputeWorkers variable with a
WithStatusComputeWorkers WaitOption threaded through waitOptions into
the statusWaiter. This removes global mutable state from pkg/kube and
lets callers opt in explicitly.
SDK consumers (e.g. helm-controller) inherit the zero value, which
preserves the upstream cli-utils synchronous behavior and avoids an
unexpected fan-out of status-compute goroutines when many releases
reconcile concurrently. The Helm CLI continues to enable 8 workers by
default via a shared pkg/cmd/flags.go helper, so install/upgrade/
rollback/uninstall/test users still get the fix for multi-minute
informer stalls out of the box.
Signed-off-by: maplemiao <maplemiao@tencent.com>
* refactor(kube): clamp negative StatusComputeWorkers values to zero
Address review feedback: when a caller passes a negative value to
WithStatusComputeWorkers, coerce it to zero rather than propagating
it to the underlying cli-utils watcher, where the behavior is
undefined. Zero is the safe default and matches the SDK opt-in
contract.
Signed-off-by: maplemiao <maplemiao@tencent.com>
---------
Signed-off-by: maplemiao <maplemiao@tencent.com>
Signed-off-by: Maple Miao <maplemiao@yunzhanghu.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Pre-Go-modules import path comments (e.g. `// import "helm.sh/helm/v4/..."`)
are obsolete since Go 1.11 where go.mod is the authoritative module path.
These stale comments cause issues with downstream tooling such as Kythe.
Removes the legacy import comments from 64 files across 20 packages:
- cmd/helm
- internal/chart/v3/lint and sub-packages
- internal/plugin and sub-packages
- internal/release/v2/util
- pkg/chart/v2/lint and sub-packages
- pkg/cmd, pkg/engine, pkg/ignore, pkg/provenance
- pkg/registry
- pkg/release/v1/util
- pkg/repo/v1
- pkg/storage and pkg/storage/driver
Follows up on #31931 and #31932 which addressed pkg/kube.
Fixes#31846
Signed-off-by: abhay1999 <abhay.chaurasiya@example.com>
Signed-off-by: abhay1999 <abhaychaurasiya19@gmail.com>
* feat: honor SOURCE_DATE_EPOCH for chart archives
Add StampModTimes() on Chart struct to recursively set ModTime on
all chart file entries. CLI reads SOURCE_DATE_EPOCH env var and wires
through all 5 commands: package, install, upgrade, dep build, dep update.
Removes unused v3 duplicate source_date_epoch.go (YAGNI).
Inlines env var parsing to CLI layer from chart util.
Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>
* docs: document SOURCE_DATE_EPOCH in environment variables help
Add a short entry for $SOURCE_DATE_EPOCH to the env var table shown
in 'helm help'. The variable is honored by 'helm package', 'install',
'upgrade', 'dep build', and 'dep update' to produce reproducible chart
archives. Full documentation belongs in helm-www.
Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>
* fix: adapt SourceDateEpoch to upstream refactored dep check
Upstream/main restructured the dependency error handling in install.go
and upgrade.go from a nested-if block (if DependencyUpdate) to an
early-return pattern (if !DependencyUpdate). Adapt the feature's
Manager construction to match the new code structure.
Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>
---------
Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>
* Fix missing conflict retry with server-side apply
Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>
* Only retry on resourcequota transient conflict
Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>
* Use isServerSideRetryable + naming nitpick
Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>
---------
Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>
Files.Lines guards against a nil entry but an empty file inside a
chart is stored as a non-nil zero-length byte slice, so the trailing
newline check indexes s[-1] and panics. The engine recovers the panic
into a render error, making every template/install/upgrade/lint that
references the file fail.
Extend the guard to len(f[path]) == 0 and return an empty slice,
matching the behaviour for missing files.
Fixes#32279
Signed-off-by: Mahesh Sadupalli <mahesh.sadupalli@gmail.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: kimsungmin1 <142377392+kimsungmin1@users.noreply.github.com>
- Use (*net.ListenConfig).Listen with the test context instead of
net.Listen (noctx).
- Use suite.NoError instead of suite.Nil for the error check
(testifylint).
- Drop the unnecessary leading blank lines in the scope test funcs
(whitespace).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
The scope test configured a TLS registry while advertising an http token
realm. oras refuses to send credentials to an http token realm when the
registry itself was contacted over https, so the auth server was never
reached and the test timed out ("timeout waiting for auth request").
Use a plain-http registry so the registry and token-realm schemes match;
the scope carried in the token request is what this test verifies, and
that is independent of TLS.
Also make the auth handler's channel send non-blocking so that a client
retry can never block the handler and stall the push/pull flow, which
addresses the review comment about a potential deadlock.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
- Fix data race by using channel instead of shared variable for requestURL
- Make assertions more robust by parsing URL and checking query parameters instead of exact string matching
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
- Change 'bellow' to 'below' (spelling correction in multiple places)
- Change 'WithScopeHint' to 'withScopeHint' to match actual function name
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
- Change DockerRegistryHost to use 127.0.0.1 for HTTP tests and helm-test-registry for TLS tests to match certificate hostname
- Add defer ln.Close() to prevent resource leak in token auth server setup
- Restore requestURL variable and assertion in test body instead of handler to avoid potential race condition
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
Replace native Go testing patterns (t.Errorf, t.Fatalf, t.Error,
t.Fatal) with github.com/stretchr/testify equivalents (assert.X,
require.X) for improved test readability and error messages.
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
Replace native Go testing patterns (t.Errorf, t.Fatalf, t.Error,
t.Fatal) with github.com/stretchr/testify equivalents (assert.X,
require.X) for improved test readability and error messages.
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
Replace native Go testing patterns (t.Errorf, t.Fatalf, t.Error,
t.Fatal) with github.com/stretchr/testify equivalents (assert.X,
require.X) for improved test readability and error messages.
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
Replace native Go testing patterns (t.Errorf, t.Fatalf, t.Error,
t.Fatal) with github.com/stretchr/testify equivalents (assert.X,
require.X) for improved test readability and error messages.
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
Replace native Go testing patterns (t.Errorf, t.Fatalf, t.Error,
t.Fatal) with github.com/stretchr/testify equivalents (assert.X,
require.X) for improved test readability and error messages.
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
Replace native Go testing patterns (t.Errorf, t.Fatalf, t.Error,
t.Fatal) with github.com/stretchr/testify equivalents (assert.X,
require.X) for improved test readability and error messages.
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
Convert pkg/gates, pkg/kubeenv, pkg/ignore, and pkg/helmpath test
files from native Go testing patterns (t.Errorf, t.Fatalf, t.Error,
t.Fatal) to github.com/stretchr/testify equivalents (assert.X,
require.X).
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
- only cache kube client when creation succeeds
- add regression test for two failed reachability checks
Signed-off-by: Mohammad Abdolirad <m.abdolirad@gmail.com>
* fix: protect FailingKubeClient.RecordedWaitOptions from concurrent access
Add a sync.Mutex to guard the append to RecordedWaitOptions in
GetWaiterWithOptions, fixing a data race detected by -race when
concurrent goroutines (e.g. upgrade + rollback) both call
GetWaiterWithOptions on the same FailingKubeClient instance.
Fixes race failures in TestUpgradeRelease_Interrupted_RollbackOnFailure
and TestInstallRelease_RollbackOnFailure_Interrupted.
Signed-off-by: Terry Howe <thowe@nvidia.com>
* fix: extract appendRecordedWaitOptionsLocked helper with defer unlock
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---------
Signed-off-by: Terry Howe <thowe@nvidia.com>
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
Commands like 'helm registry login', 'helm push', and 'helm pull' were
writing success messages ("Login Succeeded", "Pushed:", "Pulled:",
"Digest:") to stderr instead of stdout. The root cause was that
newDefaultRegistryClient and newRegistryClientWithTLS hard-coded
os.Stderr as the registry client writer, ignoring the out io.Writer
that main() passes as os.Stdout.
Thread out io.Writer through newRegistryClient, newDefaultRegistryClient,
and newRegistryClientWithTLS, and update all call sites in pkg/cmd.
Fixes#13464
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
When lookup cannot find the requested resource (apierrors.IsNotFound),
add slog.Debug() calls with structured fields (apiVersion, kind,
namespace, name) so that users running helm template --debug can see
why lookup returned an empty map instead of silently swallowing the
not-found result.
Fixes: https://github.com/helm/helm/issues/32101
Signed-off-by: Ogulcan Aydogan <ogulcanaydogan@hotmail.com>
Return the actual error from io.Copy in Digest() instead of nil.
The previous code swallowed the error and returned an empty string
as a valid SHA-256 digest, which could silently break chart
provenance verification.
Also fix encodeRelease() in pkg/storage/driver/util.go:
- Close the gzip writer on the w.Write() error path to avoid
leaking resources.
- Check the error return from gzip.Writer.Close(), which flushes
remaining compressed data and can fail.
Assisted-by: Grok/xAI
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
Matthieu MOREL
Terry Howe
Gates Wang
Zhaofeng Miao
Abhay Chaurasiya
George Jenkins
Lohit Kolluri
Jakub Jaruszewski
Matheus Pimenta
LarytheLord
Mahesh Sadupalli
kimsungmin1
kimsm28
Will Noble
Will Noble
s3onghyun
Jeaeun Kim
Evans Mungai
Mohammad Abdolirad
Ogulcan Aydogan
MrJack
Austin Abro
Sebastien Tardif