When using version ranges like ^1 or ~1.10, Helm incorrectly showed
warnings about falling back to closest version. Only show the warning
when an exact version is requested but not found.
Fixes: https://github.com/helm/helm/issues/31757
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
Only user-supplied nils should survive coalescing. Chart-default nils
defaults, not just user overrides. This caused:
- %!s(<nil>) in templates using Bitnami common.secrets.key (#31919)
- pluck fallbacks returning nil instead of falling through to globals
(#31971)
Fixes#31919Fixes#31971
Signed-off-by: Johannes Lohmer <jojo.dev@lohmer.com>
Three test cases that cover the regression scenarios introduced
by the #31644 nil preservation fix:
- subchart default nils should be cleaned up
when parent doesn't set those keys (#31919)
- user-supplied null should erase subchart defaults (#31919)
- subchart default nil should not shadow global values via pluck (#31971)
Tests are expected to fail until the regression is fixed.
Signed-off-by: Johannes Lohmer <jojo.dev@lohmer.com>
When running 'helm pull --debug', no debug output was printed because
the HTTP getter did not emit any slog.Debug messages. This adds
slog.Debug calls to log the URL being fetched and the response status
when debug-level logging is enabled.
Fixeshelm/helm#31098
Signed-off-by: Cairon <cairon-ab@users.noreply.github.com>
Move implementation to pkg/kubeenv per review; kube.RetryingRoundTripper
remains a type alias for API compatibility. pkg/cli uses kubeenv only.
Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com>
The previous fix (increasing timeout / reducing deletion delay) did not
work because the flakiness is not a timing problem at all.
Root cause: fluxcd/cli-utils HasSynced() returns true after the initial
list item is *popped* from DeltaFIFO, which is before AddFunc delivers
the ResourceUpdateEvent to the collector. This creates a race where the
SyncEvent can arrive at the statusObserver *before* the pod's Current
status is recorded. When that happens:
- statusObserver sees pod as Unknown
- Unknown is skipped for WaitForDelete (by design, to handle resources
that were already deleted before watching started)
- AggregateStatus([], NotFoundStatus) == NotFoundStatus → cancel()
- The watch context is cancelled before DeleteFunc can fire
- Final check: pod still Current → error
The test intent is to verify that waitForDeleteCtx (not the cancelled
generalCtx) is selected. A non-existent resource satisfies this:
- With waitForDeleteCtx=Background(): informer syncs with empty list
→ Unknown → cancel → success ✓
- With generalCtx (cancelled, wrong): context immediately done
→ ctx.Err() appended → error returned ✓
Remove the goroutine-based deletion and the pod creation to eliminate
the race while preserving the context-selection assertion.
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
TestMethodContextOverridesGeneralContext/WaitForDelete used a 1s
timeout with a 500ms deletion delay, leaving only ~500ms for the
fake watcher to propagate the delete event. On loaded CI runners
this window is too tight and causes intermittent failures.
Increase the timeout to 5s and reduce the deletion delay to 100ms
so there is ample headroom. Apply the same deletion-delay reduction
to TestStatusWaitForDelete which shares the same pattern.
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
When Deployed() succeeds but releaserToV1Release() fails, prepareUpgrade
returned err (nil) instead of cerr (the conversion error), causing a
silent nil return that could lead to nil pointer dereferences downstream.
Closes#32007
Signed-off-by: Rhys McNeill <rhysmcneill7@hotmail.co.uk>
Move the retrying HTTP round-tripper used by EnvSettings into pkg/cli so
pkg/cli no longer imports pkg/kube, avoiding import cycles for Helm
library consumers while preserving retry behavior for transient API
server errors.
Add pkg/cli/roundtripper_test.go with parity coverage for the moved logic.
Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com>
Made-with: Cursor
Move the retrying round tripper used by EnvSettings into pkg/cli so
pkg/cli no longer imports pkg/kube. This preserves retry behavior while
breaking the import edge that triggers cycles for Helm library consumers
(such as the kustomize integration described in #31965).
Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com>
The toTOML doc comment said "returns empty string on marshal error"
but the implementation actually returns err.Error(). Fix the comment
to match the real behavior. Also mention mustToToml as the strict
alternative.
Signed-off-by: Ilya Kiselev <kis-ilya-a@yandex.ru>
Add `mustToToml` that panics on marshal error, consistent with
`mustToYaml` and `mustToJson`. This makes it possible for chart authors
to get a hard failure when TOML serialization fails, rather than having
to inspect the output manually.
`toToml` behavior is unchanged in this commit.
Closes#31430
Signed-off-by: Ilya Kiselev <kis-ilya-a@yandex.ru>
Remove pre-Go modules import path comments from pkg/kube test files
(ready_test.go, resource_test.go, statuswait_test.go) for consistency
with the rest of the package.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
Import path comments (e.g. `// import "helm.sh/helm/v4/pkg/kube"`) are
a pre-Go modules convention no longer needed in module-aware builds.
Some files in pkg/kube had these comments while others did not, causing
inconsistency that triggered downstream Kythe indexing errors.
Remove the import comments from all affected files to make the package
declaration consistent across the directory.
Fixes#31846
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: abhay1999 <abhaychaurasiya19@gmail.com>
- Clarify --show-rollback flag help text to specify it only affects table output
- Add RollbackRevision JSON round-trip tests for pkg/release/v1 and internal/release/v2
- Add omitempty behavior verification for zero rollback_revision
Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
Replace the always-visible ROLLBACK column with an opt-in --show-rollback
flag to avoid breaking the default table output (HIP-0004). JSON and YAML
formats continue to include rollback_revision when present via omitempty.
Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
The import comment in pkg/kube/statuswait.go still referenced
helm.sh/helm/v3/pkg/kube while all other files in the package
correctly reference helm.sh/helm/v4/pkg/kube. This mismatch
causes downstream processing errors (e.g. kythe) when vendoring
Helm.
Fixes#31846
Signed-off-by: rohansood10 <rohansood10@users.noreply.github.com>
Introduce release/v2 that mirrors pkg/release/v1 but uses *v3.Chart
from internal/chart/v3. The code is structurally identical to v1 with
only import paths changed to reference internal/chart/v3 instead of
pkg/chart/v2.
- Add internal/release/v2 with Release, Info, Hook types
- Add internal/release/v2/util with filter, sorter, manifest utilities
- Update pkg/release/common.go with v2Accessor and v2HookAccessor
- Copy all test files from pkg/release/v1 and add a v2 test in common_test.go
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
When multiple processes try to download the same chart version
concurrently (e.g., via Terraform), they can race to write the
destination file. On Windows, this results in 'Access Denied'
errors because the file cannot be renamed while another process
has a handle to the destination.
This commit introduces 'PlatformAtomicWriteFile' to the fileutil
package. On Unix-like systems, it simply delegates to AtomicWriteFile,
maintaining existing behavior. On Windows, it coordinates writes using
a lock file (.lock). It acquires the lock, then performs the atomic
write.
Crucially, this implementation ensures that existing files are
overwritten (rather than skipped). This ensures that if a chart is
republished with the same version, the local cache is correctly updated,
preventing stale data issues.
Fixes#31633
Signed-off-by: Orgad Shaneh <orgad.shaneh@audiocodes.com>
* feat(create): add hidden --chart-api-version flag
Add --chart-api-version flag to helm create command to allow selecting
chart API version (v2 or v3) when creating a new chart.
- Default is v2 (existing behavior unchanged)
- v3 uses internal/chart/v3 scaffold generator
- Invalid versions return clear error message
- Works with --starter flag
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
* Add HELM_EXPERIMENTAL_CHART_V3 feature gate to create command
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
* make chartv3 private and use loader to load the chart
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
* Hide chart-api-version flag until chart v3 is officially released
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
* Conditionally hide the --chart-api-version flag if chart v3 is not enabled
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
* Add internal gates package for internal feature gates
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
* Add doc for internal/gates package
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
---------
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
The --hide-notes and --render-subchart-notes flags have no effect for
`helm template` since template output never includes notes. Mark these
flags as deprecated and hide them from help output.
The flags are preserved for backwards compatibility in Helm 4 and will
be removed in Helm 5.
Fixes#31752
Signed-off-by: Scott Rigby <scott@r6by.com>
Improve the description to explain the three usage scenarios:
- --wait alone defaults to 'watcher' strategy
- --wait=<value> uses the specified strategy
- flag omitted defaults to 'hookOnly'
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
Signed-off-by: Manuel Alonso Gonzalez <434575+manute@users.noreply.github.com>
Signed-off-by: Manuel Alonso Gonzalez <m.alonso@Manuels-MacBook-Pro.local>
The --api-versions flag was undocumented in the template command's
help text. This adds usage documentation and examples showing both
comma-separated and multiple flag usage patterns.
Fixes#13198
Signed-off-by: majiayu000 <1835304752@qq.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Signed-off-by: majiayu000 <1835304752@qq.com>
Tests were failing for cli-utils watcher because upstream k8s made
changes that impacted cli-utils. In k8s WatchListClient is now
enabled by default. Fake clients used for testing don't know this
semantic. cli-utils leverages reflection in k8s to handle this.
The Helm tests didn't handle this well.
The tests are updated to use PrependReactor and PrependWatchReactor
in the same way that cli-utils does for testing. This works without
wrapping the client.
Signed-off-by: Matt Farina <matt.farina@suse.com>
add missing coverage for the positive case where cluster-scoped resources (like ClusterRole or Namespace) should work correctly
Signed-off-by: Mohsen Mottaghi <mohsenmottaghi@outlook.com>
Adding some tests for multi namespace deployment, simulate restrcited rbac access and mixed namespace scope and cluster scope resources
Signed-off-by: Mohsen Mottaghi <mohsenmottaghi@outlook.com>
In GoLang, using the == operator to check for a certain error will not
unwrap the error chain, and therefore may hide the problem.
Signed-off-by: Mads Jensen <atombrella@users.noreply.github.com>
Only delete nil user values when overriding a non-nil chart default.
When chart has empty map or no default for a key, preserve user's nil.
| Scenario | Result |
|----------|--------|
| User sets `baz: ~`, chart has `baz: "value"` | Key deleted |
| User sets `baz: ~`, chart has empty map `{}` | Nil preserved |
| User sets `baz: ~`, chart has `baz: ~` | Nil preserved |
Fixes#31643
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
When running `helm upgrade --install` on a non-existent release, the
--server-side flag was not being passed to the install action. This
caused the install to always use server-side apply (the default),
ignoring --server-side=false.
Copy ServerSideApply and ForceConflicts from the upgrade client to the
install client when falling back to install.
Fixes#31627
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
This commit adds ownership verification to the uninstall action. It checks that the resource to be deleted is owned by the chart before deleting it.
Fixes: #31333
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
```
Error: pkg/action/release_testing.go:60:57: unexported-return: exported method Run returns unexported type action.executeShutdownFunc, which can be annoying to use (revive)
func (r *ReleaseTesting) Run(name string) (ri.Releaser, executeShutdownFunc, error) {
```
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
Fixes#31333
Helm uninstall now verifies resource ownership before deletion by checking
Helm labels and annotations. Resources not owned by the release being
uninstalled are skipped with warnings, preventing accidental deletion of
resources belonging to other releases.
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
The rangeint suggestion is faster.
The maps.Copy and slices.Contains are just syntatic sugar.
Signed-off-by: Mads Jensen <atombrella@users.noreply.github.com>
The kube client logging is based on the actionConfig logging. This
is setup to use slog.Default() before the logging flags are parsed
and logging is setup.
newRootCmdWithConfig changes the logging but it wasn't picked up
for actionConfig or the kube client. This change updates the logging
to include any changes.
Signed-off-by: Matt Farina <matt.farina@suse.com>
Adds chart name to dependency logs, namespace to resource waiting logs,
and confirmation message when all resources are ready.
Addresses #31520
Signed-off-by: shuv0id <110290476+shuv0id@users.noreply.github.com>
Helm 3.19.0 introduced a regression where vendor-specific suffixes
(e.g., -gke.1245000, -eks-4096722, +) are stripped from
.Capabilities.KubeVersion.GitVersion, breaking charts that detect
managed Kubernetes platforms.
The root cause was using k8sversion.ParseGeneric().String() which
intentionally discards vendor suffixes. The fix stores both the full
version (with vendor suffix) and a normalized version. String() returns
the normalized version for constraint checking (e.g., ">= 1.21.0"),
while Version/GitVersion preserve the full string for template access.
Fixes#31423
Related to #31063, #31078
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
While testing SDK features for v4. I was surprised with the error:
"reporter failed to start: event funnel closed: context deadline exceeded"
This occurs when no timeout is set:
```
upgradeClient := action.NewUpgrade(actionConfig)
upgradeClient.WaitStrategy = kube.StatusWatcherStrategy
// When Timeout is zero, the status wait uses a context with zero timeout which
// immediately expires causing "context deadline exceeded" errors.
upgradeClient.Timeout = 2 * time.Minute
```
With this patch it will work without specifying.
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
Benoit Tigeot
Matheus Pimenta
MrJack
Terry Howe
George Jenkins
Evans Mungai
Johannes Lohmer
Johannes Lohmer
Jorge Rocamora
Cairon
Sumit Solanki
Anmol Virdi
Rhys McNeill
abhay1999
Debasish Mohanty
Ilya Kiselev
Matthieu MOREL
tsinglua
Travis Leeden
Mads Jensen
rohansood10
Matt Farina
Joe Julian
Orgad Shaneh
Manuel Alonso
Pedro Tôrres
Scott Rigby
Austin Abro
Manuel Alonso
Feruzjon Muyassarov
majiayu000
Mujib Ahasan
Brenden Ehlers
Branch Vincent
Deepak Chethan
Mohsen Mottaghi
tison
Robert Sirchia
wangjingcun
Zadkiel AHARONIAN
Stephanie Hohenberg
Calvin Bui
Michelle Fernandez Bieber
Michelle Fernandez Bieber
megha1906
shuv0id
promalert
Benoit Tigeot