0fd2c418b0
Fix rollback for missing resources
...
Signed-off-by: Feruzjon Muyassarov <feruzjon.muyassarov@est.tech>
(cherry picked from commit 374aeb4b4e
3 weeks ago
32e2d08c45
logs
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
(cherry picked from commit a9cdc78116
2 months ago
4b6472ffb0
fix
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
(cherry picked from commit b1a976073f
2 months ago
9dfe3b35ec
fix: Use server-side apply for object create during update
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
(cherry picked from commit 18616e6ce9
2 months ago
efc1702657
Introduce a context for canceling wait operations
...
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
3 months ago
b6eca1c0f1
Refactor logging functionality to use slog.Handler
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
3 months ago
5ab4ca5490
Embed logging functionality to DRY code
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
4 months ago
50e43f4017
nil logger should be handled by discard handler
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
4 months ago
7a5816b106
Self review changes
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
4 months ago
0f90c83118
Merge remote-tracking branch 'upstream/main' into em/reinstate-logger-param
4 months ago
b1d4dc680d
feat: reinstate logger parameter to actions package
...
Fixes : #31399
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
4 months ago
752354074c
Merge pull request #31393 from benoittgt/12299
...
Return errors during upgrade when the deletion of resources fails
4 months ago
3f860e83fb
fix: use empty results instead of nil
...
Signed-off-by: Jesse Simpson <jesse.simpson36@gmail.com>
4 months ago
054eabddd7
Return errors on upgrade when deletion fails
...
This is a rebase of https://github.com/helm/helm/pull/12299
as the pull request was tagged for Helm v4.
Closes: https://github.com/helm/helm/issues/11375
Related: https://github.com/helm/helm/pull/7929
It was a pain to reproduce, here is a script:
```
set -u
NS=default
RELEASE=test-release
CHART=./test-chart
SA=limited-helm-sa
HELM=${HELM:-./bin/helm}
echo "Helm: $($HELM version)"
echo "Cleaning…"
$HELM uninstall "$RELEASE" -n "$NS" >/dev/null 2>&1 || true
kubectl -n "$NS" delete sa "$SA" role "${SA}-role" rolebinding "${SA}-rb" >/dev/null 2>&1 || true
kubectl -n "$NS" delete cronjob "$RELEASE-test-chart-cronjob" >/dev/null 2>&1 || true
rm -rf "$CHART" /tmp/limited-helm-kubeconfig
echo "Create minimal chart with only a CronJob"
$HELM create "$CHART" >/dev/null
rm -f "$CHART"/templates/{deployment.yaml,service.yaml,hpa.yaml,tests/test-connection.yaml,serviceaccount.yaml}
cat > "$CHART/templates/cronjob.yaml" <<'YAML'
apiVersion: batch/v1
kind: CronJob
metadata:
name: {{ include "test-chart.fullname" . }}-cronjob
spec:
schedule: "*/5 * * * *"
jobTemplate:
spec:
template:
spec:
restartPolicy: OnFailure
containers:
- name: hello
image: busybox
command: ["/bin/sh","-c","date; echo Hello from CronJob"]
YAML
echo "RBAC: allow Helm storage, basic reads/creates, but NO delete on cronjobs"
kubectl -n "$NS" apply -f - >/dev/null <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
name: $SA
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: ${SA}-role
rules:
- apiGroups: [""]
resources: ["secrets","configmaps"]
verbs: ["get","list","watch","create","patch","update","delete"]
- apiGroups: [""]
resources: ["pods","events"]
verbs: ["get","list","watch"]
- apiGroups: ["batch"]
resources: ["cronjobs"]
verbs: ["get","list","watch","create","patch","update"]
EOF
kubectl -n "$NS" apply -f - >/dev/null <<EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: ${SA}-rb
subjects:
- kind: ServiceAccount
name: $SA
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: ${SA}-role
EOF
echo "Create kubeconfig for that SA"
TOKEN=$(kubectl -n "$NS" create token "$SA")
SERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
CA_DATA=$(kubectl config view --minify --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}')
KCFG=/tmp/limited-helm-kubeconfig
cat > "$KCFG" <<EOF
apiVersion: v1
kind: Config
clusters:
- name: local
cluster:
server: $SERVER
certificate-authority-data: $CA_DATA
contexts:
- name: limited
context:
cluster: local
namespace: $NS
user: $SA
current-context: limited
users:
- name: $SA
user:
token: $TOKEN
EOF
set +e
echo "Install (as limited SA)"
KUBECONFIG="$KCFG" $HELM upgrade --install "$RELEASE" "$CHART" -n "$NS" --wait
echo "CronJob after install:"
kubectl -n "$NS" get cronjob "$RELEASE-test-chart-cronjob" || true
echo "Remove CronJob from chart and add a small ConfigMap to force an upgrade"
rm -f "$CHART/templates/cronjob.yaml"
cat > "$CHART/templates/configmap.yaml" <<'YAML'
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "test-chart.fullname" . }}-config
data:
hello: world
YAML
echo "Upgrade without CronJob (as limited SA)"
KUBECONFIG="$KCFG" $HELM upgrade --install "$RELEASE" "$CHART" -n "$NS"
RC=$?
echo "Post-upgrade verification"
if kubectl -n "$NS" get cronjob "$RELEASE-test-chart-cronjob" >/dev/null 2>&1; then
echo "OK: Stale CronJob still present: $RELEASE-test-chart-cronjob"
else
echo "NO_OK: CronJob deleted"
fi
echo "Helm exit code: $RC"
exit 0
```
With the current build:
```sh
./reproduce-helm-issue.sh
Helm: version.BuildInfo{Version:"v4.0+unreleased", GitCommit:"f19bb9cd4c99943f7a4980d6670de44affe3e472", GitTreeState:"dirty", GoVersion:"go1.24.0"}
Cleaning…
Create minimal chart with CronJob + ConfigMap (we will remove both in v2)
RBAC: allow Helm storage + delete for configmaps, but NO delete on cronjobs
Create kubeconfig for that SA
Install v1 (as limited SA)
Release "test-release" does not exist. Installing it now.
NAME: test-release
LAST DEPLOYED: Tue Oct 14 18:55:57 2025
NAMESPACE: default
STATUS: deployed
REVISION: 1
DESCRIPTION: Install complete
TEST SUITE: None
NOTES:
1. Get the application URL by running these commands:
export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=test-chart,app.kubernetes.io/instance=test-release" -o jsonpath="{.items[0].metadata.name}")
export CONTAINER_PORT=$(kubectl get pod --namespace default $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
echo "Visit http://127.0.0.1:8080 to use your application"
kubectl --namespace default port-forward $POD_NAME 8080:$CONTAINER_PORT
Verify v1 objects exist
NAME SCHEDULE TIMEZONE SUSPEND ACTIVE LAST SCHEDULE AGE
test-release-test-chart-cronjob */5 * * * * <none> False 0 <none> 0s
NAME DATA AGE
test-release-test-chart-config 1 0s
Prepare v2: remove BOTH CronJob and ConfigMap from the chart
Upgrade to v2 (as limited SA) — expecting CronJob delete first, then ConfigMap
- CronJob delete should FAIL (no delete permission)
- ConfigMap delete should SUCCEED (delete allowed) — proves 'continue on error' and inverted order
level=DEBUG msg="getting history for release" release=test-release
level=DEBUG msg="getting release history" name=test-release
level=DEBUG msg="preparing upgrade" name=test-release
level=DEBUG msg="getting last revision" name=test-release
level=DEBUG msg="getting release history" name=test-release
level=DEBUG msg="number of dependencies in the chart" dependencies=0
level=DEBUG msg="determined release apply method" server_side_apply=true previous_release_apply_method=ssa
level=DEBUG msg="performing update" name=test-release
level=DEBUG msg="creating upgraded release" name=test-release
level=DEBUG msg="creating release" key=sh.helm.release.v1.test-release.v2
level=DEBUG msg="getting release history" name=test-release
level=DEBUG msg="using server-side apply for resource update" forceConflicts=false dryRun=false fieldValidationDirective=Strict upgradeClientSideFieldManager=false
level=DEBUG msg="checking resources for changes" resources=0
level=DEBUG msg="deleting resource" namespace=default name=test-release-test-chart-config kind=ConfigMap
level=DEBUG msg="deleting resource" namespace=default name=test-release-test-chart-cronjob kind=CronJob
level=DEBUG msg="failed to delete resource" namespace=default name=test-release-test-chart-cronjob kind=CronJob error="cronjobs.batch \"test-release-test-chart-cronjob\" is forbidden: User \"system:serviceaccount:default:limited-helm-sa\" cannot delete resource \"cronjobs\" in API group \"batch\" in the namespace \"default\""
level=INFO msg="update completed" created=0 updated=0 deleted=1
level=WARN msg="update completed with errors" errors=1
level=DEBUG msg="updating release" key=sh.helm.release.v1.test-release.v1
level=WARN msg="upgrade failed" name=test-release error="failed to delete resource test-release-test-chart-cronjob: cronjobs.batch \"test-release-test-chart-cronjob\" is forbidden: User \"system:serviceaccount:default:limited-helm-sa\" cannot delete resource \"cronjobs\" in API group \"batch\" in the namespace \"default\""
level=DEBUG msg="updating release" key=sh.helm.release.v1.test-release.v2
Error: UPGRADE FAILED: failed to delete resource test-release-test-chart-cronjob: cronjobs.batch "test-release-test-chart-cronjob" is forbidden: User "system:serviceaccount:default:limited-helm-sa" cannot delete resource "cronjobs" in API group "batch" in the namespace "default"
Post-upgrade verification
Stale CronJob still present: test-release-test-chart-cronjob (expected if delete is forbidden)
ConfigMap deleted as expected: test-release-test-chart-config (and after CronJob attempt)
Helm exit code: 1
```
With last version v3.19:
```
HELM=/usr/local/bin/helm ./reproduce-helm-issue.sh
Helm: version.BuildInfo{Version:"v3.19.0", GitCommit:"3d8990f0836691f0229297773f3524598f46bda6", GitTreeState:"clean", GoVersion:"go1.24.7"}
Cleaning…
Create minimal chart with only a CronJob
RBAC: allow Helm storage, basic reads/creates, but NO delete on cronjobs
Create kubeconfig for that SA
Install (as limited SA)
Release "test-release" does not exist. Installing it now.
NAME: test-release
LAST DEPLOYED: Tue Oct 14 19:07:01 2025
NAMESPACE: default
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
1. Get the application URL by running these commands:
export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=test-chart,app.kubernetes.io/instance=test-release" -o jsonpath="{.items[0].metadata.name}")
export CONTAINER_PORT=$(kubectl get pod --namespace default $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
echo "Visit http://127.0.0.1:8080 to use your application"
kubectl --namespace default port-forward $POD_NAME 8080:$CONTAINER_PORT
CronJob after install:
NAME SCHEDULE TIMEZONE SUSPEND ACTIVE LAST SCHEDULE AGE
test-release-test-chart-cronjob */5 * * * * <none> False 0 <none> 0s
Remove CronJob from chart and add a small ConfigMap to force an upgrade
Upgrade without CronJob (as limited SA)
Release "test-release" has been upgraded. Happy Helming!
NAME: test-release
LAST DEPLOYED: Tue Oct 14 19:07:01 2025
NAMESPACE: default
STATUS: deployed
REVISION: 2
TEST SUITE: None
NOTES:
1. Get the application URL by running these commands:
export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=test-chart,app.kubernetes.io/instance=test-release" -o jsonpath="{.items[0].metadata.name}")
export CONTAINER_PORT=$(kubectl get pod --namespace default $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
echo "Visit http://127.0.0.1:8080 to use your application"
kubectl --namespace default port-forward $POD_NAME 8080:$CONTAINER_PORT
Post-upgrade verification
OK: Stale CronJob still present: test-release-test-chart-cronjob
Helm exit code: 0
```
Co-authored-by: dayeguilaiye <979014041@qq.com>
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
4 months ago
fbf02e494e
Merge pull request #30980 from gjenkins8/gjenkins/cleanup_kubeclient_interfaces
...
cleanup: Remove/consolidate redundant kube client Interfaces
4 months ago
c75026c318
doc string
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
4 months ago
61e3d95a94
Merge pull request #31143 from TerryHowe/fix-remove-redundant-error-check
...
fix: remove redundant error check
4 months ago
69dbd6115e
chore: fix some typos in comment
...
Signed-off-by: juejinyuxitu <juejinyuxitu@outlook.com>
4 months ago
b5de5b1591
chore: Cleanup additional/redundant kube client Interfaces
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
5 months ago
89aca09e5e
chore: fix function name
...
Signed-off-by: tzchenxixi <tzchenxixi@icloud.com>
5 months ago
ebc874ef84
fix client-side to server-side field manager migration
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
6 months ago
1e22b2fe7c
fix: remove redundant error check
...
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
6 months ago
b2dc411f9d
code review (error checks, collapse forceConflicts, UpdateApplyFunc)
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
6 months ago
99dc23f00b
switch target<->original
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
6 months ago
45141451b4
Kube client support server-side apply
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
6 months ago
744c6b5a97
fix: kube client create mutex
...
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
8 months ago
706392fabb
fix: update json-patch import path and add gomodguard settings
...
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
9 months ago
fc6c5e5edb
remove WaitAndGetCompletedPodPhase function
...
Signed-off-by: Justen Stall <39888103+justenstall@users.noreply.github.com>
10 months ago
3877ec9049
fix golangci-lint issues
...
Signed-off-by: Justen Stall <39888103+justenstall@users.noreply.github.com>
10 months ago
280a9ddbdb
Merge branch 'main' into stdlib-errors-2
...
Signed-off-by: Justen Stall <39888103+justenstall@users.noreply.github.com>
10 months ago
1f5605a405
fix formatting errors
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
10 months ago
e8e79cc4b4
Merge branch 'main' into fix-take-ownership
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
10 months ago
cbaac7652d
Call slog directly instead of using a wrapper
...
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
10 months ago
0c85456788
Leverage slog.Any for errors
...
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
10 months ago
5580f61157
Properly reproduce the nopLogger as before
...
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
10 months ago
b2380720eb
Migrate to pure slog without a custom wrapper
...
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
10 months ago
b42767be40
Migrate more code to log adapter
...
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
10 months ago
83cdffe4ae
Migrate to a dedicated internal package for slog adapter + migrate more
...
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
10 months ago
d6d7cff417
Try to make log more common and more easily grepable
...
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
10 months ago
8d30464f2c
Do no mask warning alerts
...
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
10 months ago
dfaf249221
Remove unreachable error
...
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
10 months ago
f4631bf3d8
Migrate kube package to slog
...
As for helm v4. We want to migrate logs to slog.
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
10 months ago
e55707b09d
Fix --take-ownership
...
If a resource exists in the cluster and is to be adopted by helm install
--take-ownership, it is left unchanged while helm reports the
installation to have succeeded.
This is due to CRs and CRDs being merged without three-way-merge, which
results in an empty patch.
By using a three-way-merge transparently when --take-ownership is used,
the helm behaves as expected without breaking previous behavior.
Fixes #30622
Signed-off-by: Patrick Seidensal <pseidensal@suse.com>
10 months ago
8efd428e5d
switch back to k8s rest mapper
...
Signed-off-by: Austin Abro <AustinAbro321@gmail.com>
11 months ago
386523bdbc
update to get waiter instead of set
...
Signed-off-by: Austin Abro <AustinAbro321@gmail.com>
11 months ago
10f78c814c
legacy waiter
...
Signed-off-by: Austin Abro <AustinAbro321@gmail.com>
11 months ago
600947b32e
client->restmapper
...
Signed-off-by: Austin Abro <AustinAbro321@gmail.com>
11 months ago
3a296aacad
rest mapper
...
Signed-off-by: Austin Abro <AustinAbro321@gmail.com>
11 months ago
5a254dae21
cleanup
...
Signed-off-by: Austin Abro <AustinAbro321@gmail.com>
11 months ago
11eeb4a6b1
merge
...
Signed-off-by: Austin Abro <AustinAbro321@gmail.com>
11 months ago
Feruzjon Muyassarov
George Jenkins
Matheus Pimenta
Evans Mungai
Matt Farina
Jesse Simpson
Benoit Tigeot
juejinyuxitu
tzchenxixi
Terry Howe
Matthieu MOREL
Justen Stall
Patrick Seidensal
Austin Abro