Two things changed in this commit...
1. The Build behavior was restored and the change only impacts
Update. This is a more minimal functionality change thats
a more secure behavior
2. Cleanup from Josh's feedback on the PR to create a const
and comment changes
Signed-off-by: Matt Farina <matt@mattfarina.com>
If a repository was not know to helm (e.g. added using helm repo add)
then Helm would use the range set in the depenencies as the version
in the lock file. Lock files should not have ranges since they are
locked to versions.
Helm did this because the version information for repositories was
not know to Helm. This change fixes that by making the repository
and chart information known to Helm so it can resolve the versions.
Closes#8449
Signed-off-by: Matt Farina <matt@mattfarina.com>
Previously, if a range was specified for a file:// url as a
dependency the range would be put in the lockfile. Lockfiles are
designed to pin to a specific version and not support ranges. This
is for reproducibility.
The change here pins to a the specific version of the chart
specified using the file:// when update is run.
Signed-off-by: Matt Farina <matt@mattfarina.com>
* fix(sdk): Polish the downloader/manager package error return
Close#8471
Signed-off-by: Dong Gang <dong.gang@daocloud.io>
* Modify the repositories validation function `resloveRepoNames` and add a
unit test.
Signed-off-by: Dong Gang <dong.gang@daocloud.io>
* Remove wrong commit
Signed-off-by: Dong Gang <dong.gang@daocloud.io>
If two `helm upgrade`s are executed at the exact same time, then one of
the invocations will fail with "already exists".
If one `helm upgrade` is executed and a second one is started while the
first is in `pending-upgrade`, then the second invocation will create a
new release. Effectively, two helm invocations will simultaneously
change the state of Kubernetes resources -- which is scary -- then two
releases will be in `deployed` state -- which can cause other issues.
This commit fixes the corrupted storage problem, by introducting a poor
person's lock. If the last release is in a pending state, then helm will
abort. If the last release is in a pending state, due to a previously
killed helm, then the user is expected to do `helm rollback`.
Closes#7274
Signed-off-by: Cristian Klein <cristian.klein@elastisys.com>
No longer using the 'syscall' package, as further reading into this
issue has shown that 'syscall' is deprecated/locked down. Additional
issues posted on Golang's github indicates that the newer preferred
mechanism to get the file descriptor for stdin is: int(os.Stdin.Fd())
Signed-off-by: Jack Weldon <jack.weldon.scm@gmail.com>
Previously in Helm 2, 'helm repo add' would prompt for your password if
you only provided the --username flag. This helps prevent someone's
credentials from being logged in their shell's history, from showing
up in process lists, and from being seen by others nearby.
Closes#7174
Signed-off-by: Jack Weldon <jack.weldon.scm@gmail.com>
She Jiayu
yxxhero
Matt Farina
Andrew Melis
Holder
Chris Wells
Martin Hickey
Simon Shine
Matthew Fisher
Bridget Kromhout
wawa0210
Cristian Klein
Michelle Noorali
Hidde Beydals
Jack Weldon
Matt Butcher