3bcf965f99
perf: enable concurrent status computation to prevent multi-minute delays ( #32043 )
...
* fix: enable concurrent status computation to prevent multi-minute delays
Set StatusComputeWorkers=8 on DefaultStatusWatcher for Wait,
WaitWithJobs, and WatchUntilReady. This opts in to the async status
computation added in fluxcd/cli-utils#20 , preventing the informer
notification pipeline from being blocked by slow API calls when many
resources are updated simultaneously.
Without this, status computation for resources like Deployments (which
require additional LIST ReplicaSets/Pods calls) runs serially inside
the informer, causing growing delays of 1-3+ minutes when upgrading
many resources at once (e.g., ~20 Deployments via Helm).
Signed-off-by: maplemiao <maplemiao@tencent.com>
* refactor(kube): expose StatusComputeWorkers as a WaitOption
Replace the package-level DefaultStatusComputeWorkers variable with a
WithStatusComputeWorkers WaitOption threaded through waitOptions into
the statusWaiter. This removes global mutable state from pkg/kube and
lets callers opt in explicitly.
SDK consumers (e.g. helm-controller) inherit the zero value, which
preserves the upstream cli-utils synchronous behavior and avoids an
unexpected fan-out of status-compute goroutines when many releases
reconcile concurrently. The Helm CLI continues to enable 8 workers by
default via a shared pkg/cmd/flags.go helper, so install/upgrade/
rollback/uninstall/test users still get the fix for multi-minute
informer stalls out of the box.
Signed-off-by: maplemiao <maplemiao@tencent.com>
* refactor(kube): clamp negative StatusComputeWorkers values to zero
Address review feedback: when a caller passes a negative value to
WithStatusComputeWorkers, coerce it to zero rather than propagating
it to the underlying cli-utils watcher, where the behavior is
undefined. Zero is the safe default and matches the SDK opt-in
contract.
Signed-off-by: maplemiao <maplemiao@tencent.com>
---------
Signed-off-by: maplemiao <maplemiao@tencent.com>
Signed-off-by: Maple Miao <maplemiao@yunzhanghu.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
1 week ago
a2b1a60d51
fix: enhance error handling and improve test assertions ( #32352 )
...
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
1 week ago
aa1ae3a360
Fix missing conflict retry with server-side apply ( #32088 )
...
* Fix missing conflict retry with server-side apply
Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>
* Only retry on resourcequota transient conflict
Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>
* Use isServerSideRetryable + naming nitpick
Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>
---------
Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>
2 weeks ago
96b315f188
chore: fix emptyStringTest, nestingReduce and singleCaseSwitch checks issues from gocritic
...
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
3 weeks ago
05b2746081
Merge pull request #32184 from atkrad/fix/kube-isreachable-nil-panic
...
fix panic on repeated IsReachable calls
1 month ago
b3fbf8d0f7
Merge pull request #30808 from mmorel-35/errorlint
...
chore: enable errorlint
2 months ago
1f7869c31f
fix panic on repeated IsReachable calls
...
- only cache kube client when creation succeeds
- add regression test for two failed reachability checks
Signed-off-by: Mohammad Abdolirad <m.abdolirad@gmail.com>
2 months ago
59b57c5c31
Merge pull request #31885 from mmorel-35/whitespace
...
chore: fix whitespace linter
2 months ago
f257c95c78
fix(kube): clarify server-side apply patch errors
...
Signed-off-by: abhay1999 <abhaychaurasiya19@gmail.com>
4 months ago
af31a67924
chore: enable errorlint linter
...
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
5 months ago
1e0f702f00
chore: fix whitespace linter
...
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
5 months ago
d7cdc9e8fb
pkg/kube: remove legacy import comments
...
Import path comments (e.g. `// import "helm.sh/helm/v4/pkg/kube"`) are
a pre-Go modules convention no longer needed in module-aware builds.
Some files in pkg/kube had these comments while others did not, causing
inconsistency that triggered downstream Kythe indexing errors.
Remove the import comments from all affected files to make the package
declaration consistent across the directory.
Fixes #31846
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: abhay1999 <abhaychaurasiya19@gmail.com>
5 months ago
259f181808
chore: fix some minor issues in the comments
...
Signed-off-by: tsinglua <tsinglua@outlook.com>
5 months ago
6c2cb2f547
chore(pkg): enable perfsprint linter
...
#### Description
enable perfsprint linter in pkg/cmd
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
5 months ago
ec0726523e
whitespace
...
Signed-off-by: Austin Abro <austinabro321@gmail.com>
6 months ago
63b40a7a5e
use logger with waiter
...
Signed-off-by: Austin Abro <austinabro321@gmail.com>
6 months ago
b0b35f1231
feat(kstatus): fine-grained context options for waiting
...
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
6 months ago
40a9de1086
Merge pull request #31412 from fmuyassarov/devel/rollback
...
Fix rollback for missing resources
7 months ago
59ece92bed
pkg/kube: introduce support for custom kstatus readers
...
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
7 months ago
374aeb4b4e
Fix rollback for missing resources
...
Signed-off-by: Feruzjon Muyassarov <feruzjon.muyassarov@est.tech>
7 months ago
4cf7d8d025
Merge pull request #31641 from wangjingcun/main
...
chore: fix some comments to improve readability
8 months ago
858cf31583
chore: fix some comments to improve readability
...
Signed-off-by: wangjingcun <wangjingcun@aliyun.com>
8 months ago
a18e59e465
Enable the sloglint linter
...
Signed-off-by: Mads Jensen <atombrella@users.noreply.github.com>
8 months ago
61d289c119
Merge pull request #31518 from gjenkins8/gjenkins/fix_update_create
...
fix: Use server-side apply for object create during update
8 months ago
a9cdc78116
logs
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
8 months ago
b1a976073f
fix
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
8 months ago
18616e6ce9
fix: Use server-side apply for object create during update
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
8 months ago
11128659aa
Provide more help for SDK user when setting up WaitStrategy
...
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
9 months ago
5cbd9b3035
While testing SDK features for v4. I was surprised with the error:
...
> "reporter failed to start: event funnel closed: context deadline exceeded"
It happens when you forget to set a minimal timeout:
```go
upgradeClient := action.NewUpgrade(actionConfig)
upgradeClient.WaitStrategy = kube.StatusWatcherStrategy
// When Timeout is zero, the status wait uses a context with zero timeout which
// immediately expires causing "context deadline exceeded" errors.
upgradeClient.Timeout = 2 * time.Minute
```
Also maybe it might be worth documenting this more clearly. Initial [PR](https://github.com/helm/helm/pull/13604 ) say:
> I have not written any docs, I assume that can be done when we are closer to Helm 4, a lot of it is covered by linking to - https://github.com/kubernetes-sigs/cli-utils/blob/master/pkg/kstatus/README.md
Related:
- https://github.com/helm/helm/pull/31411#issuecomment-3443925663
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
9 months ago
efc1702657
Introduce a context for canceling wait operations
...
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
9 months ago
b6eca1c0f1
Refactor logging functionality to use slog.Handler
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
9 months ago
5ab4ca5490
Embed logging functionality to DRY code
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
9 months ago
50e43f4017
nil logger should be handled by discard handler
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
9 months ago
7a5816b106
Self review changes
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
9 months ago
0f90c83118
Merge remote-tracking branch 'upstream/main' into em/reinstate-logger-param
9 months ago
b1d4dc680d
feat: reinstate logger parameter to actions package
...
Fixes : #31399
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
9 months ago
752354074c
Merge pull request #31393 from benoittgt/12299
...
Return errors during upgrade when the deletion of resources fails
9 months ago
3f860e83fb
fix: use empty results instead of nil
...
Signed-off-by: Jesse Simpson <jesse.simpson36@gmail.com>
9 months ago
054eabddd7
Return errors on upgrade when deletion fails
...
This is a rebase of https://github.com/helm/helm/pull/12299
as the pull request was tagged for Helm v4.
Closes: https://github.com/helm/helm/issues/11375
Related: https://github.com/helm/helm/pull/7929
It was a pain to reproduce, here is a script:
```
set -u
NS=default
RELEASE=test-release
CHART=./test-chart
SA=limited-helm-sa
HELM=${HELM:-./bin/helm}
echo "Helm: $($HELM version)"
echo "Cleaning…"
$HELM uninstall "$RELEASE" -n "$NS" >/dev/null 2>&1 || true
kubectl -n "$NS" delete sa "$SA" role "${SA}-role" rolebinding "${SA}-rb" >/dev/null 2>&1 || true
kubectl -n "$NS" delete cronjob "$RELEASE-test-chart-cronjob" >/dev/null 2>&1 || true
rm -rf "$CHART" /tmp/limited-helm-kubeconfig
echo "Create minimal chart with only a CronJob"
$HELM create "$CHART" >/dev/null
rm -f "$CHART"/templates/{deployment.yaml,service.yaml,hpa.yaml,tests/test-connection.yaml,serviceaccount.yaml}
cat > "$CHART/templates/cronjob.yaml" <<'YAML'
apiVersion: batch/v1
kind: CronJob
metadata:
name: {{ include "test-chart.fullname" . }}-cronjob
spec:
schedule: "*/5 * * * *"
jobTemplate:
spec:
template:
spec:
restartPolicy: OnFailure
containers:
- name: hello
image: busybox
command: ["/bin/sh","-c","date; echo Hello from CronJob"]
YAML
echo "RBAC: allow Helm storage, basic reads/creates, but NO delete on cronjobs"
kubectl -n "$NS" apply -f - >/dev/null <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
name: $SA
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: ${SA}-role
rules:
- apiGroups: [""]
resources: ["secrets","configmaps"]
verbs: ["get","list","watch","create","patch","update","delete"]
- apiGroups: [""]
resources: ["pods","events"]
verbs: ["get","list","watch"]
- apiGroups: ["batch"]
resources: ["cronjobs"]
verbs: ["get","list","watch","create","patch","update"]
EOF
kubectl -n "$NS" apply -f - >/dev/null <<EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: ${SA}-rb
subjects:
- kind: ServiceAccount
name: $SA
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: ${SA}-role
EOF
echo "Create kubeconfig for that SA"
TOKEN=$(kubectl -n "$NS" create token "$SA")
SERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
CA_DATA=$(kubectl config view --minify --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}')
KCFG=/tmp/limited-helm-kubeconfig
cat > "$KCFG" <<EOF
apiVersion: v1
kind: Config
clusters:
- name: local
cluster:
server: $SERVER
certificate-authority-data: $CA_DATA
contexts:
- name: limited
context:
cluster: local
namespace: $NS
user: $SA
current-context: limited
users:
- name: $SA
user:
token: $TOKEN
EOF
set +e
echo "Install (as limited SA)"
KUBECONFIG="$KCFG" $HELM upgrade --install "$RELEASE" "$CHART" -n "$NS" --wait
echo "CronJob after install:"
kubectl -n "$NS" get cronjob "$RELEASE-test-chart-cronjob" || true
echo "Remove CronJob from chart and add a small ConfigMap to force an upgrade"
rm -f "$CHART/templates/cronjob.yaml"
cat > "$CHART/templates/configmap.yaml" <<'YAML'
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "test-chart.fullname" . }}-config
data:
hello: world
YAML
echo "Upgrade without CronJob (as limited SA)"
KUBECONFIG="$KCFG" $HELM upgrade --install "$RELEASE" "$CHART" -n "$NS"
RC=$?
echo "Post-upgrade verification"
if kubectl -n "$NS" get cronjob "$RELEASE-test-chart-cronjob" >/dev/null 2>&1; then
echo "OK: Stale CronJob still present: $RELEASE-test-chart-cronjob"
else
echo "NO_OK: CronJob deleted"
fi
echo "Helm exit code: $RC"
exit 0
```
With the current build:
```sh
./reproduce-helm-issue.sh
Helm: version.BuildInfo{Version:"v4.0+unreleased", GitCommit:"f19bb9cd4c99943f7a4980d6670de44affe3e472", GitTreeState:"dirty", GoVersion:"go1.24.0"}
Cleaning…
Create minimal chart with CronJob + ConfigMap (we will remove both in v2)
RBAC: allow Helm storage + delete for configmaps, but NO delete on cronjobs
Create kubeconfig for that SA
Install v1 (as limited SA)
Release "test-release" does not exist. Installing it now.
NAME: test-release
LAST DEPLOYED: Tue Oct 14 18:55:57 2025
NAMESPACE: default
STATUS: deployed
REVISION: 1
DESCRIPTION: Install complete
TEST SUITE: None
NOTES:
1. Get the application URL by running these commands:
export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=test-chart,app.kubernetes.io/instance=test-release" -o jsonpath="{.items[0].metadata.name}")
export CONTAINER_PORT=$(kubectl get pod --namespace default $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
echo "Visit http://127.0.0.1:8080 to use your application"
kubectl --namespace default port-forward $POD_NAME 8080:$CONTAINER_PORT
Verify v1 objects exist
NAME SCHEDULE TIMEZONE SUSPEND ACTIVE LAST SCHEDULE AGE
test-release-test-chart-cronjob */5 * * * * <none> False 0 <none> 0s
NAME DATA AGE
test-release-test-chart-config 1 0s
Prepare v2: remove BOTH CronJob and ConfigMap from the chart
Upgrade to v2 (as limited SA) — expecting CronJob delete first, then ConfigMap
- CronJob delete should FAIL (no delete permission)
- ConfigMap delete should SUCCEED (delete allowed) — proves 'continue on error' and inverted order
level=DEBUG msg="getting history for release" release=test-release
level=DEBUG msg="getting release history" name=test-release
level=DEBUG msg="preparing upgrade" name=test-release
level=DEBUG msg="getting last revision" name=test-release
level=DEBUG msg="getting release history" name=test-release
level=DEBUG msg="number of dependencies in the chart" dependencies=0
level=DEBUG msg="determined release apply method" server_side_apply=true previous_release_apply_method=ssa
level=DEBUG msg="performing update" name=test-release
level=DEBUG msg="creating upgraded release" name=test-release
level=DEBUG msg="creating release" key=sh.helm.release.v1.test-release.v2
level=DEBUG msg="getting release history" name=test-release
level=DEBUG msg="using server-side apply for resource update" forceConflicts=false dryRun=false fieldValidationDirective=Strict upgradeClientSideFieldManager=false
level=DEBUG msg="checking resources for changes" resources=0
level=DEBUG msg="deleting resource" namespace=default name=test-release-test-chart-config kind=ConfigMap
level=DEBUG msg="deleting resource" namespace=default name=test-release-test-chart-cronjob kind=CronJob
level=DEBUG msg="failed to delete resource" namespace=default name=test-release-test-chart-cronjob kind=CronJob error="cronjobs.batch \"test-release-test-chart-cronjob\" is forbidden: User \"system:serviceaccount:default:limited-helm-sa\" cannot delete resource \"cronjobs\" in API group \"batch\" in the namespace \"default\""
level=INFO msg="update completed" created=0 updated=0 deleted=1
level=WARN msg="update completed with errors" errors=1
level=DEBUG msg="updating release" key=sh.helm.release.v1.test-release.v1
level=WARN msg="upgrade failed" name=test-release error="failed to delete resource test-release-test-chart-cronjob: cronjobs.batch \"test-release-test-chart-cronjob\" is forbidden: User \"system:serviceaccount:default:limited-helm-sa\" cannot delete resource \"cronjobs\" in API group \"batch\" in the namespace \"default\""
level=DEBUG msg="updating release" key=sh.helm.release.v1.test-release.v2
Error: UPGRADE FAILED: failed to delete resource test-release-test-chart-cronjob: cronjobs.batch "test-release-test-chart-cronjob" is forbidden: User "system:serviceaccount:default:limited-helm-sa" cannot delete resource "cronjobs" in API group "batch" in the namespace "default"
Post-upgrade verification
Stale CronJob still present: test-release-test-chart-cronjob (expected if delete is forbidden)
ConfigMap deleted as expected: test-release-test-chart-config (and after CronJob attempt)
Helm exit code: 1
```
With last version v3.19:
```
HELM=/usr/local/bin/helm ./reproduce-helm-issue.sh
Helm: version.BuildInfo{Version:"v3.19.0", GitCommit:"3d8990f0836691f0229297773f3524598f46bda6", GitTreeState:"clean", GoVersion:"go1.24.7"}
Cleaning…
Create minimal chart with only a CronJob
RBAC: allow Helm storage, basic reads/creates, but NO delete on cronjobs
Create kubeconfig for that SA
Install (as limited SA)
Release "test-release" does not exist. Installing it now.
NAME: test-release
LAST DEPLOYED: Tue Oct 14 19:07:01 2025
NAMESPACE: default
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
1. Get the application URL by running these commands:
export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=test-chart,app.kubernetes.io/instance=test-release" -o jsonpath="{.items[0].metadata.name}")
export CONTAINER_PORT=$(kubectl get pod --namespace default $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
echo "Visit http://127.0.0.1:8080 to use your application"
kubectl --namespace default port-forward $POD_NAME 8080:$CONTAINER_PORT
CronJob after install:
NAME SCHEDULE TIMEZONE SUSPEND ACTIVE LAST SCHEDULE AGE
test-release-test-chart-cronjob */5 * * * * <none> False 0 <none> 0s
Remove CronJob from chart and add a small ConfigMap to force an upgrade
Upgrade without CronJob (as limited SA)
Release "test-release" has been upgraded. Happy Helming!
NAME: test-release
LAST DEPLOYED: Tue Oct 14 19:07:01 2025
NAMESPACE: default
STATUS: deployed
REVISION: 2
TEST SUITE: None
NOTES:
1. Get the application URL by running these commands:
export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=test-chart,app.kubernetes.io/instance=test-release" -o jsonpath="{.items[0].metadata.name}")
export CONTAINER_PORT=$(kubectl get pod --namespace default $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
echo "Visit http://127.0.0.1:8080 to use your application"
kubectl --namespace default port-forward $POD_NAME 8080:$CONTAINER_PORT
Post-upgrade verification
OK: Stale CronJob still present: test-release-test-chart-cronjob
Helm exit code: 0
```
Co-authored-by: dayeguilaiye <979014041@qq.com>
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
10 months ago
fbf02e494e
Merge pull request #30980 from gjenkins8/gjenkins/cleanup_kubeclient_interfaces
...
cleanup: Remove/consolidate redundant kube client Interfaces
10 months ago
c75026c318
doc string
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
10 months ago
61e3d95a94
Merge pull request #31143 from TerryHowe/fix-remove-redundant-error-check
...
fix: remove redundant error check
10 months ago
69dbd6115e
chore: fix some typos in comment
...
Signed-off-by: juejinyuxitu <juejinyuxitu@outlook.com>
10 months ago
b5de5b1591
chore: Cleanup additional/redundant kube client Interfaces
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
10 months ago
89aca09e5e
chore: fix function name
...
Signed-off-by: tzchenxixi <tzchenxixi@icloud.com>
11 months ago
ebc874ef84
fix client-side to server-side field manager migration
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
11 months ago
1e22b2fe7c
fix: remove redundant error check
...
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
12 months ago
b2dc411f9d
code review (error checks, collapse forceConflicts, UpdateApplyFunc)
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
12 months ago
99dc23f00b
switch target<->original
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
12 months ago
45141451b4
Kube client support server-side apply
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
12 months ago
Zhaofeng Miao
Matthieu MOREL
Jakub Jaruszewski
Terry Howe
Mohammad Abdolirad
abhay1999
tsinglua
Austin Abro
Matheus Pimenta
Evans Mungai
Feruzjon Muyassarov
Robert Sirchia
wangjingcun
Mads Jensen
Matt Farina
George Jenkins
Benoit Tigeot
Jesse Simpson
juejinyuxitu
tzchenxixi