Previously the chart source was recorded by mutating the chart's metadata
annotations in pkg/cmd before calling RunWithContext. Because the render
values expose chart metadata to templates (.Chart comes from
accessor.MetadataAsMap()), this injected meta.helm.sh/release-source into
.Chart.Annotations during template rendering, which could change rendered
manifests for charts that enumerate or branch on chart annotations.
Move the annotation to the action layer and apply it only after rendering
completes, via a new Install.ChartSource / Upgrade.ChartSource field. The
annotation lands on the persisted release's chart metadata (the same chart
pointer stored on the release) but is never present in the template render
context, so 'helm list --show-source' and 'helm get metadata' still surface
the source while rendered output is unaffected.
The cmd helper is reduced to a pure chartSource() resolver (repo URL
preferred, credentials stripped); sanitizeChartSource is unchanged. Adds an
action-level test asserting the source is absent from the rendered manifest
but present on the stored release.
Signed-off-by: Shaan Satsangi <shaansatsangi@gmail.com>
The --show-source help claimed JSON/YAML output 'always includes' the
source field, but releaseElement.Source is tagged json:"source,omitempty"
so it is omitted when a release has no recorded source. Reword the help to
state the flag affects only table output and that JSON/YAML emit source
whenever a release has one.
Also add cmd-level get metadata coverage for a release whose chart records
meta.helm.sh/release-source, with table/JSON/YAML golden files, so the new
SOURCE line and source field do not regress.
Signed-off-by: Shaan Satsangi <shaansatsangi@gmail.com>
url.Parse treats a Windows absolute path such as C:\charts\mychart as
having scheme "c", so sanitizeChartSource re-encoded it (e.g. the drive
letter was lowercased and separators could be percent-escaped), producing
a misleading SOURCE value for local installs/upgrades.
Gate sanitization on the parsed URL having a host component, so only real
repository URLs (scheme://host/...) are rewritten while local filesystem
paths and chart references are returned unchanged. Add regression tests
covering Windows (back- and forward-slash) and absolute unix paths.
Signed-off-by: Shaan Satsangi <shaansatsangi@gmail.com>
Record where a release's chart was installed or upgraded from and surface
it via `helm list` and `helm get metadata` — addressing both surfaces
called out in #4256.
`helm install` and `helm upgrade` set a `meta.helm.sh/release-source`
annotation on the chart metadata (the `--repo` URL when supplied,
otherwise the chart reference). The annotation is written after any
`--dependency-update` chart reload so it survives the reload, and any
credentials embedded in a repo URL are stripped before the value is
persisted so secrets are not leaked into the release record.
- `helm list`: new `source` field in JSON/YAML output (omitted when
empty, so existing releases keep their schema) plus an opt-in
`--show-source` flag for the table column, leaving the default table
layout unchanged for scripts that parse it.
- `helm get metadata`: new `source` field, shown in the table only when
set.
Closes#4256
Signed-off-by: Shaan Satsangi <shaansatsangi@gmail.com>
- only cache kube client when creation succeeds
- add regression test for two failed reachability checks
Signed-off-by: Mohammad Abdolirad <m.abdolirad@gmail.com>
* fix: protect FailingKubeClient.RecordedWaitOptions from concurrent access
Add a sync.Mutex to guard the append to RecordedWaitOptions in
GetWaiterWithOptions, fixing a data race detected by -race when
concurrent goroutines (e.g. upgrade + rollback) both call
GetWaiterWithOptions on the same FailingKubeClient instance.
Fixes race failures in TestUpgradeRelease_Interrupted_RollbackOnFailure
and TestInstallRelease_RollbackOnFailure_Interrupted.
Signed-off-by: Terry Howe <thowe@nvidia.com>
* fix: extract appendRecordedWaitOptionsLocked helper with defer unlock
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---------
Signed-off-by: Terry Howe <thowe@nvidia.com>
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
Commands like 'helm registry login', 'helm push', and 'helm pull' were
writing success messages ("Login Succeeded", "Pushed:", "Pulled:",
"Digest:") to stderr instead of stdout. The root cause was that
newDefaultRegistryClient and newRegistryClientWithTLS hard-coded
os.Stderr as the registry client writer, ignoring the out io.Writer
that main() passes as os.Stdout.
Thread out io.Writer through newRegistryClient, newDefaultRegistryClient,
and newRegistryClientWithTLS, and update all call sites in pkg/cmd.
Fixes#13464
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
When lookup cannot find the requested resource (apierrors.IsNotFound),
add slog.Debug() calls with structured fields (apiVersion, kind,
namespace, name) so that users running helm template --debug can see
why lookup returned an empty map instead of silently swallowing the
not-found result.
Fixes: https://github.com/helm/helm/issues/32101
Signed-off-by: Ogulcan Aydogan <ogulcanaydogan@hotmail.com>
Shaan Satsangi
Terry Howe
Matthieu MOREL
dependabot[bot]
George Jenkins
s3onghyun
devShaik010
Jeaeun Kim
Evans Mungai
Mohammad Abdolirad
Ogulcan Aydogan
Robert Sirchia
MrJack