99cd196435
Merge pull request #31435 from matheuscscp/cancel-health-checks
...
Introduce a context for canceling wait operations
2 months ago
efc1702657
Introduce a context for canceling wait operations
...
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
2 months ago
bdc459d73c
Merge pull request #31389 from TerryHowe/chore-more-registry-clean-up
...
chore: fix pkg/registry warnings to reduce noise
2 months ago
841d8d7e76
Merge pull request #31364 from helm/dependabot/github_actions/main/github/codeql-action-4
...
chore(deps): bump github/codeql-action from 3 to 4
2 months ago
9bed143103
Merge pull request #31323 from mattfarina/reproducible-chart-builds
...
Reproducible chart archive builds
2 months ago
8834d90c60
Merge pull request #31440 from mattfarina/bump-go-1.25
...
Updating Go and golangci-lint versions
2 months ago
15300549f0
When time not available, using time.Now
...
Note, when time is not available, the builds are not reproducible.
This problem would only happen when an SDK user is using parts of
the API to build their own tooling. Helm will consistently inject
the dates through the higher level APIs.
Signed-off-by: Matt Farina <matt.farina@suse.com>
2 months ago
c6334c2ac5
Updating Go and golangci-lint versions
...
Signed-off-by: Matt Farina <matt.farina@suse.com>
2 months ago
ca8eae9361
Reproducible chart archive builds
...
Building the same chart into an archive multiple times will have
the same sha256 hash.
Perviously, the time in the headers for a file was time.Now() which
changed each time. The time is now collected from the operating
system when the file is loaded and this time is used.
Fixes : #3612
Signed-off-by: Matt Farina <matt.farina@suse.com>
2 months ago
f4c5220d99
Merge pull request #31411 from banjoh/em/reinstate-logger-param
...
feat: reinstate logger parameter to actions package
2 months ago
2ddeb50fa6
Set default logger in Configuration constructor
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
2 months ago
a94878fb89
Fix failing test
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
2 months ago
28bc76c364
Add tests for logging LogHolder
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
2 months ago
a112bf5aa6
Remove non-reachable code
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
2 months ago
1da2b0a6d4
Merge pull request #31204 from benoittgt/fix-31202
...
Avoid panic in helm.sh/helm/v3/pkg/chartutil.ValidateAgainstSchema
2 months ago
25ad74f5a7
Merge pull request #31337 from rachelvweber/rawo/fixingWaitStrategy
...
Fixing rollback and uninstall client WaitStrategy
2 months ago
aed687eaa1
Add config options to NewConfiguration()
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
2 months ago
e63b4d92cb
Update internal/logging/logging.go
...
Co-authored-by: George Jenkins <gvjenkins@gmail.com>
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
2 months ago
99fe9b3b9b
Update logging to use a param for the logger
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
2 months ago
d67b17b6ec
Minor name change
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
2 months ago
b6eca1c0f1
Refactor logging functionality to use slog.Handler
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
2 months ago
5ab4ca5490
Embed logging functionality to DRY code
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
2 months ago
9c32e34d60
Add logger to sql driver and ensure storage has logger
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
2 months ago
50e43f4017
nil logger should be handled by discard handler
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
2 months ago
7a5816b106
Self review changes
...
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
2 months ago
0f90c83118
Merge remote-tracking branch 'upstream/main' into em/reinstate-logger-param
2 months ago
b1d4dc680d
feat: reinstate logger parameter to actions package
...
Fixes : #31399
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
2 months ago
a3db5f5667
Merge pull request #31408 from AndiDog/plugin-err-msg
...
Improve error message when plugin source cannot be determined or a non-directory is passed
2 months ago
f0386b1daa
Merge pull request #31338 from yzewei/add-loong64-support
...
Add loongarch64 support
2 months ago
76e6b7a6fe
Merge pull request #31390 from TerryHowe/chore-increase-helm-list-test-coverage
...
fix: improve pkg/cmd/list test coverage
2 months ago
97ee09d935
Merge pull request #31365 from reddaisyy/main
...
refactor: use reflect.TypeFor
2 months ago
2cfd41ec28
Merge pull request #31351 from gjenkins8/gjenkins/helm_version_kubeversion
...
feat: `helm version` print Kubernetes (client-go) version
2 months ago
752354074c
Merge pull request #31393 from benoittgt/12299
...
Return errors during upgrade when the deletion of resources fails
2 months ago
37de51428c
Merge pull request #31376 from benoittgt/accept-yaml-yml
...
Do not ignore *.yml file on linting while accepting *.yaml
2 months ago
3924cf3781
Merge pull request #31362 from fabiocarneiro/patch-1
...
Clarify the intent of the resource instructions
2 months ago
b0247ce8bf
Merge pull request #31395 from wyrapeseed/main
...
chore: fix some comment format
2 months ago
d0225754f2
Merge pull request #31406 from jessesimpson36/jessesimpson36/fix-nil-pointer-empty-result
...
fix: kube client should return empty results objects instead of nil
2 months ago
b05411506a
Improve error message when plugin source cannot be determined or a non-directory is passed
...
Signed-off-by: Andreas Sommer <andreas.sommer87@googlemail.com>
2 months ago
0f6e14dfd3
chore: fix various warnings to reduce noise
...
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
2 months ago
3f860e83fb
fix: use empty results instead of nil
...
Signed-off-by: Jesse Simpson <jesse.simpson36@gmail.com>
2 months ago
96b4c363c8
fix: Update returns nil on error, test should reflect this
...
Signed-off-by: Jesse Simpson <jesse.simpson36@gmail.com>
2 months ago
490dffeb34
Merge pull request #31401 from TerryHowe/refactor-remove-unused-err
...
refactor: remove unused err from pkg/registry/client.go
2 months ago
917822cfca
refactor: remove unused err from pkg/registry/client.go
...
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
2 months ago
4f585add24
Merge pull request #31392 from TerryHowe/feature-create-copilot-structured-context
...
feature: create copilot structured context
2 months ago
f14c89c936
Merge pull request #31391 from TerryHowe/chore-rename-test-registry
...
chore: rename test registry
2 months ago
b9eadd3186
chore: fix some comment format
...
Signed-off-by: wyrapeseed <wyrapeseed@outlook.com>
2 months ago
7097c8e2e5
Replicate as unit test case where we fail once a resource deletion
...
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
2 months ago
054eabddd7
Return errors on upgrade when deletion fails
...
This is a rebase of https://github.com/helm/helm/pull/12299
as the pull request was tagged for Helm v4.
Closes: https://github.com/helm/helm/issues/11375
Related: https://github.com/helm/helm/pull/7929
It was a pain to reproduce, here is a script:
```
set -u
NS=default
RELEASE=test-release
CHART=./test-chart
SA=limited-helm-sa
HELM=${HELM:-./bin/helm}
echo "Helm: $($HELM version)"
echo "Cleaning…"
$HELM uninstall "$RELEASE" -n "$NS" >/dev/null 2>&1 || true
kubectl -n "$NS" delete sa "$SA" role "${SA}-role" rolebinding "${SA}-rb" >/dev/null 2>&1 || true
kubectl -n "$NS" delete cronjob "$RELEASE-test-chart-cronjob" >/dev/null 2>&1 || true
rm -rf "$CHART" /tmp/limited-helm-kubeconfig
echo "Create minimal chart with only a CronJob"
$HELM create "$CHART" >/dev/null
rm -f "$CHART"/templates/{deployment.yaml,service.yaml,hpa.yaml,tests/test-connection.yaml,serviceaccount.yaml}
cat > "$CHART/templates/cronjob.yaml" <<'YAML'
apiVersion: batch/v1
kind: CronJob
metadata:
name: {{ include "test-chart.fullname" . }}-cronjob
spec:
schedule: "*/5 * * * *"
jobTemplate:
spec:
template:
spec:
restartPolicy: OnFailure
containers:
- name: hello
image: busybox
command: ["/bin/sh","-c","date; echo Hello from CronJob"]
YAML
echo "RBAC: allow Helm storage, basic reads/creates, but NO delete on cronjobs"
kubectl -n "$NS" apply -f - >/dev/null <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
name: $SA
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: ${SA}-role
rules:
- apiGroups: [""]
resources: ["secrets","configmaps"]
verbs: ["get","list","watch","create","patch","update","delete"]
- apiGroups: [""]
resources: ["pods","events"]
verbs: ["get","list","watch"]
- apiGroups: ["batch"]
resources: ["cronjobs"]
verbs: ["get","list","watch","create","patch","update"]
EOF
kubectl -n "$NS" apply -f - >/dev/null <<EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: ${SA}-rb
subjects:
- kind: ServiceAccount
name: $SA
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: ${SA}-role
EOF
echo "Create kubeconfig for that SA"
TOKEN=$(kubectl -n "$NS" create token "$SA")
SERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
CA_DATA=$(kubectl config view --minify --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}')
KCFG=/tmp/limited-helm-kubeconfig
cat > "$KCFG" <<EOF
apiVersion: v1
kind: Config
clusters:
- name: local
cluster:
server: $SERVER
certificate-authority-data: $CA_DATA
contexts:
- name: limited
context:
cluster: local
namespace: $NS
user: $SA
current-context: limited
users:
- name: $SA
user:
token: $TOKEN
EOF
set +e
echo "Install (as limited SA)"
KUBECONFIG="$KCFG" $HELM upgrade --install "$RELEASE" "$CHART" -n "$NS" --wait
echo "CronJob after install:"
kubectl -n "$NS" get cronjob "$RELEASE-test-chart-cronjob" || true
echo "Remove CronJob from chart and add a small ConfigMap to force an upgrade"
rm -f "$CHART/templates/cronjob.yaml"
cat > "$CHART/templates/configmap.yaml" <<'YAML'
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "test-chart.fullname" . }}-config
data:
hello: world
YAML
echo "Upgrade without CronJob (as limited SA)"
KUBECONFIG="$KCFG" $HELM upgrade --install "$RELEASE" "$CHART" -n "$NS"
RC=$?
echo "Post-upgrade verification"
if kubectl -n "$NS" get cronjob "$RELEASE-test-chart-cronjob" >/dev/null 2>&1; then
echo "OK: Stale CronJob still present: $RELEASE-test-chart-cronjob"
else
echo "NO_OK: CronJob deleted"
fi
echo "Helm exit code: $RC"
exit 0
```
With the current build:
```sh
./reproduce-helm-issue.sh
Helm: version.BuildInfo{Version:"v4.0+unreleased", GitCommit:"f19bb9cd4c99943f7a4980d6670de44affe3e472", GitTreeState:"dirty", GoVersion:"go1.24.0"}
Cleaning…
Create minimal chart with CronJob + ConfigMap (we will remove both in v2)
RBAC: allow Helm storage + delete for configmaps, but NO delete on cronjobs
Create kubeconfig for that SA
Install v1 (as limited SA)
Release "test-release" does not exist. Installing it now.
NAME: test-release
LAST DEPLOYED: Tue Oct 14 18:55:57 2025
NAMESPACE: default
STATUS: deployed
REVISION: 1
DESCRIPTION: Install complete
TEST SUITE: None
NOTES:
1. Get the application URL by running these commands:
export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=test-chart,app.kubernetes.io/instance=test-release" -o jsonpath="{.items[0].metadata.name}")
export CONTAINER_PORT=$(kubectl get pod --namespace default $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
echo "Visit http://127.0.0.1:8080 to use your application"
kubectl --namespace default port-forward $POD_NAME 8080:$CONTAINER_PORT
Verify v1 objects exist
NAME SCHEDULE TIMEZONE SUSPEND ACTIVE LAST SCHEDULE AGE
test-release-test-chart-cronjob */5 * * * * <none> False 0 <none> 0s
NAME DATA AGE
test-release-test-chart-config 1 0s
Prepare v2: remove BOTH CronJob and ConfigMap from the chart
Upgrade to v2 (as limited SA) — expecting CronJob delete first, then ConfigMap
- CronJob delete should FAIL (no delete permission)
- ConfigMap delete should SUCCEED (delete allowed) — proves 'continue on error' and inverted order
level=DEBUG msg="getting history for release" release=test-release
level=DEBUG msg="getting release history" name=test-release
level=DEBUG msg="preparing upgrade" name=test-release
level=DEBUG msg="getting last revision" name=test-release
level=DEBUG msg="getting release history" name=test-release
level=DEBUG msg="number of dependencies in the chart" dependencies=0
level=DEBUG msg="determined release apply method" server_side_apply=true previous_release_apply_method=ssa
level=DEBUG msg="performing update" name=test-release
level=DEBUG msg="creating upgraded release" name=test-release
level=DEBUG msg="creating release" key=sh.helm.release.v1.test-release.v2
level=DEBUG msg="getting release history" name=test-release
level=DEBUG msg="using server-side apply for resource update" forceConflicts=false dryRun=false fieldValidationDirective=Strict upgradeClientSideFieldManager=false
level=DEBUG msg="checking resources for changes" resources=0
level=DEBUG msg="deleting resource" namespace=default name=test-release-test-chart-config kind=ConfigMap
level=DEBUG msg="deleting resource" namespace=default name=test-release-test-chart-cronjob kind=CronJob
level=DEBUG msg="failed to delete resource" namespace=default name=test-release-test-chart-cronjob kind=CronJob error="cronjobs.batch \"test-release-test-chart-cronjob\" is forbidden: User \"system:serviceaccount:default:limited-helm-sa\" cannot delete resource \"cronjobs\" in API group \"batch\" in the namespace \"default\""
level=INFO msg="update completed" created=0 updated=0 deleted=1
level=WARN msg="update completed with errors" errors=1
level=DEBUG msg="updating release" key=sh.helm.release.v1.test-release.v1
level=WARN msg="upgrade failed" name=test-release error="failed to delete resource test-release-test-chart-cronjob: cronjobs.batch \"test-release-test-chart-cronjob\" is forbidden: User \"system:serviceaccount:default:limited-helm-sa\" cannot delete resource \"cronjobs\" in API group \"batch\" in the namespace \"default\""
level=DEBUG msg="updating release" key=sh.helm.release.v1.test-release.v2
Error: UPGRADE FAILED: failed to delete resource test-release-test-chart-cronjob: cronjobs.batch "test-release-test-chart-cronjob" is forbidden: User "system:serviceaccount:default:limited-helm-sa" cannot delete resource "cronjobs" in API group "batch" in the namespace "default"
Post-upgrade verification
Stale CronJob still present: test-release-test-chart-cronjob (expected if delete is forbidden)
ConfigMap deleted as expected: test-release-test-chart-config (and after CronJob attempt)
Helm exit code: 1
```
With last version v3.19:
```
HELM=/usr/local/bin/helm ./reproduce-helm-issue.sh
Helm: version.BuildInfo{Version:"v3.19.0", GitCommit:"3d8990f0836691f0229297773f3524598f46bda6", GitTreeState:"clean", GoVersion:"go1.24.7"}
Cleaning…
Create minimal chart with only a CronJob
RBAC: allow Helm storage, basic reads/creates, but NO delete on cronjobs
Create kubeconfig for that SA
Install (as limited SA)
Release "test-release" does not exist. Installing it now.
NAME: test-release
LAST DEPLOYED: Tue Oct 14 19:07:01 2025
NAMESPACE: default
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
1. Get the application URL by running these commands:
export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=test-chart,app.kubernetes.io/instance=test-release" -o jsonpath="{.items[0].metadata.name}")
export CONTAINER_PORT=$(kubectl get pod --namespace default $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
echo "Visit http://127.0.0.1:8080 to use your application"
kubectl --namespace default port-forward $POD_NAME 8080:$CONTAINER_PORT
CronJob after install:
NAME SCHEDULE TIMEZONE SUSPEND ACTIVE LAST SCHEDULE AGE
test-release-test-chart-cronjob */5 * * * * <none> False 0 <none> 0s
Remove CronJob from chart and add a small ConfigMap to force an upgrade
Upgrade without CronJob (as limited SA)
Release "test-release" has been upgraded. Happy Helming!
NAME: test-release
LAST DEPLOYED: Tue Oct 14 19:07:01 2025
NAMESPACE: default
STATUS: deployed
REVISION: 2
TEST SUITE: None
NOTES:
1. Get the application URL by running these commands:
export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=test-chart,app.kubernetes.io/instance=test-release" -o jsonpath="{.items[0].metadata.name}")
export CONTAINER_PORT=$(kubectl get pod --namespace default $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
echo "Visit http://127.0.0.1:8080 to use your application"
kubectl --namespace default port-forward $POD_NAME 8080:$CONTAINER_PORT
Post-upgrade verification
OK: Stale CronJob still present: test-release-test-chart-cronjob
Helm exit code: 0
```
Co-authored-by: dayeguilaiye <979014041@qq.com>
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
2 months ago
f19bb9cd4c
Merge pull request #31388 from helm/dependabot/go_modules/main/sigs.k8s.io/controller-runtime-0.22.3
...
chore(deps): bump sigs.k8s.io/controller-runtime from 0.22.2 to 0.22.3
2 months ago
4edf050960
feature: create copilot structured context
...
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
2 months ago
Scott Rigby
Matheus Pimenta
George Jenkins
Matt Farina
Evans Mungai
Robert Sirchia
Andreas Sommer
Terry Howe
Jesse Simpson
wyrapeseed
Benoit Tigeot