When using --dry-run=server with --server-side=true, Helm now properly
validates manifests against the Kubernetes API server. Previously, the
dry-run would return early without calling the API, missing validation
errors like unknown fields in the spec.
This fix ensures that DryRunServer mode calls KubeClient.Create/Update
with the dry-run option, matching the behavior of kubectl apply
--dry-run=server.
Fixes: helm/helm#31505
Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
* fix: enable concurrent status computation to prevent multi-minute delays
Set StatusComputeWorkers=8 on DefaultStatusWatcher for Wait,
WaitWithJobs, and WatchUntilReady. This opts in to the async status
computation added in fluxcd/cli-utils#20, preventing the informer
notification pipeline from being blocked by slow API calls when many
resources are updated simultaneously.
Without this, status computation for resources like Deployments (which
require additional LIST ReplicaSets/Pods calls) runs serially inside
the informer, causing growing delays of 1-3+ minutes when upgrading
many resources at once (e.g., ~20 Deployments via Helm).
Signed-off-by: maplemiao <maplemiao@tencent.com>
* refactor(kube): expose StatusComputeWorkers as a WaitOption
Replace the package-level DefaultStatusComputeWorkers variable with a
WithStatusComputeWorkers WaitOption threaded through waitOptions into
the statusWaiter. This removes global mutable state from pkg/kube and
lets callers opt in explicitly.
SDK consumers (e.g. helm-controller) inherit the zero value, which
preserves the upstream cli-utils synchronous behavior and avoids an
unexpected fan-out of status-compute goroutines when many releases
reconcile concurrently. The Helm CLI continues to enable 8 workers by
default via a shared pkg/cmd/flags.go helper, so install/upgrade/
rollback/uninstall/test users still get the fix for multi-minute
informer stalls out of the box.
Signed-off-by: maplemiao <maplemiao@tencent.com>
* refactor(kube): clamp negative StatusComputeWorkers values to zero
Address review feedback: when a caller passes a negative value to
WithStatusComputeWorkers, coerce it to zero rather than propagating
it to the underlying cli-utils watcher, where the behavior is
undefined. Zero is the safe default and matches the SDK opt-in
contract.
Signed-off-by: maplemiao <maplemiao@tencent.com>
---------
Signed-off-by: maplemiao <maplemiao@tencent.com>
Signed-off-by: Maple Miao <maplemiao@yunzhanghu.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Pre-Go-modules import path comments (e.g. `// import "helm.sh/helm/v4/..."`)
are obsolete since Go 1.11 where go.mod is the authoritative module path.
These stale comments cause issues with downstream tooling such as Kythe.
Removes the legacy import comments from 64 files across 20 packages:
- cmd/helm
- internal/chart/v3/lint and sub-packages
- internal/plugin and sub-packages
- internal/release/v2/util
- pkg/chart/v2/lint and sub-packages
- pkg/cmd, pkg/engine, pkg/ignore, pkg/provenance
- pkg/registry
- pkg/release/v1/util
- pkg/repo/v1
- pkg/storage and pkg/storage/driver
Follows up on #31931 and #31932 which addressed pkg/kube.
Fixes#31846
Signed-off-by: abhay1999 <abhay.chaurasiya@example.com>
Signed-off-by: abhay1999 <abhaychaurasiya19@gmail.com>
* feat: honor SOURCE_DATE_EPOCH for chart archives
Add StampModTimes() on Chart struct to recursively set ModTime on
all chart file entries. CLI reads SOURCE_DATE_EPOCH env var and wires
through all 5 commands: package, install, upgrade, dep build, dep update.
Removes unused v3 duplicate source_date_epoch.go (YAGNI).
Inlines env var parsing to CLI layer from chart util.
Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>
* docs: document SOURCE_DATE_EPOCH in environment variables help
Add a short entry for $SOURCE_DATE_EPOCH to the env var table shown
in 'helm help'. The variable is honored by 'helm package', 'install',
'upgrade', 'dep build', and 'dep update' to produce reproducible chart
archives. Full documentation belongs in helm-www.
Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>
* fix: adapt SourceDateEpoch to upstream refactored dep check
Upstream/main restructured the dependency error handling in install.go
and upgrade.go from a nested-if block (if DependencyUpdate) to an
early-return pattern (if !DependencyUpdate). Adapt the feature's
Manager construction to match the new code structure.
Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>
---------
Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>
* Fix missing conflict retry with server-side apply
Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>
* Only retry on resourcequota transient conflict
Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>
* Use isServerSideRetryable + naming nitpick
Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>
---------
Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>
Files.Lines guards against a nil entry but an empty file inside a
chart is stored as a non-nil zero-length byte slice, so the trailing
newline check indexes s[-1] and panics. The engine recovers the panic
into a render error, making every template/install/upgrade/lint that
references the file fail.
Extend the guard to len(f[path]) == 0 and return an empty slice,
matching the behaviour for missing files.
Fixes#32279
Signed-off-by: Mahesh Sadupalli <mahesh.sadupalli@gmail.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: kimsungmin1 <142377392+kimsungmin1@users.noreply.github.com>
- Use (*net.ListenConfig).Listen with the test context instead of
net.Listen (noctx).
- Use suite.NoError instead of suite.Nil for the error check
(testifylint).
- Drop the unnecessary leading blank lines in the scope test funcs
(whitespace).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
The scope test configured a TLS registry while advertising an http token
realm. oras refuses to send credentials to an http token realm when the
registry itself was contacted over https, so the auth server was never
reached and the test timed out ("timeout waiting for auth request").
Use a plain-http registry so the registry and token-realm schemes match;
the scope carried in the token request is what this test verifies, and
that is independent of TLS.
Also make the auth handler's channel send non-blocking so that a client
retry can never block the handler and stall the push/pull flow, which
addresses the review comment about a potential deadlock.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
- Fix data race by using channel instead of shared variable for requestURL
- Make assertions more robust by parsing URL and checking query parameters instead of exact string matching
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
- Change 'bellow' to 'below' (spelling correction in multiple places)
- Change 'WithScopeHint' to 'withScopeHint' to match actual function name
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
- Change DockerRegistryHost to use 127.0.0.1 for HTTP tests and helm-test-registry for TLS tests to match certificate hostname
- Add defer ln.Close() to prevent resource leak in token auth server setup
- Restore requestURL variable and assertion in test body instead of handler to avoid potential race condition
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
MrJack
Terry Howe
George Jenkins
Matt Farina
Matthieu MOREL
Zhaofeng Miao
Abhay Chaurasiya
Lohit Kolluri
Jakub Jaruszewski
Matheus Pimenta
LarytheLord
Mahesh Sadupalli
kimsungmin1
kimsm28