* Fix missing conflict retry with server-side apply
Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>
* Only retry on resourcequota transient conflict
Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>
* Use isServerSideRetryable + naming nitpick
Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>
---------
Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>
Files.Lines guards against a nil entry but an empty file inside a
chart is stored as a non-nil zero-length byte slice, so the trailing
newline check indexes s[-1] and panics. The engine recovers the panic
into a render error, making every template/install/upgrade/lint that
references the file fail.
Extend the guard to len(f[path]) == 0 and return an empty slice,
matching the behaviour for missing files.
Fixes#32279
Signed-off-by: Mahesh Sadupalli <mahesh.sadupalli@gmail.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: kimsungmin1 <142377392+kimsungmin1@users.noreply.github.com>
- Use (*net.ListenConfig).Listen with the test context instead of
net.Listen (noctx).
- Use suite.NoError instead of suite.Nil for the error check
(testifylint).
- Drop the unnecessary leading blank lines in the scope test funcs
(whitespace).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
The scope test configured a TLS registry while advertising an http token
realm. oras refuses to send credentials to an http token realm when the
registry itself was contacted over https, so the auth server was never
reached and the test timed out ("timeout waiting for auth request").
Use a plain-http registry so the registry and token-realm schemes match;
the scope carried in the token request is what this test verifies, and
that is independent of TLS.
Also make the auth handler's channel send non-blocking so that a client
retry can never block the handler and stall the push/pull flow, which
addresses the review comment about a potential deadlock.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
- Fix data race by using channel instead of shared variable for requestURL
- Make assertions more robust by parsing URL and checking query parameters instead of exact string matching
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
- Change 'bellow' to 'below' (spelling correction in multiple places)
- Change 'WithScopeHint' to 'withScopeHint' to match actual function name
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
- Change DockerRegistryHost to use 127.0.0.1 for HTTP tests and helm-test-registry for TLS tests to match certificate hostname
- Add defer ln.Close() to prevent resource leak in token auth server setup
- Restore requestURL variable and assertion in test body instead of handler to avoid potential race condition
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
Replace native Go testing patterns (t.Errorf, t.Fatalf, t.Error,
t.Fatal) with github.com/stretchr/testify equivalents (assert.X,
require.X) for improved test readability and error messages.
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
Replace native Go testing patterns (t.Errorf, t.Fatalf, t.Error,
t.Fatal) with github.com/stretchr/testify equivalents (assert.X,
require.X) for improved test readability and error messages.
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
Replace native Go testing patterns (t.Errorf, t.Fatalf, t.Error,
t.Fatal) with github.com/stretchr/testify equivalents (assert.X,
require.X) for improved test readability and error messages.
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
Replace native Go testing patterns (t.Errorf, t.Fatalf, t.Error,
t.Fatal) with github.com/stretchr/testify equivalents (assert.X,
require.X) for improved test readability and error messages.
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
Replace native Go testing patterns (t.Errorf, t.Fatalf, t.Error,
t.Fatal) with github.com/stretchr/testify equivalents (assert.X,
require.X) for improved test readability and error messages.
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
Replace native Go testing patterns (t.Errorf, t.Fatalf, t.Error,
t.Fatal) with github.com/stretchr/testify equivalents (assert.X,
require.X) for improved test readability and error messages.
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
Convert pkg/gates, pkg/kubeenv, pkg/ignore, and pkg/helmpath test
files from native Go testing patterns (t.Errorf, t.Fatalf, t.Error,
t.Fatal) to github.com/stretchr/testify equivalents (assert.X,
require.X).
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
- only cache kube client when creation succeeds
- add regression test for two failed reachability checks
Signed-off-by: Mohammad Abdolirad <m.abdolirad@gmail.com>
* fix: protect FailingKubeClient.RecordedWaitOptions from concurrent access
Add a sync.Mutex to guard the append to RecordedWaitOptions in
GetWaiterWithOptions, fixing a data race detected by -race when
concurrent goroutines (e.g. upgrade + rollback) both call
GetWaiterWithOptions on the same FailingKubeClient instance.
Fixes race failures in TestUpgradeRelease_Interrupted_RollbackOnFailure
and TestInstallRelease_RollbackOnFailure_Interrupted.
Signed-off-by: Terry Howe <thowe@nvidia.com>
* fix: extract appendRecordedWaitOptionsLocked helper with defer unlock
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---------
Signed-off-by: Terry Howe <thowe@nvidia.com>
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
Commands like 'helm registry login', 'helm push', and 'helm pull' were
writing success messages ("Login Succeeded", "Pushed:", "Pulled:",
"Digest:") to stderr instead of stdout. The root cause was that
newDefaultRegistryClient and newRegistryClientWithTLS hard-coded
os.Stderr as the registry client writer, ignoring the out io.Writer
that main() passes as os.Stdout.
Thread out io.Writer through newRegistryClient, newDefaultRegistryClient,
and newRegistryClientWithTLS, and update all call sites in pkg/cmd.
Fixes#13464
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
When lookup cannot find the requested resource (apierrors.IsNotFound),
add slog.Debug() calls with structured fields (apiVersion, kind,
namespace, name) so that users running helm template --debug can see
why lookup returned an empty map instead of silently swallowing the
not-found result.
Fixes: https://github.com/helm/helm/issues/32101
Signed-off-by: Ogulcan Aydogan <ogulcanaydogan@hotmail.com>
Return the actual error from io.Copy in Digest() instead of nil.
The previous code swallowed the error and returned an empty string
as a valid SHA-256 digest, which could silently break chart
provenance verification.
Also fix encodeRelease() in pkg/storage/driver/util.go:
- Close the gzip writer on the w.Write() error path to avoid
leaking resources.
- Check the error return from gzip.Writer.Close(), which flushes
remaining compressed data and can fail.
Assisted-by: Grok/xAI
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
Before this change, hooks with `helm.sh/hook: test` but Kind != Pod
(ConfigMap, Secret, ...) led to `helm test --logs` fail with
`unable to get pod <name>`.
Signed-off-by: Gregory Man <man.gregory@gmail.com>
slog.Error on line 157 passes printf-style positional args (%q, %s)
instead of key-value pairs. The slog API treats these as unkeyed
attributes, producing garbled log output.
Two nearby slog.Warn calls wrap fmt.Sprintf unnecessarily. Convert
all three calls to use proper structured key-value arguments.
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
Assisted-by: Grok/grok-4
- Distinguish unowned resources from those whose ownership could not be
verified (e.g. RBAC/network errors). Unverifiable resources are now
returned in a separate list with the underlying error so log output
and the "kept" summary describe what actually happened.
- Only prefix the kept summary with the resource-policy header when
there are policy-kept resources, so users with only ownership-skipped
resources don't see a misleading header.
- Update verifyOwnershipBeforeDelete doc comment to reflect that
not-found resources are excluded from all returned lists.
- Assert success of Releases.Create in uninstall tests so fixture
setup failures are surfaced immediately.
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
- Close log stream after reading (prevents connection/fd leak)
- Strengthen tests to assert on output headers rather than error paths
- Remove unused import
Signed-off-by: Sebastien Tardif <SebTardif@ncf.ca>
When a test pod contains multiple containers (e.g. Istio/Consul/Vault
sidecars), 'helm test --logs' failed with 'a container name must be
specified'. This happened because GetPodLogs called the Kubernetes log
API without specifying a container name.
The fix fetches the pod spec first, then iterates over all containers
(init containers + regular containers) and requests logs for each one
explicitly. Errors from individual containers are collected and returned
together via errors.Join rather than aborting on the first failure.
Also fixes a typo: hooksByWight -> hooksByWeight.
Closes#6902
Signed-off-by: Sebastien Tardif <SebTardif@ncf.ca>
Helm now requires Go 1.26 (#32078); the cloner[T] type-assertion fallback
in transport.go was a defensive shim for Go versions before
http.Transport.Clone() existed. The fallback path is unreachable on
supported Go versions.
Refs: #31386
Signed-off-by: Ogulcan Aydogan <ogulcanaydogan@hotmail.com>
The previous change suppressed ctx.Err() whenever there were no
resource-specific errors, which incorrectly swallowed context.Canceled
and other non-deadline errors signalling an external interruption.
Refine the condition: only suppress context.DeadlineExceeded when there
are no resource-specific errors (resources are Unknown/NotFound, meaning
the delete wait succeeded or resources were already gone). Any other
context error — including context.Canceled — is always propagated.
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
During informer initialization there is a brief window where watched
resources appear as Unknown before their real statuses are delivered.
The statusObserver skips Unknown resources when waiting for deletion
(they may have been deleted before the watch started), but if *all*
resources are in that transient Unknown state the skipped-resource list
is empty. AggregateStatus on an empty slice returns the desired status,
causing cancel() to be called immediately — before any real status event
has arrived.
Guard against this by tracking the count of Unknown-skipped resources.
When every resource was Unknown-skipped and none have a definitive status
yet, defer the early-cancel decision until at least one resource reports
a real status. This preserves the correct behaviour for resources that
were genuinely deleted before the watch started (they eventually receive
a NotFound or stay Unknown, and the aggregate succeeds), while fixing
the race for resources that are transiently Unknown at startup.
Also tighten the ctx.Err() check in waitForDelete: only append a
deadline error when there are resource-specific errors to accompany it.
A timeout while all resources are Unknown or NotFound is not itself an
error — the resources are in an acceptable state for a delete wait.
Fixes: TestStatusWaitForDelete/error_when_not_all_objects_are_deleted
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
`isVersionRange` checked for `x`/`X` across the entire version
string, misclassifying exact versions like `1.0.0-fix`,
`2.0.0-next`, or `1.0.0+exp` as ranges.
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
From Matt's comment
> The check for " || " should remove the spaces and have "||". Spaces around the || aren't required.
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
When using version ranges like ^1 or ~1.10, Helm incorrectly showed
warnings about falling back to closest version. Only show the warning
when an exact version is requested but not found.
Fixes: https://github.com/helm/helm/issues/31757
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
Only user-supplied nils should survive coalescing. Chart-default nils
defaults, not just user overrides. This caused:
- %!s(<nil>) in templates using Bitnami common.secrets.key (#31919)
- pluck fallbacks returning nil instead of falling through to globals
(#31971)
Fixes#31919Fixes#31971
Signed-off-by: Johannes Lohmer <jojo.dev@lohmer.com>
Three test cases that cover the regression scenarios introduced
by the #31644 nil preservation fix:
- subchart default nils should be cleaned up
when parent doesn't set those keys (#31919)
- user-supplied null should erase subchart defaults (#31919)
- subchart default nil should not shadow global values via pluck (#31971)
Tests are expected to fail until the regression is fixed.
Signed-off-by: Johannes Lohmer <jojo.dev@lohmer.com>
When running 'helm pull --debug', no debug output was printed because
the HTTP getter did not emit any slog.Debug messages. This adds
slog.Debug calls to log the URL being fetched and the response status
when debug-level logging is enabled.
Fixeshelm/helm#31098
Signed-off-by: Cairon <cairon-ab@users.noreply.github.com>
Move implementation to pkg/kubeenv per review; kube.RetryingRoundTripper
remains a type alias for API compatibility. pkg/cli uses kubeenv only.
Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com>
The previous fix (increasing timeout / reducing deletion delay) did not
work because the flakiness is not a timing problem at all.
Root cause: fluxcd/cli-utils HasSynced() returns true after the initial
list item is *popped* from DeltaFIFO, which is before AddFunc delivers
the ResourceUpdateEvent to the collector. This creates a race where the
SyncEvent can arrive at the statusObserver *before* the pod's Current
status is recorded. When that happens:
- statusObserver sees pod as Unknown
- Unknown is skipped for WaitForDelete (by design, to handle resources
that were already deleted before watching started)
- AggregateStatus([], NotFoundStatus) == NotFoundStatus → cancel()
- The watch context is cancelled before DeleteFunc can fire
- Final check: pod still Current → error
The test intent is to verify that waitForDeleteCtx (not the cancelled
generalCtx) is selected. A non-existent resource satisfies this:
- With waitForDeleteCtx=Background(): informer syncs with empty list
→ Unknown → cancel → success ✓
- With generalCtx (cancelled, wrong): context immediately done
→ ctx.Err() appended → error returned ✓
Remove the goroutine-based deletion and the pod creation to eliminate
the race while preserving the context-selection assertion.
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
TestMethodContextOverridesGeneralContext/WaitForDelete used a 1s
timeout with a 500ms deletion delay, leaving only ~500ms for the
fake watcher to propagate the delete event. On loaded CI runners
this window is too tight and causes intermittent failures.
Increase the timeout to 5s and reduce the deletion delay to 100ms
so there is ample headroom. Apply the same deletion-delay reduction
to TestStatusWaitForDelete which shares the same pattern.
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
When Deployed() succeeds but releaserToV1Release() fails, prepareUpgrade
returned err (nil) instead of cerr (the conversion error), causing a
silent nil return that could lead to nil pointer dereferences downstream.
Closes#32007
Signed-off-by: Rhys McNeill <rhysmcneill7@hotmail.co.uk>
Move the retrying HTTP round-tripper used by EnvSettings into pkg/cli so
pkg/cli no longer imports pkg/kube, avoiding import cycles for Helm
library consumers while preserving retry behavior for transient API
server errors.
Add pkg/cli/roundtripper_test.go with parity coverage for the moved logic.
Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com>
Made-with: Cursor
Move the retrying round tripper used by EnvSettings into pkg/cli so
pkg/cli no longer imports pkg/kube. This preserves retry behavior while
breaking the import edge that triggers cycles for Helm library consumers
(such as the kustomize integration described in #31965).
Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com>
Jakub Jaruszewski
Matthieu MOREL
George Jenkins
Matheus Pimenta
Terry Howe
LarytheLord
Mahesh Sadupalli
kimsungmin1
kimsm28
Will Noble
Will Noble
s3onghyun
Jeaeun Kim
Evans Mungai
Mohammad Abdolirad
Ogulcan Aydogan
MrJack
Austin Abro
Sebastien Tardif
Robert Sirchia
Gregory Man
Kai Tanaka
box4wangjing
Sumit Solanki
Benoit Tigeot
Johannes Lohmer
Johannes Lohmer
Jorge Rocamora
Cairon
Anmol Virdi
Rhys McNeill
abhay1999
Debasish Mohanty