* fix: deep merge environments from multiple bases (#2273)
Problem:
When using multiple base helmfiles, environment values were being
completely replaced instead of deep-merged due to mergo.WithOverride
introduced in PR #2228.
Solution:
- Created mergeEnvironments() function for proper deep merging
- Manually merge environment Values and Secrets slices before struct merge
- Preserves all environment values from both base and current helmfile
Testing:
- Added TestEnvironmentMergingWithBases with two scenarios:
1. Multiple bases with overlapping environment values
2. Environment values with array merging
Fixes#2273
Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
* fix: auto-detect Kubernetes version for helm-diff (#2275)
Problem:
When helmfile runs helm-diff without specifying kubeVersion, helm-diff
falls back to v1.20.0. This causes chart compatibility checks to fail
for charts requiring newer Kubernetes versions (e.g., kubeVersion: ">=1.25.0").
Root Cause:
- flagsForDiff() was not passing kubeVersion to helm-diff plugin
- Without --kube-version flag, helm-diff uses default v1.20.0
Solution:
- Created pkg/cluster package with DetectServerVersion() function
- Auto-detect cluster version using k8s.io/client-go discovery API
- Pass detected version to helm-diff via --kube-version flag
- Priority: helmfile.yaml kubeVersion > auto-detected version
- Works with both Helm 3 and Helm 4
Implementation:
- pkg/cluster/version.go: Cluster version detection
- pkg/app/app.go: detectKubeVersion() helper used in diff() and apply()
- pkg/state/state.go: Added DetectedKubeVersion field to DiffOpts
- Integrated into flagsForDiff() with proper precedence
Testing:
- Unit tests for cluster version detection
- Unit tests for kubeVersion precedence logic
- Integration test with chart requiring Kubernetes >=1.25.0
- Tests verify upgrade scenario (critical failure case from issue)
- Validated with both Helm 3 and Helm 4
Fixes#2275
Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
* fix: enable lookup() function with strategicMergePatches (#2271)
Problem:
When using strategicMergePatches (kustomize), Helm's lookup() function
stops working. Charts like Grafana use lookup() to preserve existing
resource values (e.g., PVC volumeName), which get lost when using patches.
Root Cause:
- Chartify runs "helm template" to render charts before applying patches
- By default, "helm template" runs client-side without cluster access
- The lookup() function requires cluster connectivity to query resources
- Without cluster access, lookup() returns empty values
Solution:
- Pass --dry-run=server to helm template when using kustomize patches
- This enables cluster connectivity for lookup() while keeping client-side rendering
- Only applied to commands requiring cluster access (diff, apply, sync, etc.)
- Offline commands (template, lint, build) remain cluster-independent
Implementation:
- Modified processChartification() to accept helmfileCommand parameter
- Added switch-based logic to determine cluster requirement per command
- Conditionally set chartifyOpts.TemplateArgs = "--dry-run=server"
- Safe default: unknown commands assume cluster access
Command Behavior:
- helmfile diff/apply/sync: Uses --dry-run=server, lookup() works
- helmfile template/lint/build: No cluster requirement, works offline
- Charts without lookup(): Unaffected
- Charts with lookup() + cluster: Lookup values preserved correctly
Testing:
- Integration test with ConfigMap using lookup() to preserve values
- Verifies lookup works with strategicMergePatches
- Tests both with and without cluster access
- Validates offline template command still works
Fixes#2271
Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
* fix: remove unnecessary error return from mergeEnvironments
The mergeEnvironments function always returns nil, making the error
return value unnecessary. This fixes the unparam linter warning.
- Changed function signature to not return error
- Updated call site to not handle error
- All tests still pass
Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
* fix: handle nil Environments map in mergeEnvironments
Fixes panic when base helmfile has nil Environments map.
Initialize the destination map if nil before merging to prevent
"assignment to entry in nil map" panic.
- Added nil check in mergeEnvironments to return early
- Initialize layers[0].Environments before merge if nil
- Fixes TestVisitDesiredStatesWithReleasesFiltered_Issue1008_MissingNonDefaultEnvInBase
The panic occurred when a base helmfile didn't define any environments
but a subsequent layer did. Now we properly initialize an empty map
to merge into.
Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
* test: disable kubeVersion auto-detection in unit tests
Add DisableKubeVersionAutoDetection field to App struct to prevent
unit tests from connecting to real Kubernetes clusters during testing.
The kubeVersion auto-detection feature (issue #2275) was causing
unit tests to fail because:
1. Tests use mock helm implementations without real cluster access
2. Auto-detection was connecting to local minikube cluster (v1.34.0)
3. Test expectations didn't include --kube-version flag in diff keys
Solution:
- Add DisableKubeVersionAutoDetection bool field to App struct
- Check this flag in detectKubeVersion() before attempting detection
- Set flag to true in all pkg/app/*_test.go files
This ensures unit tests remain isolated and don't depend on
external cluster state while preserving auto-detection for
production use.
Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
* chore: upgrade helm-diff plugin to v3.14.1
Update helm-diff plugin from v3.14.0 to v3.14.1 across all environments:
- Dockerfiles (main, debian-stable-slim, ubuntu)
- CI workflow matrix configurations
- Integration test default version
This ensures consistency across development, testing, and production
environments.
Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
* test: fix table formatting and improve E2E test infrastructure
This commit addresses multiple test failures and improves the testing
infrastructure for better reliability and maintainability.
Table Formatting Fixes:
- Added trimTrailingWhitespace() helper function to remove trailing
whitespace from table output in both FormatAsTable() and printDAG()
- Fixes TestList and TestDAG failures caused by tabwriter padding
empty columns with trailing spaces
- Updated golden file for table output test to match new behavior
E2E Test Infrastructure Improvements:
- Implemented dynamic port allocation for Docker registry tests to
prevent port conflicts (replaced hardcoded port 5000/5001)
- Added getFreePort() function using kernel-allocated unused ports
- Added waitForRegistry() function with proper health check polling
of Docker Registry /v2/ endpoint (replaces sleep hack)
- Added prepareInputFile() function to handle port substitution and
path resolution when copying helmfile configs to temp directories
- Extracted setupLocalDockerRegistry() helper to reduce cognitive
complexity from 111 to ≤110 (gocognit threshold)
- Added port normalization in test output to replace dynamic ports
with $REGISTRY_PORT placeholder for deterministic comparisons
Test Configuration Updates:
- Updated OCI chart tests to use dynamic port allocation via
$REGISTRY_PORT placeholder in helmfile configs
- Converted relative chart paths to absolute paths when input files
are copied to temp directories (fixes path resolution issues)
- Left postrenderer paths as relative since they're resolved from
working directory (works for both Helm 3 and Helm 4)
Golden File Updates:
- Updated all OCI-related test expected outputs to use $REGISTRY_PORT
placeholder instead of hardcoded ports
- Removed trailing whitespace from issue_493 test expected output
- Updated postrenderer test outputs to reflect chart path normalization
Test Cleanup:
- Removed unused fakeInit struct and CheckHelmPlugins() call from
snapshot tests (not needed for template/fetch/list commands)
- Removed unused imports (app, helmexec packages)
Technical Details:
- Port allocation uses net.Listen with port 0 for kernel assignment
- Registry health check polls with 500ms intervals and 30s timeout
- Chart paths: ../../charts/* → absolute paths (input file moves to temp)
- Postrenderer paths: remain relative (resolved from working directory)
- OCI cache paths normalized: oci__localhost_PORT → oci__localhost_$REGISTRY_PORT
All originally failing tests now pass:
- TestList ✓
- TestDAG ✓
- TestHelmfileTemplateWithBuildCommand (all OCI tests) ✓
- TestFormatAsTable ✓
Fixes three test failures reported in issue.
Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
* fix(test): convert postrenderer paths to absolute for Helm 3
Helm 3 resolves postrenderer script paths relative to the helmfile
location. When the input file is copied to a temp directory for
port substitution, relative postrenderer paths break.
Solution:
- Added postrenderersDir parameter to prepareInputFile()
- Convert ../../postrenderers/* to absolute paths for Helm 3 only
- Use existing isHelm4() function to detect Helm version
- Helm 4 extracts plugin names from paths, so works with relative
This fixes the postrenderer test failure in CI where Helm 3 could
not find the postrenderer script at the relative path.
Fixes: Error: unable to find binary at ../../postrenderers/add-cm2.bash
Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
* fix(test): remove remaining hardcoded port 5001 in OCI tests
Updated 4 remaining OCI chart tests that still had hardcoded port 5001:
- oci_chart_pull
- oci_chart_pull_once
- oci_chart_pull_once2
- oci_chart_pull_direct
Changes:
- config.yaml: Removed hardcoded port, use dynamic allocation
- input.yaml.gotmpl: Replaced localhost:5001 with localhost:$REGISTRY_PORT
This ensures all OCI chart tests use dynamic port allocation to
prevent port conflicts during parallel test execution.
Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
* fix: prevent helm-diff from normalizing server-side defaults
Problem:
The suppress-output-line-regex integration test was failing because
helm-diff was reporting "has changed, but diff is empty after suppression"
for Service resources when it should have shown ipFamilyPolicy and ipFamilies
fields being removed.
Root Cause:
When auto-detected kubeVersion (e.g., 1.34.0) is passed to helm-diff via
--kube-version flag, helm-diff normalizes server-side defaults. This makes
fields like ipFamilyPolicy and ipFamilies appear unchanged, even though they
don't exist in the chart template and will be removed by the upgrade.
After applying suppressOutputLineRegex patterns, only label changes remained
(helm.sh/chart and app.kubernetes.io/version). These were correctly suppressed,
leaving an empty diff - hence the "diff is empty after suppression" message.
Solution:
Added a new configuration option 'disableAutoDetectedKubeVersionForDiff' to allow
disabling auto-detected kubeVersion being passed to helm-diff. This prevents
helm-diff from normalizing server-side defaults when needed.
Default behavior: Pass auto-detected kubeVersion (fixes issue #2275, existing behavior)
Opt-out behavior: Set flag to true to only use explicit kubeVersion from helmfile.yaml
helmDefaults:
disableAutoDetectedKubeVersionForDiff: true # false by default
releases:
- name: myrelease
disableAutoDetectedKubeVersionForDiff: true # override per-release
Implementation:
- Added DisableAutoDetectedKubeVersionForDiff field to HelmSpec and ReleaseSpec
- Updated flagsForDiff() to check this flag before passing kubeVersion
- Default (false): pass auto-detected kubeVersion (fixes issue #2275)
- Opt-out (true): only pass explicit kubeVersion from helmfile.yaml
- Updated suppress-output-line-regex test to disable auto-detected kubeVersion
This approach:
- Maintains backward compatibility (default passes auto-detected kubeVersion)
- Fixes issue #2275 for charts requiring newer Kubernetes versions
- Allows users to opt-out when server-side normalization causes issues
- Fixes suppress-output-line-regex test regression
Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
* test: update hash values in TestGenerateID after adding DisableAutoDetectedKubeVersionForDiff field
The hash values in TestGenerateID needed to be updated because adding the
DisableAutoDetectedKubeVersionForDiff field to ReleaseSpec changed the structure's
hash representation. This is expected behavior as generateValuesID() hashes the
entire ReleaseSpec structure.
Updated all expected hash values to match the new values:
- baseline: foo-values-66f7fd6f7b
- different bytes content: foo-values-6664979cd7
- different map content: foo-values-78897dfd49
- different chart: foo-values-64b7846cb7
- different name: bar-values-576cb7ddc7
- specific ns: myns-foo-values-6c567f54c
Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
* fix: address PR review comments and resolve issue #2280
This commit addresses all review comments from GitHub Copilot and
resolves issue #2280 regarding --color flag conflict with Helm 4.
Changes:
1. Fixed documentation in pkg/cluster/version.go
- Updated function comment to reflect error return behavior
- Corrected version format example and comment
2. Added complete command categorization in pkg/state/state.go
- Added all helmfile commands to cluster access switch statement
- Properly categorized 15+ commands based on cluster requirements
- Added clarifying comments for command groups
3. Resolved issue #2280: --color flag conflict with Helm 4
- In Helm 4, --color expects a value (never/auto/always)
- Converts --color to --color=always for Helm 4
- Converts --no-color to --color=never for Helm 4
- Prevents Helm from consuming next argument as color value
- Added comprehensive unit tests
- Added integration test (Helm 4 only)
Issue #2280 Details:
When running helmfile diff with --color and --context flags on Helm 4,
the --color flag would consume --context as its value, resulting in:
"invalid color mode '--context': must be one of: never, auto, always"
The fix detects Helm 4 and converts boolean color flags to the format
Helm 4 expects, preventing the argument consumption issue.
Fixes#2280
Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
* fix: correct kubeVersion precedence comment in test
The comment incorrectly stated that state.KubeVersion takes precedence
over paramKubeVersion, but the actual implementation (getKubeVersion in
state.go:3354-3364) shows the correct order is:
1. paramKubeVersion (auto-detected from cluster)
2. release.KubeVersion (per-release override)
3. state.KubeVersion (helmfile.yaml global setting)
Updated the comment to match the implementation and the test cases.
Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
* fix: resolve Helm 4 --color flag conflict (issue #2280)
This commit resolves issue #2280 where the --color flag causes Helm 4
to consume the next argument, resulting in errors like:
"invalid color mode '--context': must be one of: never, auto, always"
Root Cause:
In Helm 4, the --color flag is parsed by the Helm binary before being
passed to plugins like helm-diff. This causes Helm to interpret the
next argument (e.g., --context) as the value for --color.
Solution:
Remove --color and --no-color flags from helm-diff commands when using
Helm 4, and instead use the HELM_DIFF_COLOR environment variable.
The helm-diff plugin supports HELM_DIFF_COLOR=[true|false] as an
alternative to the --color/--no-color flags.
Changes:
1. Added filterColorFlagsForHelm4() function in pkg/helmexec/exec.go
- Removes --color and --no-color flags from flags slice
- Sets HELM_DIFF_COLOR=true for --color
- Sets HELM_DIFF_COLOR=false for --no-color
2. Modified DiffRelease() to call filterColorFlagsForHelm4() on Helm 4
3. Added comprehensive unit tests in pkg/helmexec/exec_test.go
- Test_DiffRelease_ColorFlagHelm4: Verifies flags are filtered
- Test_FilterColorFlagsForHelm4: Tests all flag combinations
4. Added integration test in test/integration/test-cases/issue-2280.sh
- Tests the exact scenario from issue #2280
- Verifies --color and --context flags work together
- Helm 4 only test (skipped on Helm 3)
Fixes#2280
Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
* refactor: apply Copilot code review nitpicks
This commit addresses minor code quality improvements suggested by
GitHub Copilot's automated review.
Changes:
1. pkg/app/formatters.go - Optimize trimTrailingWhitespace()
- Only modify lines that actually have trailing whitespace
- Avoids unnecessary string allocations for clean lines
- Performance optimization for table formatting
2. test/e2e/template/helmfile/snapshot_test.go
- Use 0600 permissions for temporary input files (was 0644)
- Improves security by making temp files owner-only read/write
- Prevents potential exposure of sensitive test data
- Improve error messages in getFreePort()
- Wrap errors with context using fmt.Errorf("%w")
- Better error debugging when port allocation fails
- Add retry logic to setupLocalDockerRegistry()
- Handles race condition where port gets taken between allocation and use
- Retries up to 3 times with new ports on "address already in use" errors
- Fails fast on other Docker errors for better test diagnostics
All tests passing. These are non-functional improvements that enhance
code quality, performance, security, and test reliability.
Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
* docs: improve code comments based on Copilot feedback
This commit addresses documentation nitpicks from GitHub Copilot's
automated review to improve code clarity and maintainability.
Changes:
1. pkg/app/app.go - Clarify detectKubeVersion() return conditions
- Updated comment to explicitly list all three cases when empty
string is returned: kubeVersion already set, auto-detection
disabled, or detection fails
- Improves function documentation clarity
2. test/e2e/template/helmfile/snapshot_test.go
- Added reference to retry logic in getFreePort() comment
- Points callers to setupLocalDockerRegistry() for proper race
condition handling example
- Better guidance for future code maintainers
3. pkg/state/state.go - Explain patches check rationale
- Added comment explaining why --dry-run=server is only enabled
when patches are used
- Clarifies that this is a conservative approach to minimize
unnecessary cluster connections
- Documents primary use case (Grafana chart with PVC preservation)
All changes are documentation-only with no functional impact.
All tests passing.
Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
* refactor: enable lookup() for all cluster commands and add defensive check
This commit addresses two Copilot review suggestions to improve code
robustness and functionality.
Changes:
1. pkg/state/state.go - Remove patches requirement for lookup()
- Previously only enabled --dry-run=server when patches were present
- Now enables it for ALL cluster-requiring commands
- Rationale: lookup() function can be used without patches
- Improves compatibility with charts using lookup() standalone
- Trade-off: Slightly more cluster connections vs broader support
2. pkg/helmexec/exec.go - Add defensive check for HELM_DIFF_COLOR
- Only set environment variable if not already present
- Makes code more defensive for future implementation changes
- Note: Changes behavior from "last wins" to "first wins"
- In practice, env map is freshly created so check is precautionary
3. pkg/helmexec/exec_test.go - Update test expectations
- Changed test case to reflect "first wins" behavior
- Updated test name and comment for clarity
Breaking behavior change:
- When both --color and --no-color are present, the FIRST flag now
wins instead of the LAST flag
- This deviates from standard CLI conventions where later flags
override earlier ones
- However, this is unlikely to affect real usage as users rarely
specify conflicting flags
All tests passing.
Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
---------
Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
* Fix helmBinary and kustomizeBinary being ignored when using bases
- Add mergo.WithOverride to merge operations for proper precedence
- Move default binary setting after base loading
- Add comprehensive tests for various base scenarios
Co-authored-by: yxxhero <11087727+yxxhero@users.noreply.github.com>
* Fix code formatting in create_test.go
Co-authored-by: yxxhero <11087727+yxxhero@users.noreply.github.com>
* Remove duplicate comment block in create_test.go
Removed duplicate comment lines (530-532) as identified by code review.
Co-authored-by: yxxhero <11087727+yxxhero@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: yxxhero <11087727+yxxhero@users.noreply.github.com>
* feat: make environment context available
This feature adds the "{{.Environment.KubeContext}}" variable.
Discussion #829
Signed-off-by: sewieland <sebastian.wieland@iav.de>
* chore: fix tests which compare logging outputs
This commit adds an addtional space wherever needed to the expected log outputs due to the added "KubeContext" in the environment struct.
Discussion #829
Signed-off-by: Sebastian Wieland <wieland.s@mailbox.org>
* docs: added documentation for `Environment.KubeContext`
Discussion #829
Signed-off-by: Sebastian Wieland <wieland.s@mailbox.org>
* test: make sure the `Environment.KubeContext` is mapped out correctly
Discussion #829
Signed-off-by: Sebastian Wieland <wieland.s@mailbox.org>
---------
Signed-off-by: sewieland <sebastian.wieland@iav.de>
Signed-off-by: Sebastian Wieland <wieland.s@mailbox.org>
Co-authored-by: sewieland <sebastian.wieland@iav.de>
Allow configuring the lockfile in the state. This makes it possible for
example maintain a lock per environment.
Signed-off-by: Lassi Pölönen <lassi.polonen@iki.fi>
Signed-off-by: Lassi Pölönen <lassi.polonen@iki.fi>
* feat: show live output from the Helm binary
Signed-off-by: Rodrigo Fior Kuntzer <rodrigo@miro.com>
* fixup! Merge branch 'main' into enable-live-output
Signed-off-by: Yusuke Kuoka <ykuoka@gmail.com>
Currently it's not possible to use `.Environment` values in `*.gomtpl` files. The documentation states the opposite:
https://github.com/roboll/helmfile#environment (2nd paragraph).
The problem is already described in #1090.
This PR fixes this bug.
Fixes#1090
Co-authored-by: Peter Aichinger <petera@topdesk.com>
When helmfile is run with `--environment NAME` and there was a base hemlfile that misses `environments`, helmfile had been trying to load env values for NAME and failing.
A base helmfile is allowed to reference values from within itself, but that's optional. In other words, a base helmfile that misses the env is okay as long as it doesn't self-reference env values.
So, this change allows missing env and env values while loading base helmfile. After loading, a base helmfile can fail due to referencing missing env values, but that's okay.
Fixes#1008
Closes#444 and #782
This is the final PR to fully cache and parallelize helm secret decryption. It threads the shared helmexec.Interface into the StateCreator and HelmState structs to be used during environment secret decryption. This should effectively cache secrets for the duration of a helmfile run, regardless of where they are first decrypted.
This change enhances helmfile to accept terraform-module-like URLs in nested state files a.k.a sub-helmfiles.
```yaml
helmfiles:
- # Terraform-module-like URL for importing a remote directory and use a file in it as a nested-state file
# The nested-state file is locally checked-out along with the remote directory containing it.
# Therefore all the local paths in the file are resolved relative to the file
path: git::https://github.com/cloudposse/helmfiles.git@releases/kiam.yaml?ref=0.40.0
```
The URL isn't equivalent to terraform module sources. The difference is that we use `@` to distinguish between (1) the path to the repository and directory containing the state file and (2) the path to the state file being loaded. This distinction provides us enough fleibiity to instruct helmfile to check-out necessary and sufficient directory to make the state file works.
Under the hood, it uses [hashicorp/go-getter](https://github.com/hashicorp/go-getter), that is used for [terraform module sources](https://www.terraform.io/docs/modules/sources.html) as well.
Only the git provider without authentication like git-credentials helper is tested. But theoretically any go-getter providers should work. Please feel free to test the provider of your choice and contribute documentation or instruction to use it :)
Resolves#347
Aditya Menon
Copilot
SADIK KUZU
yxxhero
Alessio Dionisi
Yusuke Kuoka
SeWieland
Lassi Pölönen
Rodrigo Fior Kuntzer
Arkaitz Jimenez
yxxhero
austin ce
pjotre86
Wi1dcard
Joshua Hansen
Kevin J. Qiu
chenrui
Eric Bailey
Kyrylo Lebediev
Travis Groth