Fix Helmfile swallowing secrets decryption errors (#1849)

Fixes #1826

.circleci/Makefile

@@ -0,0 +1,77 @@
+HELM_VERSION ?= v3.5.3
+HELM2_VERSION ?= v2.17.0
+KUSTOMIZE_VERSION ?= v3.8.8
+K8S_VERSION ?= v1.13.12
+MINIKUBE_VERSION ?= v0.30.0
+SOPS_VERSION ?= v3.6.1
+
+# ---
+CHANGE_MINIKUBE_NONE_USER ?= true
+MINIKUBE_WANTUPDATENOTIFICATION ?= false
+MINIKUBE_WANTREPORTERRORPROMPT ?= false
+
+VAULT_ADDR := http://127.0.0.1:8200
+VAULT_TOKEN := toor
+
+tmp := $(shell mktemp -d)
+HELM_FILENAME := helm-${HELM_VERSION}-linux-amd64.tar.gz
+HELM2_FILENAME := helm-${HELM2_VERSION}-linux-amd64.tar.gz
+KUSTOMIZE_FILENAME := kustomize_${KUSTOMIZE_VERSION}_linux_amd64.tar.gz
+
+
+all: vault sops helm kustomize minikube/destroy minikube
+
+helm:
+	curl -sSLo $(tmp)/${HELM_FILENAME} "https://get.helm.sh/${HELM_FILENAME}"
+	tar zxf $(tmp)/${HELM_FILENAME} --directory ${tmp} linux-amd64/helm
+	chmod +x ${tmp}/linux-amd64/helm
+	sudo mv ${tmp}/linux-amd64/helm /usr/local/bin/
+.PHONY: helm
+
+helm2:
+	curl -sSLo $(tmp)/${HELM2_FILENAME} "https://kubernetes-helm.storage.googleapis.com/${HELM2_FILENAME}"
+	tar zxf $(tmp)/${HELM2_FILENAME} --directory ${tmp} linux-amd64/helm
+	chmod +x ${tmp}/linux-amd64/helm
+	sudo mv ${tmp}/linux-amd64/helm /usr/local/bin/
+.PHONY: helm2
+
+kustomize:
+	curl -sSLo $(tmp)/${KUSTOMIZE_FILENAME} "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2F${KUSTOMIZE_VERSION}/${KUSTOMIZE_FILENAME}"
+	tar zxf $(tmp)/${KUSTOMIZE_FILENAME} --directory ${tmp} kustomize
+	chmod +x ${tmp}/kustomize
+	sudo mv ${tmp}/kustomize /usr/local/bin/
+.PHONY: kustomize
+
+minikube/destroy:
+	sudo -E minikube delete || true
+	sudo -E rm -rf /etc/kubernetes || true
+	sudo -E rm -rf $$HOME/.minikube/* || true
+.PHONY: minikube/destroy
+.EXPORT_ALL_VARIABLES: minikube/destroy
+
+minikube:
+	curl -sSLo ${tmp}/kubectl https://storage.googleapis.com/kubernetes-release/release/${K8S_VERSION}/bin/linux/amd64/kubectl
+	chmod +x ${tmp}/kubectl && sudo mv ${tmp}/kubectl /usr/local/bin/
+	curl -sSLo ${tmp}/minikube https://storage.googleapis.com/minikube/releases/${MINIKUBE_VERSION}/minikube-linux-amd64
+	chmod +x ${tmp}/minikube && sudo mv ${tmp}/minikube /usr/local/bin/
+	sudo -E minikube delete || true
+	sudo -E rm -rf /etc/kubernetes || true
+	sudo -E rm -rf $$HOME/.minikube/* || true
+	sudo -E minikube start --vm-driver=none --kubernetes-version=${K8S_VERSION}
+	sudo -E minikube update-context
+	kubectl wait node/minikube --for=condition=Ready
+.PHONY: minikube
+.EXPORT_ALL_VARIABLES: minikube
+
+vault:
+	docker kill $$(docker ps -a --filter "name=vault" -q) || true
+	docker run -d -p8200:8200 --rm --name vault vault:1.2.0 server -dev -dev-root-token-id=toor
+	docker run --rm --network="host" -e VAULT_ADDR=$$VAULT_ADDR -e VAULT_TOKEN=$$VAULT_TOKEN  vault:1.2.0 secrets enable -path=sops transit
+	docker run --rm --network="host" -e VAULT_ADDR=$$VAULT_ADDR -e VAULT_TOKEN=$$VAULT_TOKEN  vault:1.2.0 write sops/keys/key type=rsa-4096
+.PHONY: vault
+
+sops:
+	curl -sSLo $(tmp)/sops "https://github.com/mozilla/sops/releases/download/${SOPS_VERSION}/sops-${SOPS_VERSION}.linux"
+	chmod +x $(tmp)/sops	
+	sudo mv ${tmp}/sops /usr/local/bin/
+.PHONY: sops

.circleci/config.yml

@@ -1,25 +1,76 @@
-version: 2
+version: 2.1
 
 jobs:
 
   build:
     docker:
-      - image: circleci/golang:1.11.2
-    working_directory: /go/src/github.com/roboll/helmfile
+      - image: circleci/golang:1.16.3
+    environment:
+      GOPATH: /go
+    working_directory: /home/circleci/workspace/helmfile
     steps:
       - checkout
+      - restore_cache:
+          keys:
+          - go-mod-cache-v1-{{ checksum "./go.sum" }}
+          - go-mod-cache-v1-
+      - run: go env
       - run: make build
+      - run: make build-test-tools
+      - save_cache:
+          key: go-mod-cache-v1-{{ checksum "./go.sum" }}
+          paths:
+          - /go/pkg/mod
       - persist_to_workspace:
-          root: /go/src/github.com/roboll/helmfile
+          root: ./
           paths:
             - .
+  image:
+    docker:
+    - image: circleci/golang:1.16.3
+    working_directory: /home/circleci/workspace/helmfile
+    steps:
+    - checkout
+    - restore_cache:
+        keys:
+        - go-mod-cache-v1-{{ checksum "./go.sum" }}
+        - go-mod-cache-v1-
+    - setup_remote_docker
+    - run:
+        command: |
+          make tools
+          go mod vendor
+          ORG=roboll BUILD_URL="$CIRCLE_BUILD_URL" make image
+
+  image_helm3:
+    docker:
+    - image: circleci/golang:1.16.3
+    working_directory: /home/circleci/workspace/helmfile
+    steps:
+    - checkout
+    - restore_cache:
+        keys:
+        - go-mod-cache-v1-{{ checksum "./go.sum" }}
+        - go-mod-cache-v1-
+    - setup_remote_docker
+    - run:
+        command: |
+          make tools
+          go mod vendor
+          ORG=roboll BUILD_URL="$CIRCLE_BUILD_URL" make image/helm3
 
   test:
+    environment:
+      GOPATH: /go
     docker:
-      - image: circleci/golang:1.11.2
-    working_directory: /go/src/github.com/roboll/helmfile
+      - image: circleci/golang:1.16.3
+    working_directory: /home/circleci/workspace/helmfile
     steps:
       - checkout
+      - restore_cache:
+          keys:
+          - go-mod-cache-v1-{{ checksum "./go.sum" }}
+          - go-mod-cache-v1-
       - run: make check
       - run: make pristine
       - run: make test
@@ -27,78 +78,78 @@ jobs:
   # thanks to https://raw.githubusercontent.com/weaveworks/launcher/master/.circleci/config.yml
   integration_tests:
     machine:
-      image: circleci/classic:201808-01
-    environment:
-      CHANGE_MINIKUBE_NONE_USER: true
-      MINIKUBE_WANTUPDATENOTIFICATION: false
-      MINIKUBE_WANTREPORTERRORPROMPT: false
+      image: ubuntu-2004:202010-01
+    parameters:
+      helm-version:
+        type: string
     steps:
       - checkout
       - run: mkdir ~/build
       - attach_workspace:
           at: ~/build
-      - run: cp ~/build/helmfile ~/project/helmfile
       - run:
-          name: Install helm
-          environment:
-            HELM_VERSION: v2.13.0
+          name: Install test dependencies
           command: |
-            HELM_FILENAME="helm-${HELM_VERSION}-linux-amd64.tar.gz"
-            curl -Lo ${HELM_FILENAME} "https://kubernetes-helm.storage.googleapis.com/${HELM_FILENAME}"
-            tar zxf ${HELM_FILENAME} linux-amd64/helm
-            chmod +x linux-amd64/helm
-            sudo mv linux-amd64/helm /usr/local/bin/
-      - run:
-          name: Deploy minikube
-          environment:
-            CHANGE_MINIKUBE_NONE_USER: true
-            K8S_VERSION: v1.12.3
-            MINIKUBE_VERSION: v0.30.0
-          command: |
-            curl -Lo kubectl https://storage.googleapis.com/kubernetes-release/release/${K8S_VERSION}/bin/linux/amd64/kubectl
-            chmod +x kubectl && sudo mv kubectl /usr/local/bin/
-            curl -Lo minikube https://storage.googleapis.com/minikube/releases/${MINIKUBE_VERSION}/minikube-linux-amd64
-            chmod +x minikube && sudo mv minikube /usr/local/bin/
-            sudo -E minikube start --vm-driver=none --kubernetes-version=${K8S_VERSION}
-            sudo -E minikube update-context
-      - run:
-          name: Wait for nodes to become ready
-          command: JSONPATH='{range .items[*]}{@.metadata.name}:{range @.status.conditions[*]}{@.type}={@.status};{end}{end}'; until kubectl get nodes -o jsonpath="$JSONPATH" 2>&1 | grep -q "Ready=True"; do sleep 1; done
+            cp ~/build/helmfile ~/project/helmfile
+            cp ~/build/diff-yamls ~/project/diff-yamls
+            cp ~/build/yamldiff ~/project/yamldiff
+            if [[ "<< parameters.helm-version >>" == v3* ]]
+            then
+              make -C .circleci helm
+            else
+              make -C .circleci helm2
+            fi            
+            make -C .circleci vault
+            make -C .circleci sops
+            make -C .circleci kustomize
+            make -C .circleci minikube
       - run:
           name: Execute integration tests
+          environment:
+            TERM: "xterm"
           command: |
             export TERM=xterm
-            make integration
+            if [[ "<< parameters.helm-version >>" == v3* ]]
+            then
+              HELMFILE_HELM3=1 make integration
+            else
+              make integration
+            fi
 
 # GITHUB_TOKEN env var must be setup in circleci console
 
   release:
     docker:
-      - image: circleci/golang:1.11.2
-    working_directory: /go/src/github.com/roboll/helmfile
+      - image: circleci/golang:1.16.3
+    working_directory: /home/circleci/workspace/helmfile
     steps:
     - checkout
+    - restore_cache:
+        keys:
+        - go-mod-cache-v1-{{ checksum "./go.sum" }}
+        - go-mod-cache-v1-
     - setup_remote_docker
     - run:
         command: |
           docker login -u="$DOCKER_USER" -p="$DOCKER_PASS" quay.io
           make tools
-          BUILD_URL="$CIRCLE_BUILD_URL" make push release
+          go mod vendor
+          ORG=roboll BUILD_URL="$CIRCLE_BUILD_URL" make push push/helm3 release
 
 workflows:
   version: 2
   build_and_test:
     jobs:
       - build
+      - image
+      - image_helm3
       - test
       - integration_tests:
           requires:
             - build
-          filters:
-            branches:
-              only:
-                - master
-                - /pull.*/
+          matrix:
+            parameters:
+              helm-version: ["v2.17.0", "v3.4.2", "v3.5.4"]
       - release:
           filters:
             branches:

.editorconfig

@@ -0,0 +1,5 @@
+root = true
+
+[*.md]
+insert_final_newline = true
+trim_trailing_whitespace = true

.gitignore

@@ -1,3 +1,12 @@
 dist/
 .idea/
-helmfile
+helmfile
+helmfile.lock
+/diff-yamls
+/yamldiff
+test/integration/tmp
+vendor/
+*.log
+.vagrant/
+*.lock
+test/integration/.gnupg/

Dockerfile

@@ -1,29 +1,49 @@
-FROM golang:1.11.2-alpine3.8 as builder
+FROM golang:1.16.3-alpine3.13 as builder
 
 RUN apk add --no-cache make git
-WORKDIR /go/src/github.com/roboll/helmfile/
-COPY . /go/src/github.com/roboll/helmfile/
+WORKDIR /workspace/helmfile
+COPY . /workspace/helmfile
 RUN make static-linux
 
 # -----------------------------------------------------------------------------
 
-FROM alpine:3.8
+FROM alpine:3.11
 
-RUN apk add --no-cache ca-certificates git bash curl
+RUN apk add --no-cache ca-certificates git bash curl jq
 
-ARG HELM_VERSION=v2.13.0
+ARG HELM_VERSION="v2.17.0"
 ARG HELM_LOCATION="https://kubernetes-helm.storage.googleapis.com"
 ARG HELM_FILENAME="helm-${HELM_VERSION}-linux-amd64.tar.gz"
-ARG HELM_SHA256="15eca6ad225a8279de80c7ced42305e24bc5ac60bb7d96f2d2fa4af86e02c794"
-RUN wget ${HELM_LOCATION}/${HELM_FILENAME} && \
+ARG HELM_SHA256="f3bec3c7c55f6a9eb9e6586b8c503f370af92fe987fcbf741f37707606d70296"
+RUN set -x && \
+    wget ${HELM_LOCATION}/${HELM_FILENAME} && \
+    echo Verifying ${HELM_FILENAME}... && \
     sha256sum ${HELM_FILENAME} | grep -q "${HELM_SHA256}" && \
-    tar zxf ${HELM_FILENAME} && mv /linux-amd64/helm /usr/local/bin/ && \
+    echo Extracting ${HELM_FILENAME}... && \
+    tar zxvf ${HELM_FILENAME} && mv /linux-amd64/helm /usr/local/bin/ && \
+    mv /linux-amd64/tiller /usr/local/bin/ && \
     rm ${HELM_FILENAME} && rm -r /linux-amd64
 
-RUN mkdir -p "$(helm home)/plugins"
+# using the install documentation found at https://kubernetes.io/docs/tasks/tools/install-kubectl/
+# for now but in a future version of alpine (in the testing version at the time of writing)
+# we should be able to install using apk add.
+# the sha256 sum can be found at https://storage.googleapis.com/kubernetes-release/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256
+# maybe a good idea to automate in the future?
+ENV KUBECTL_VERSION="v1.18.9"
+ENV KUBECTL_SHA256="6a68756a2d3d04b4d0f52b00de6493ba2c1fcb28b32f3e4a0e99b3d9f6c4e8ed"
+RUN set -x & \
+    curl --retry 5 --retry-connrefused -LO "https://storage.googleapis.com/kubernetes-release/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" && \
+    sha256sum kubectl | grep ${KUBECTL_SHA256} && \
+    chmod +x kubectl && \
+    mv kubectl /usr/local/bin/kubectl
+
+RUN ["helm", "init", "--client-only", "--stable-repo-url", "https://charts.helm.sh/stable"]
 RUN helm plugin install https://github.com/databus23/helm-diff && \
-    helm plugin install https://github.com/futuresimple/helm-secrets
+    helm plugin install https://github.com/futuresimple/helm-secrets && \
+    helm plugin install https://github.com/hypnoglow/helm-s3.git && \
+    helm plugin install https://github.com/aslafy-z/helm-git.git && \
+    helm plugin install https://github.com/rimusz/helm-tiller
 
-COPY --from=builder /go/src/github.com/roboll/helmfile/dist/helmfile_linux_amd64 /usr/local/bin/helmfile
+COPY --from=builder /workspace/helmfile/dist/helmfile_linux_amd64 /usr/local/bin/helmfile
 
-CMD ["/usr/local/bin/helmfile"]
+CMD ["/usr/local/bin/helmfile", "--help"]

Dockerfile.helm3

@@ -0,0 +1,55 @@
+FROM golang:1.16.3-alpine3.13 as builder
+
+RUN apk add --no-cache make git
+WORKDIR /workspace/helmfile
+COPY . /workspace/helmfile
+RUN make static-linux
+
+# -----------------------------------------------------------------------------
+
+FROM alpine:3.11
+
+RUN apk add --no-cache ca-certificates git bash curl jq
+
+ARG HELM_VERSION="v3.5.3"
+ARG HELM_LOCATION="https://get.helm.sh"
+ARG HELM_FILENAME="helm-${HELM_VERSION}-linux-amd64.tar.gz"
+ARG HELM_SHA256="2170a1a644a9e0b863f00c17b761ce33d4323da64fc74562a3a6df2abbf6cd70"
+RUN set -x && \
+    wget ${HELM_LOCATION}/${HELM_FILENAME} && \
+    echo Verifying ${HELM_FILENAME}... && \
+    sha256sum ${HELM_FILENAME} | grep -q "${HELM_SHA256}" && \
+    echo Extracting ${HELM_FILENAME}... && \
+    tar zxvf ${HELM_FILENAME} && mv /linux-amd64/helm /usr/local/bin/ && \
+    rm ${HELM_FILENAME} && rm -r /linux-amd64
+
+# using the install documentation found at https://kubernetes.io/docs/tasks/tools/install-kubectl/
+# for now but in a future version of alpine (in the testing version at the time of writing)
+# we should be able to install using apk add.
+# the sha256 sum can be found at https://storage.googleapis.com/kubernetes-release/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256
+# maybe a good idea to automate in the future?
+ENV KUBECTL_VERSION="v1.18.9"
+ENV KUBECTL_SHA256="6a68756a2d3d04b4d0f52b00de6493ba2c1fcb28b32f3e4a0e99b3d9f6c4e8ed"
+RUN set -x && \
+    curl --retry 5 --retry-connrefused -LO "https://storage.googleapis.com/kubernetes-release/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" && \
+    sha256sum kubectl | grep ${KUBECTL_SHA256} && \
+    chmod +x kubectl && \
+    mv kubectl /usr/local/bin/kubectl
+
+ENV KUSTOMIZE_VERSION="v3.8.8"
+ENV KUSTOMIZE_SHA256="175938206f23956ec18dac3da0816ea5b5b485a8493a839da278faac82e3c303"
+RUN set -x && \
+    curl --retry 5 --retry-connrefused -LO https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/${KUSTOMIZE_VERSION}/kustomize_${KUSTOMIZE_VERSION}_linux_amd64.tar.gz && \
+    sha256sum kustomize_${KUSTOMIZE_VERSION}_linux_amd64.tar.gz | grep ${KUSTOMIZE_SHA256} && \
+    tar zxf kustomize_${KUSTOMIZE_VERSION}_linux_amd64.tar.gz && \
+    rm kustomize_${KUSTOMIZE_VERSION}_linux_amd64.tar.gz && \
+    mv kustomize /usr/local/bin/kustomize
+
+RUN helm plugin install https://github.com/databus23/helm-diff --version v3.1.3 && \
+    helm plugin install https://github.com/jkroepke/helm-secrets --version v3.5.0 && \
+    helm plugin install https://github.com/hypnoglow/helm-s3.git --version v0.10.0 && \
+    helm plugin install https://github.com/aslafy-z/helm-git.git --version v0.10.0
+
+COPY --from=builder /workspace/helmfile/dist/helmfile_linux_amd64 /usr/local/bin/helmfile
+
+CMD ["/usr/local/bin/helmfile"]

Gopkg.lock

@@ -1,121 +0,0 @@
-# This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.
-
-
-[[projects]]
-  digest = "1:d9141c149f722217d35834972878499a4781fe5ae46a152e8ac843ff15efc80f"
-  name = "github.com/Masterminds/semver"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "8d82589cda2d7b5b9167396841975c4535c9bec6"
-  version = "v1.4.1"
-
-[[projects]]
-  digest = "1:46a054a232ea2b7f0a35398d682b433d26ba9975fce9197b1784824402059f5b"
-  name = "github.com/Masterminds/sprig"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "6b2a58267f6a8b1dc8e2eb5519b984008fa85e8c"
-  version = "v2.15.0"
-
-[[projects]]
-  digest = "1:8f5416c7f59da8600725ae1ff00a99af1da8b04c211ae6f3c8f8bcab0164f650"
-  name = "github.com/aokoli/goutils"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "3391d3790d23d03408670993e957e8f408993c34"
-  version = "v1.0.1"
-
-[[projects]]
-  digest = "1:8f8811f9be822914c3a25c6a071e93beb4c805d7b026cbf298bc577bc1cc945b"
-  name = "github.com/google/uuid"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "064e2069ce9c359c118179501254f67d7d37ba24"
-  version = "0.2"
-
-[[projects]]
-  digest = "1:6b1e7618931d0ed9a17fec1c1d84271907aa61172c50b8272327f6cd4fafb650"
-  name = "github.com/huandu/xstrings"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "2bf18b218c51864a87384c06996e40ff9dcff8e1"
-  version = "v1.0.0"
-
-[[projects]]
-  digest = "1:8eb1de8112c9924d59bf1d3e5c26f5eaa2bfc2a5fcbb92dc1c2e4546d695f277"
-  name = "github.com/imdario/mergo"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "9f23e2d6bd2a77f959b2bf6acdbefd708a83a4a4"
-  version = "v0.3.6"
-
-[[projects]]
-  digest = "1:55d0f7127962b0657acfd69650634057b3a08958226feee1b64a379666bb915e"
-  name = "github.com/urfave/cli"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "6011f165dc288c72abd8acd7722f837c5c64198d"
-
-[[projects]]
-  digest = "1:3c1a69cdae3501bf75e76d0d86dc6f2b0a7421bc205c0cb7b96b19eed464a34d"
-  name = "go.uber.org/atomic"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "1ea20fb1cbb1cc08cbd0d913a96dead89aa18289"
-  version = "v1.3.2"
-
-[[projects]]
-  digest = "1:60bf2a5e347af463c42ed31a493d817f8a72f102543060ed992754e689805d1a"
-  name = "go.uber.org/multierr"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "3c4937480c32f4c13a875a1829af76c98ca3d40a"
-  version = "v1.1.0"
-
-[[projects]]
-  digest = "1:9580b1b079114140ade8cec957685344d14f00119e0241f6b369633cb346eeb3"
-  name = "go.uber.org/zap"
-  packages = [
-    ".",
-    "buffer",
-    "internal/bufferpool",
-    "internal/color",
-    "internal/exit",
-    "zapcore",
-  ]
-  pruneopts = "UT"
-  revision = "eeedf312bc6c57391d84767a4cd413f02a917974"
-  version = "v1.8.0"
-
-[[projects]]
-  branch = "master"
-  digest = "1:7b1c378a71f617ec07229a1fcbb90b6a5344295823e1d732398f50fd9ae4bbec"
-  name = "golang.org/x/crypto"
-  packages = [
-    "pbkdf2",
-    "scrypt",
-  ]
-  pruneopts = "UT"
-  revision = "b2aa35443fbc700ab74c586ae79b81c171851023"
-
-[[projects]]
-  branch = "v2"
-  digest = "1:342378ac4dcb378a5448dd723f0784ae519383532f5e70ade24132c4c8693202"
-  name = "gopkg.in/yaml.v2"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "5420a8b6744d3b0345ab293f6fcba19c978f1183"
-
-[solve-meta]
-  analyzer-name = "dep"
-  analyzer-version = 1
-  input-imports = [
-    "github.com/Masterminds/sprig",
-    "github.com/imdario/mergo",
-    "github.com/urfave/cli",
-    "go.uber.org/zap",
-    "go.uber.org/zap/zapcore",
-    "gopkg.in/yaml.v2",
-  ]
-  solver-name = "gps-cdcl"
-  solver-version = 1

Gopkg.toml

@@ -1,15 +0,0 @@
-[[constraint]]
-  name = "github.com/Masterminds/sprig"
-  version = "2.15.0"
-
-[[constraint]]
-  branch = "v2"
-  name = "gopkg.in/yaml.v2"
-
-[prune]
-  go-tests = true
-  unused-packages = true
-
-[[constraint]]
-  name = "github.com/imdario/mergo"
-  version = "0.3.6"

Makefile

@@ -2,7 +2,7 @@ ORG     ?= $(shell basename $(realpath ..))
 PKGS    := $(shell go list ./... | grep -v /vendor/)
 
 build:
-	go build ${TARGETS}
+	go build -ldflags '-X github.com/roboll/helmfile/pkg/app/version.Version=${TAG}' ${TARGETS}
 .PHONY: build
 
 generate:
@@ -17,6 +17,11 @@ check:
 	go vet ${PKGS}
 .PHONY: check
 
+build-test-tools:
+	go build test/diff-yamls/diff-yamls.go
+	go build test/yamldiff/yamldiff.go
+.PHONY: build-test-tools
+
 test:
 	go test -v ${PKGS} -cover -race -p=1
 .PHONY: test
@@ -25,16 +30,23 @@ integration:
 	bash test/integration/run.sh
 .PHONY: integration
 
+integration/vagrant:
+	$(MAKE) build GOOS=linux GOARCH=amd64
+	$(MAKE) build-test-tools GOOS=linux GOARCH=amd64
+	vagrant up
+	vagrant ssh -c 'HELMFILE_HELM3=1 make -C /vagrant integration'
+.PHONY: integration/vagrant
+
 cross:
-	env CGO_ENABLED=0 gox -os '!freebsd !netbsd' -arch '!arm' -output "dist/{{.Dir}}_{{.OS}}_{{.Arch}}" -ldflags '-X main.Version=${TAG}' ${TARGETS}
+	env CGO_ENABLED=0 gox -os 'windows darwin linux' -arch '386 amd64 arm64' -osarch '!darwin/arm64 !darwin/386' -output "dist/{{.Dir}}_{{.OS}}_{{.Arch}}" -ldflags '-X github.com/roboll/helmfile/pkg/app/version.Version=${TAG}' ${TARGETS}
 .PHONY: cross
 
 static-linux:
-	env CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o "dist/helmfile_linux_amd64" -ldflags '-X main.Version=${TAG}' ${TARGETS}
-.PHONY: linux
+	env CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOFLAGS=-mod=readonly go build -o "dist/helmfile_linux_amd64" -ldflags '-X github.com/roboll/helmfile/pkg/app/version.Version=${TAG}' ${TARGETS}
+.PHONY: static-linux
 
 install:
-	env CGO_ENABLED=0 go install -ldflags '-X main.Version=${TAG}' ${TARGETS}
+	env CGO_ENABLED=0 go install -ldflags '-X github.com/roboll/helmfile/pkg/app/version.Version=${TAG}' ${TARGETS}
 .PHONY: install
 
 clean:
@@ -42,7 +54,8 @@ clean:
 .PHONY: clean
 
 pristine: generate fmt
-	git ls-files --exclude-standard --modified --deleted --others | diff /dev/null -
+	git diff | cat
+	git ls-files --exclude-standard --modified --deleted --others -x vendor  | grep -v '^go.' | diff /dev/null -
 .PHONY: pristine
 
 release: pristine cross
@@ -58,6 +71,12 @@ run: image
 push: image
 	docker push quay.io/${ORG}/helmfile:${TAG}
 
+image/helm3:
+	docker build -f Dockerfile.helm3 -t quay.io/${ORG}/helmfile:helm3-${TAG} .
+
+push/helm3: image/helm3
+	docker push quay.io/${ORG}/helmfile:helm3-${TAG}
+
 tools:
 	go get -u github.com/tcnksm/ghr github.com/mitchellh/gox
 .PHONY: tools

PATHS.md

@@ -1,25 +1,27 @@
-# Paths Overivew 
-Using manifest files in conjunction with command line argument can be a bit confusing.  
+# Paths Overivew
 
-A few rules to clear up this ambiguity: 
+Using manifest files in conjunction with command line argument can be a bit confusing.
+
+A few rules to clear up this ambiguity:
 
 - Absolute paths are always resolved as absolute paths
 - Relative paths referenced *in* the helmfile manifest itself are relative to that manifest
 - Relative paths referenced on the command line are relative to the current working directory the user is in
 
 ### Examples
-There are several examples that we can go through in the `/examples` folder which demonstrate this.
+
+There are several examples that we can go through in the [`/examples`](examples) folder which demonstrate this.
 
 **Local Execution**
 
-This is an example of a Helmfile manifest referencing a local value directly. 
+This is an example of a Helmfile manifest referencing a local value directly.
 
 Indirect:
 ```
 helmfile -f examples/deployments/local/charts.yaml sync
 ```
 
-Direct: 
+Direct:
 ```
 cd examples/deployments/local/
 helmfile sync
@@ -27,14 +29,14 @@ helmfile sync
 
 **Relative Paths in Helmfile**
 
-This is an example of a Helmfile manifest using relative paths for values. 
+This is an example of a Helmfile manifest using relative paths for values.
 
 Indirect:
 ```
 helmfile -f examples/deployments/dev/charts.yaml sync
 ```
 
-Direct: 
+Direct:
 ```
 cd examples/deployments/dev/
 helmfile sync
@@ -42,7 +44,7 @@ helmfile sync
 
 **Relative Paths in Helmfile w/ --values overrides**
 
-This is an example of a Helmfile manifest using relative paths for values including an additional `--values` from the command line.  
+This is an example of a Helmfile manifest using relative paths for values including an additional `--values` from the command line.
 
 NOTE: The `--values` is resolved relative to the CWD of the terminal *not* the Helmfile manifest.  You can see this with the `replicas` being adjusted to 3 now for the deployment.
 
@@ -51,7 +53,7 @@ Indirect:
 helmfile -f examples/deployments/dev/charts.yaml sync --values values/replica-values.yaml
 ```
 
-Direct: 
+Direct:
 ```
 cd examples/deployments/dev/
 helmfile sync --values ../../values/replica-values.yaml

USERS.md

@@ -1,18 +1,33 @@
 # Helmfile Users
 
-The following table is compiled from public information or from survey responses. If you are using Helmfile in your
-company or organization, we would like to invite you to [participate in our user survey](https://docs.google.com/forms/d/e/1FAIpQLSfrF5kR9nXsr5yWqNZGgN-KquM1mBTuYNn5lRmEVXEvhq0VIQ/viewform)
-to help us extend this list.
+Who's actually using Helmfile? The following table is compiled from public information, survey response and PRs. It's
+likely this is only a small selection of actual users, but it's a start.
+
+If you are using Helmfile in your company or organization, we would like to invite you to create a PR to add your
+information to this file.
 
 <!-- TABLE_START -->
-| Organization | Workload | More Info | Location |
-|---|---|---|---|
-| [reddit.com](https://www.reddit.com/) | production | [GitHub issue](https://github.com/roboll/helmfile/issues/96#issue-312012249) | San Francisco, CA, US |
-| [ricardo.ch](https://www.ricardo.ch/) | proof-of-concept | | Zug, Switzerland |
+| Organization | Workload | More Info | Location | Added |
+|---|---|---|---|---|
+| [reddit.com](https://www.reddit.com/) | production | [GitHub issue](https://github.com/roboll/helmfile/issues/96#issue-312012249), [Talk](https://www.slideshare.net/GregoryTaylor11/helm-at-reddit-from-local-dev-staging-to-production) | San Francisco, CA | April 2018 |
+| [ricardo.ch](https://www.ricardo.ch/) | production | We're deploying our complete application platform using Helmfile. | Zug, Switzerland | April 2018 |
+| [Hellofresh](https://engineering.hellofresh.com/) | production | We've been using helmfile in production since April 2018 for deploying all our infrastructure applications | Berlin, Germany | April 2018 |
+| [Cherre](https://cherre.com/) | production | We have no public posts about using Helmfile, but we have been using it for a long time now | New York, NY | October 2018 |
+| [Sight Machine](https://sightmachine.com/) | production | We don't have anything publicly posted about it, but have been using it for quite a while in production. | San Francisco, CA and Ann Arbor, MI | December 2018 |
+| [TailorMed](https://tailormed.co/) | production | We're deploying all of our platform and all K8s resources using Helmfile. The power of Helmfile are more then amazing. Thank you! | Tel-Aviv, Israel | September 2020 |
+| [VSHN – The DevOps Company](https://vshn.ch) | production	| | Zurich, Switzerland | March 2019 |
+| [Vlocity](https://vlocity.com/) | proof-of-concept | | Melbourne, Australia | March 2019 |
+| [transit](https://transit.app/) | production | [Blog post](https://medium.com/@naseem_60378/helmfile-its-like-a-helm-for-your-helm-74a908581599). | Montreal, Canada | March 2019 |
+| [uniqkey](https://uniqkey.eu/) | production | [Wiki Page](https://ocd-scm.github.io/ocd-meta/) | Copenhagen, Denmark | April 2019 |
+| [bitsofinfo](https://github.com/bitsofinfo/helmfile-deploy) | production | Used with [helmfile-deploy](https://github.com/bitsofinfo/helmfile-deploy) to manage releases for dozens of apps | USA | July 2019 |
+| [kloeckner-i](https://www.kloeckner-i.com/) | production | We are deploying our standard tools via helmfile to all our clusters.  | Berlin, Germany | September 2019 |
+| [American Express](https://www.americanexpress.com) | proof-of-concept | Orchestration of both internal cluster workloads and local developer environments. | London, GB | January 2020 |
+| [Sportradar](https://www.sportradar.com) | production | Since mid-2019, we've been deploying our core infrastructure and several application stacks with Helmfile. | St. Gallen, Switzerland | March 2020 |
+| [PedidosYa](https://www.pedidosya.com) | production | | Montevideo, Uruguay | June 2020 |
+| [Jenkins OSS](https://jenkins.io) | production | [jenkins-infra/charts](https://github.com/jenkins-infra/charts) | * | July 2020 |
+| [SettleMint](https://settlemint.com) | production | The SettleMint platform allows enterprises to spin up k8s clusters and deploy production grade blockchain networks and additional services. Helmfile is in charge of deploying these networks and services on demand out of the self service management ui. | Belgium, Singapore, UAE, India | October 2020 |
+| [AutoTrader (UK)](https://www.autotrader.co.uk) | production | We've used Helmfile for 2+ years to deploy 400+ services | UK | October 2020 |
+| [Trend Micro](https://www.trendmicro.com) | production | We manage 9 k8s clusters in a mono git repository with Helmfile | Taipei, Taiwan |  December 2019 |
+| [William Hill](https://www.williamhill.com) | production | We have standardised on Helmfile for managing both our application services and our Kubernetes platform components. | International |  March 2021 |
+| [The Hyve](https://www.thehyve.nl) | production | We've been using Helmfile since 2019 to deploy [Radar-base applications](https://github.com/RADAR-base/RADAR-Kubernetes). [Blog Post](https://www.thehyve.nl/articles/kubernetes-added-to-radar-base) | Utrecht, Netherlands |  April 2021 |
 <!-- TABLE_END -->
-
-## Contact
-
-Please fill out [the Google form](https://docs.google.com/forms/d/e/1FAIpQLSfrF5kR9nXsr5yWqNZGgN-KquM1mBTuYNn5lRmEVXEvhq0VIQ/viewform) to add your organization instead of opening a PR.
-
-You can also [reach the maintainer on Twitter](https://twitter.com/DerCed).

Vagrantfile

@@ -0,0 +1,19 @@
+Vagrant.configure("2") do |config|
+  config.vm.box = "ubuntu/focal64"
+  config.vm.hostname = "minikube.box"
+  config.vm.provision :shell, privileged: false,
+    inline: <<-EOS
+      set -e
+      sudo apt-get update
+      sudo apt-get install -y make docker.io
+      sudo systemctl start docker
+      sudo usermod -G docker $USER
+      cd /vagrant/.circleci
+      make all
+    EOS
+
+  config.vm.provider "virtualbox" do |v|
+    v.memory = 2048
+    v.cpus = 2
+  end
+end

autocomplete/helmfile_bash_autocomplete

@@ -0,0 +1,18 @@
+#! /bin/bash
+
+_helmfile_bash_autocomplete() {
+  if [[ "${COMP_WORDS[0]}" != "source" ]]; then
+    local cur opts base
+    COMPREPLY=()
+    cur="${COMP_WORDS[COMP_CWORD]}"
+    if [[ "$cur" == "-"* ]]; then
+      opts=$( ${COMP_WORDS[@]:0:$COMP_CWORD} ${cur} --generate-bash-completion )
+    else
+      opts=$( ${COMP_WORDS[@]:0:$COMP_CWORD} --generate-bash-completion )
+    fi
+    COMPREPLY=( $(compgen -W "${opts}" -- ${cur}) )
+    return 0
+  fi
+}
+
+complete -o bashdefault -o default -o nospace -F _helmfile_bash_autocomplete helmfile

autocomplete/helmfile_zsh_autocomplete

@@ -0,0 +1,23 @@
+#compdef helmfile
+
+_helmfile_zsh_autocomplete() {
+
+  local -a opts
+  local cur
+  cur=${words[-1]}
+  if [[ "$cur" == "-"* ]]; then
+    opts=("${(@f)$(_CLI_ZSH_AUTOCOMPLETE_HACK=1 ${words[@]:0:#words[@]-1} ${cur} --generate-bash-completion)}")
+  else
+    opts=("${(@f)$(_CLI_ZSH_AUTOCOMPLETE_HACK=1 ${words[@]:0:#words[@]-1} --generate-bash-completion)}")
+  fi
+
+  if [[ "${opts[1]}" != "" ]]; then
+    _describe 'values' opts
+  else
+    _files
+  fi
+
+  return
+}
+
+compdef _helmfile_zsh_autocomplete helmfile

cmd/cmd.go

@@ -1,100 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"github.com/roboll/helmfile/helmexec"
-	"github.com/roboll/helmfile/pkg/app"
-	"github.com/roboll/helmfile/state"
-	"github.com/urfave/cli"
-	"go.uber.org/zap"
-	"os/exec"
-	"strings"
-	"syscall"
-)
-
-func VisitAllDesiredStates(c *cli.Context, converge func(*state.HelmState, helmexec.Interface, app.Context) (bool, []error)) error {
-	a, fileOrDir, err := InitAppEntry(c, false)
-	if err != nil {
-		return err
-	}
-
-	ctx := app.NewContext()
-
-	convergeWithHelmBinary := func(st *state.HelmState, helm helmexec.Interface) (bool, []error) {
-		if c.GlobalString("helm-binary") != "" {
-			helm.SetHelmBinary(c.GlobalString("helm-binary"))
-		}
-		return converge(st, helm, ctx)
-	}
-
-	err = a.VisitDesiredStates(fileOrDir, convergeWithHelmBinary)
-
-	return toCliError(err)
-}
-
-func InitAppEntry(c *cli.Context, reverse bool) (*app.App, string, error) {
-	if c.NArg() > 0 {
-		cli.ShowAppHelp(c)
-		return nil, "", fmt.Errorf("err: extraneous arguments: %s", strings.Join(c.Args(), ", "))
-	}
-
-	fileOrDir := c.GlobalString("file")
-	kubeContext := c.GlobalString("kube-context")
-	namespace := c.GlobalString("namespace")
-	selectors := c.GlobalStringSlice("selector")
-	logger := c.App.Metadata["logger"].(*zap.SugaredLogger)
-
-	env := c.GlobalString("environment")
-	if env == "" {
-		env = state.DefaultEnv
-	}
-
-	app := app.Init(&app.App{
-		KubeContext: kubeContext,
-		Logger:      logger,
-		Reverse:     reverse,
-		Env:         env,
-		Namespace:   namespace,
-		Selectors:   selectors,
-	})
-
-	return app, fileOrDir, nil
-}
-
-func FindAndIterateOverDesiredStatesUsingFlagsWithReverse(c *cli.Context, reverse bool, converge func(*state.HelmState, helmexec.Interface, app.Context) []error) error {
-	a, fileOrDir, err := InitAppEntry(c, reverse)
-	if err != nil {
-		return err
-	}
-
-	ctx := app.NewContext()
-
-	convergeWithHelmBinary := func(st *state.HelmState, helm helmexec.Interface) []error {
-		if c.GlobalString("helm-binary") != "" {
-			helm.SetHelmBinary(c.GlobalString("helm-binary"))
-		}
-		return converge(st, helm, ctx)
-	}
-
-	err = a.VisitDesiredStatesWithReleasesFiltered(fileOrDir, convergeWithHelmBinary)
-
-	return toCliError(err)
-}
-
-func toCliError(err error) error {
-	if err != nil {
-		switch e := err.(type) {
-		case *app.NoMatchingHelmfileError:
-			return cli.NewExitError(e.Error(), 2)
-		case *exec.ExitError:
-			// Propagate any non-zero exit status from the external command like `helm` that is failed under the hood
-			status := e.Sys().(syscall.WaitStatus)
-			return cli.NewExitError(e.Error(), status.ExitStatus())
-		case *state.DiffError:
-			return cli.NewExitError(e.Error(), e.Code)
-		default:
-			return cli.NewExitError(e.Error(), 1)
-		}
-	}
-	return err
-}

cmd/deps.go

@@ -1,37 +0,0 @@
-package cmd
-
-import (
-	"github.com/roboll/helmfile/args"
-	"github.com/roboll/helmfile/helmexec"
-	"github.com/roboll/helmfile/pkg/app"
-	"github.com/roboll/helmfile/state"
-	"github.com/urfave/cli"
-)
-
-func Deps(a *app.App) cli.Command {
-	return cli.Command{
-		Name:  "deps",
-		Usage: "update charts based on the contents of requirements.yaml",
-		Flags: []cli.Flag{
-			cli.StringFlag{
-				Name:  "args",
-				Value: "",
-				Usage: "pass args to helm exec",
-			},
-		},
-		Action: func(c *cli.Context) error {
-			return VisitAllDesiredStates(c, func(state *state.HelmState, helm helmexec.Interface, ctx app.Context) (bool, []error) {
-				args := args.GetArgs(c.String("args"), state)
-				if len(args) > 0 {
-					helm.SetExtraArgs(args...)
-				}
-
-				errs := state.UpdateDeps(helm)
-
-				ok := len(errs) == 0
-
-				return ok, errs
-			})
-		},
-	}
-}

docs/advanced-features.md

@@ -0,0 +1,299 @@
+## Advanced Features
+
+- [Import Configuration Parameters into Helmfile](#import-configuration-parameters-into-helmfile)
+- [Deploy Kustomization with Helmfile](#deploy-kustomizations-with-helmfile)
+- [Adhoc Kustomization of Helm Charts](#adhoc-kustomization-of-helm-charts)
+- [Adding dependencies without forking the chart](#adding-dependencies-without-forking-the-chart)
+
+### Import Configuration Parameters into Helmfile
+
+Helmfile integrates [vals]() to import configuration parameters from following backends:
+
+- AWS SSM Parameter Store
+- AWS SecretsManager
+- Vault
+- SOPS
+
+See [Vals "Suported Backends"](https://github.com/variantdev/vals#suported-backends) for the full list of available backends.
+
+This feature was implemented in https://github.com/roboll/helmfile/pull/906.
+If you're curious how it's designed and how it works, please consult the pull request.
+
+### Deploy Kustomizations with Helmfile
+
+You can deploy [kustomize](https://github.com/kubernetes-sigs/kustomize) "kustomization"s with Helmfile.
+
+Most of Kustomize operations that is usually done with `kustomize edit` can be done declaratively via Helm values.yaml files.
+
+Under the hood, Helmfile transforms the kustomization into a local chart in a temporary directory so that it can be `helm upgrade --install`ed.
+
+The transformation is done by generating (1)a temporary kustomization from various options and (2)temporary chart from the temporary kustomization.
+
+An example pseudo code for the transformation logic can be written as:
+
+```console
+$ TMPCHART=/tmp/sometmpdir
+$ mkdir -p ${TMPCHART}/templates
+$ somehow_generate_chart_yaml ${TMPCHART}/Chart.yaml
+
+$ TMPKUSTOMIZATION=/tmp/sometmpdir2
+$ somehow_generate_temp_kustomization_yaml ${TMPKUSTOMIZATION}/kustomization.yaml
+$ kustomize build ${TMPKUSTOMIZATION}/kustomization.yaml > ${TMPCHART}/templates/all.yaml
+```
+
+Let's say you have a `helmfile.yaml` that looks like the below:
+
+```yaml
+releases:
+- name: myapp
+  chart: mykustomization
+  values:
+  - values.yaml
+```
+
+Helmfile firstly generates a temporary `kustomization.yaml` that looks like:
+
+```yaml
+bases:
+- $(ABS_PATH_TO_HELMFILE_YAML}/mykustomization
+```
+
+Followed by the below steps:
+
+- Running `kustomize edit set image $IMAGE` for every `$IMAGE` generated from your values.yaml
+- Running `kustomize edit set nameprefix $NAMEPREFIX` with the nameprefix specified in your values.yaml
+- Running `kustomize edit set namesuffix $NAMESUFFIX` with the namesuffix specified in your values.yaml
+- Running `kustomize edit set namespace $NS` with the namespace specified in your values.yaml
+
+A `values.yaml` file for kustomization would look like the below:
+
+```yaml
+images:
+# kustomize edit set image mysql=eu.gcr.io/my-project/mysql@canary
+- name: mysql
+  newName: eu.gcr.io/my-project/mysql
+  newTag: canary
+# kustomize edit set image myapp=my-registry/my-app@sha256:24a0c4b4a4c0eb97a1aabb8e29f18e917d05abfe1b7a7c07857230879ce7d3d3
+- name: myapp
+  digest: sha256:24a0c4b4a4c0eb97a1aabb8e29f18e917d05abfe1b7a7c07857230879ce7d3d3
+  newName: my-registry/my-app
+
+# kustomize edit set nameprefix foo-
+namePrefix: foo-
+
+# kustomize edit set namesuffix -bar
+nameSuffix: -bar
+
+# kustomize edit set namespace myapp
+namespace: myapp
+```
+
+At this point, Helmfile can generate a complete kustomization from the base kustomization you specified in `releases[].chart` of your helmfile.yaml and `values.yaml`,
+which can be included in the temporary chart.
+
+After all, Helmfile just installs the temporary chart like standard charts, which allows you to manage everything with Helmfile regardless of each app is declared using a Helm chart or a kustomization.
+
+Please also see [test/advanced/helmfile.yaml](https://github.com/roboll/helmfile/tree/master/test/advanced/helmfile.yaml) for an example of kustomization support and more.
+
+### Adhoc Kustomization of Helm charts
+
+With Helmfile's integration with Helmfile, not only deploying Kustomization as a Helm chart, you can kustomize charts before installation.
+
+Currently, Helmfile allows you to set the following fields for kustomizing the chart:
+
+- [`releases[].strategicMergePatches`](#strategicmergepatches)
+- `releases[].jsonPatches`
+- [`releases[].transformers`](#transformers)
+
+#### `strategicMergePatches`
+
+You can add/update any Kubernetes resource field rendered from a Helm chart by specifying `releases[].strategicMergePatches`:
+
+```
+repositories:
+- name: incubator
+  url: https://kubernetes-charts-incubator.storage.googleapis.com
+
+releases:
+- name: raw1
+  chart: incubator/raw
+  values:
+  - resources:
+    - apiVersion: v1
+      kind: ConfigMap
+      metadata:
+        name: raw1
+        namespace: default
+      data:
+        foo: FOO
+  strategicMergePatches:
+    - apiVersion: v1
+      kind: ConfigMap
+      metadata:
+        name: raw1
+        namespace: default
+      data:
+        bar: BAR
+```
+
+Running `helmfile template` on the above example results in a ConfigMap called `raw` whose `data` is:
+
+```yaml
+foo: FOO
+bar: BAR
+```
+
+Please note that the second `data` field `bar` is coming from the strategic-merge patch defined in the above helmfile.yaml.
+
+There's also `releases[].jsonPatches` that works similarly to `strategicMergePatches` but has additional capability to remove fields.
+
+Please also see [test/advanced/helmfile.yaml](https://github.com/roboll/helmfile/tree/master/test/advanced/helmfile.yaml) for an example of patching support and more.
+
+#### `transformers`
+
+You can set `transformers` to apply [Kustomize's transformers](https://github.com/kubernetes-sigs/kustomize/blob/master/examples/configureBuiltinPlugin.md#configuring-the-builtin-plugins-instead).
+
+Each item can be a path to a YAML or go template file, or an embedded transformer declaration as a YAML hash.
+
+It's often used to add common labels and annotations to your resources.
+
+In the below example. we add common annotations and labels every resource rendered from the `aws-load-balancer-controller` chart:
+
+```yaml
+releases:
+- name: "aws-load-balancer-controller"
+  namespace: "kube-system"
+  forceNamespace: "kube-system"
+  chart: "center/aws/aws-load-balancer-controller"
+  transformers:
+  - apiVersion: builtin
+    kind: AnnotationsTransformer
+    metadata:
+      name: notImportantHere
+    annotations:
+      area: 51
+      greeting: take me to your leader
+    fieldSpecs:
+    - path: metadata/annotations
+      create: true
+  - apiVersion: builtin
+    kind: LabelTransformer
+    metadata:
+      name: notImportantHere
+    labels:
+      foo: bar
+    fieldSpecs:
+    - path: metadata/labels
+      create: true
+```
+
+As explained earlier, `transformers` can be not only a list of embedded transformers, but also YAML or go template files, or a mix of those three kinds.
+
+```yaml
+transformers:
+# Embedded transformer
+- apiVersion: builtin
+  kind: AnnotationsTransformer
+  metadata:
+    name: notImportantHere
+  annotations:
+    area: 51
+    greeting: take me to your leader
+  fieldSpecs:
+  - path: metadata/annotations
+    create: true
+# YAML file
+- path/to/transformer.yaml
+# Go template
+# The same set of template parameters as release values files templates is available.
+- path/to/transformer.yaml.gotmpl
+```
+
+Please see https://github.com/kubernetes-sigs/kustomize/blob/master/examples/configureBuiltinPlugin.md#configuring-the-builtin-plugins-instead for more information on how to declare transformers.
+
+### Adding dependencies without forking the chart
+
+With Helmfile, you can add chart dependencies to a Helm chart without forking it.
+
+An example `helmfile.yaml` that adds a `stable/envoy` dependency to the release `foo` looks like the below:
+
+```
+repositories:
+- name: stable
+  url: https://charts.helm.sh/stable
+
+releases:
+- name: foo
+  chart: ./path/to/foo
+  dependencies:
+  - chart: stable/envoy
+    version: 1.5
+```
+
+When Helmfile encounters `releases[].dependencies`, it creates a another temporary chart from `./path/to/foo` and adds the following `dependencies` to the `Chart.yaml`, so that you don't need to fork the chart.
+
+```
+dependencies:
+- name: envoy
+  repo: https://charts.helm.sh/stable
+  condition: envoy.enabled
+```
+
+A Helm chart can have two or more dependencies for the same chart with different `alias`es. To give your dependency an `alias`, defien it like you would do in a standard `Chart.yaml`:
+
+```
+repositories:
+- name: stable
+  url: https://charts.helm.sh/stable
+
+releases:
+- name: foo
+  chart: ./path/to/foo
+  dependencies:
+  - chart: stable/envoy
+    version: 1.5
+    alias: bar
+  - chart: stable/envoy
+    version: 1.5
+    alias: baz
+```
+
+which will tweaks the temporary chart's `Chart.yaml` to have:
+
+
+```
+dependencies:
+- alias: bar
+  name: envoy
+  repo: https://charts.helm.sh/stable
+  condition: bar.enabled
+- alias: baz
+  name: envoy
+  repo: https://charts.helm.sh/stable
+  condition: baz.enabled
+```
+
+Please see #649 for more context around this feature.
+
+After the support for adhoc dependency to local chart (#1765),
+you can even write local file paths relative to `helmfile.yaml` in `chart`:
+
+```
+releases:
+- name: foo
+  chart: ./path/to/foo
+  dependencies:
+  - chart: ./path/to/bar
+```
+
+Internally, Helmfile creates another temporary chart from the local chart `./path/to/foo`, and modifies the chart's `Chart.yaml` dependencies to look like:
+
+```
+dependencies:
+- alias: bar
+  name: bar
+  repo: file:///abs/path/to/bar
+  condition: bar.enabled
+```
+
+Please read https://github.com/roboll/helmfile/issues/1762#issuecomment-816341251 for more details.

docs/remote-secrets.md

@@ -0,0 +1,58 @@
+# Secrets 
+
+helmfile can handle secrets using [helm-secrets](https://github.com/jkroepke/helm-secrets) plugin or using remote secrets storage 
+(everything that package [vals](https://github.com/variantdev/vals) can handle vault, AWS SSM etc)  
+This section will describe the second use case. 
+
+# Remote secrets 
+
+This paragraph will describe how to use remote secrets storage (vault, SSM etc) in helmfile 
+
+## Fetching single key
+
+To fetch single key from remote secret storage you can use `fetchSecretValue` template function example below
+
+```yaml 
+# helmfile.yaml 
+
+repositories: 
+  - name: stable 
+    url: https://kubernetes-charts.storage.googleapis.com 
+
+environments: 
+  default: 
+    values:
+      - service:
+          password: ref+vault://svc/#pass
+          login: ref+vault://svc/#login
+releases:
+  - name: service 
+    namespace: default
+    labels:
+      cluster: services
+      secrets: vault
+    chart: stable/svc
+    version: 0.1.0
+    values:
+      - service:
+          login: {{ .Values.service.login | fetchSecretValue }} # this will resolve ref+vault://svc/#pass and fetch secret from vault
+          password: {{ .Values.service.password | fetchSecretValue | quote }}
+      # - values/service.yaml.gotmpl   # alternatively 
+```
+## Fetching multiple keys
+Alternatively you can use `expandSecretRefs` to fetch a map of secrets 
+```yaml
+# values/service.yaml.gotmpl
+service:
+{{ .Values.service | expandSecretRefs | toYaml | nindent 2 }}
+```
+
+This will produce
+```yaml
+# values/service.yaml
+service:
+  login: svc-login # fetched from vault
+  password: pass
+  
+```
+

docs/writing-helmfile.md

@@ -2,6 +2,23 @@
 
 This guide covers the Helmfile’s considered patterns for writing advanced helmfiles. It focuses on how helmfile should be structured and executed.
 
+## Helmfile .Values vs Helm .Values
+
+Templating engine of Helmfile uses the same pipeline name `.Values` as Helm, so in some use-cases `.Values` of Helmfile and
+Helm can be seen in the same file. To distinguish these two kinds of `.Values`, Helmfile provides an alias `.StateValues`
+for its `.Values`.
+
+```
+app:
+  project: {{.Environmont.Name}}-{{.StateValues.project}} # Same as {{.Environmont.Name}}-{{.Values.project}}
+
+{{`
+extraEnvVars:
+- name: APP_PROJECT
+  value: {{.Values.app.project}}
+`}}
+```
+
 ## Missing keys and Default values
 
 helmfile tries its best to inform users for noticing potential mistakes.
@@ -11,13 +28,13 @@ One example of how helmfile achieves it is that, `helmfile` fails when you tried
 That is, the following example let `helmfile` fail when you have no `eventApi.replicas` defined in environment values.
 
 ```
-{{ .Environment.Values.eventApi.replicas | default 1 }}
+{{ .Values.eventApi.replicas | default 1 }}
 ```
 
-In case it isn't a mistake and you do want to allow missing keys, use the `getOrNil` template function:
+In case it isn't a mistake and you do want to allow missing keys, use the `get` template function:
 
 ```
-{{ .Environment.Values | getOrNil "eventApi.replicas" }}
+{{ .Values | get "eventApi.replicas" nil }}
 ```
 
 This result in printing `<no value` in your template, that may or may not result in a failure.
@@ -25,14 +42,14 @@ This result in printing `<no value` in your template, that may or may not result
 If you want a kind of default values that is used when a missing key was referenced, use `default` like:
 
 ```
-{{ .Environment.Values | getOrNil "eventApi.replicas" | default 1 }}
+{{ .Values | get "eventApi.replicas" 1 }}
 ```
 
 Now, you get `1` when there is no `eventApi.replicas` defined in environment values.
 
 ## Release Template / Conventional Directory Structure
 
-Introducing helmfile into a large-scale project that involes dozens of releases often results in a lot of repetitions in `helmfile.yaml` files.
+Introducing helmfile into a large-scale project that involves dozens of releases often results in a lot of repetitions in `helmfile.yaml` files.
 
 The example below shows repetitions in `namespace`, `chart`, `values`, and `secrets`:
 
@@ -57,7 +74,7 @@ releases:
   values:
   - "./config/kubernetes-dashboard/values.yaml"
   - "./config/kubernetes-dashboard/{{ .Environment.Name }}.yaml"
-  values:
+  secrets:
   - "./config/kubernetes-dashboard/secrets.yaml"
   - "./config/kubernetes-dashboard/{{ .Environment.Name }}-secrets.yaml"
 ```
@@ -89,35 +106,70 @@ releases:
   <<: *default
 ```
 
+Release Templating supports the following parts of release definition:
+- basic fields: `name`, `namespace`, `chart`, `version`
+- boolean fields: `installed`, `wait`, `waitForJobs`, `tillerless`, `verify` by the means of additional text
+  fields designed for templating only: `installedTemplate`, `waitTemplate`, `tillerlessTemplate`, `verifyTemplate`
+  ```yaml
+  # ...
+    installedTemplate: '{{`{{ eq .Release.Namespace "kube-system" }}`}}'
+    waitTemplate: '{{`{{ eq .Release.Labels.tag "safe" | not }}`}}'
+  # ...
+  ```
+- `set` block values:
+  ```yaml
+  # ...
+    setTemplate:
+    - name: '{{`{{ .Release.Name }}`}}'
+      values: '{{`{{ .Release.Namespace }}`}}'
+  # ...
+  ```
+- `values` and `secrets` file paths:
+  ```yaml
+  # ...
+    valuesTemplate:
+    - config/{{`{{ .Release.Name }}`}}/values.yaml
+    secrets:
+    - config/{{`{{ .Release.Name }}`}}/secrets.yaml
+  # ...
+  ```
+- inline `values` map:
+  ```yaml
+  # ...
+    valuesTemplate:
+    - image:
+        tag: `{{ .Release.Labels.tag }}`
+  # ...
+  ```
+
 See the [issue 428](https://github.com/roboll/helmfile/issues/428) for more context on how this is supposed to work.
 
-## Layering
+## Layering Release Values
 
-You may occasionally end up with many helmfiles that shares common parts like which repositories to use, and whichi release to be bundled by default.
+Please note, that it is not possible to layer `values` sections. If `values` is defined in the release and in the release template, only the `values` defined in the release will be considered. The same applies to `secrets` and `set`.
+
+## Layering State Files
+
+> See **Layering State Template Files** if you're layering templates.
+
+You may occasionally end up with many helmfiles that shares common parts like which repositories to use, and which release to be bundled by default.
 
 Use Layering to extract the common parts into a dedicated *library helmfile*s, so that each helmfile becomes DRY.
 
 Let's assume that your `helmfile.yaml` looks like:
 
-```
-{ readFile "commons.yaml" }}
----
-{{ readFile "environments.yaml" }}
----
+```yaml
+bases:
+- environments.yaml
+
 releases:
+- name: metricbeat
+  chart: stable/metricbeat
 - name: myapp
   chart: mychart
 ```
 
-Whereas `commons.yaml` contained a monitoring agent:
-
-```yaml
-releases:
-- name: metricbaet
-  chart: stable/metricbeat
-```
-
-And `environments.yaml` contained well-known environments:
+Whereas `environments.yaml` contained well-known environments:
 
 ```yaml
 environments:
@@ -125,23 +177,24 @@ environments:
   production:
 ```
 
-At run time, template expressions in your `helmfile.yaml` are executed:
+At run time, `bases` in your `helmfile.yaml` are evaluated to produce:
 
 ```yaml
-releases:
-- name: metricbaet
-  chart: stable/metricbeat
 ---
+# environments.yaml
 environments:
   development:
   production:
 ---
+# helmfile.yaml
 releases:
 - name: myapp
   chart: mychart
+- name: metricbeat
+  chart: stable/metricbeat
 ```
 
-Resulting YAML documents are merged in the order of occurrence,
+Finally the resulting YAML documents are merged in the order of occurrence,
 so that your `helmfile.yaml` becomes:
 
 ```yaml
@@ -150,7 +203,7 @@ environments:
   production:
 
 releases:
-- name: metricbaet
+- name: metricbeat
   chart: stable/metricbeat
 - name: myapp
   chart: mychart
@@ -159,3 +212,203 @@ releases:
 Great!
 
 Now, repeat the above steps for each your `helmfile.yaml`, so that all your helmfiles becomes DRY.
+
+Please also see [the discussion in the issue 388](https://github.com/roboll/helmfile/issues/388#issuecomment-491710348) for more advanced layering examples.
+
+## Merging Arrays in Layers
+
+Helmfile doesn't merge arrays across layers. That is, the below example doesn't work as you might have expected:
+
+```yaml
+releases:
+- name: metricbeat
+  chart: stable/metricbeat
+---
+releases:
+- name: myapp
+  chart: mychart
+```
+
+Helmfile overrides the `releases` array with the latest layer so the resulting state file will be:
+
+```yaml
+releases:
+# metricbeat release disappeared! but that's how helmfile works
+- name: myapp
+  chart: mychart
+```
+
+A work-around is to treat the state file as a go template and use `readFile` template function to import the common part of your state file as a plain text:
+
+`common.yaml`:
+
+```yaml
+templates:
+  metricbeat: &metricbeat
+    name: metricbeat
+    chart: stable/metricbeat
+```
+
+`helmfile.yaml`:
+
+```yaml
+{{ readFile "common.yaml" }}
+
+releases:
+- <<: *metricbeat
+- name: myapp
+  chart: mychart
+```
+
+## Layering State Template Files
+
+Do you need to make your state file even more DRY?
+
+Turned out layering state files wasn't enough for you?
+
+Helmfile supports an advanced feature that allows you to compose state "template" files to generate the final state to be processed.
+
+In the following example `helmfile.yaml.gotmpl`, each `---` separated part of the file is a go template.
+
+`helmfile.yaml.gotmpl`:
+
+```yaml
+# Part 1: Reused Enviroment Values
+bases:
+  - myenv.yaml
+---
+# Part 2: Reused Defaults
+bases:
+  - mydefaults.yaml
+---
+# Part 3: Dynamic Releases
+releases:
+  - name: test1
+    chart: mychart-{{ .Values.myname }}
+    values:
+      replicaCount: 1
+      image:
+        repository: "nginx"
+        tag: "latest"
+```
+
+Suppose the `myenv.yaml` and `test.env.yaml` loaded in the first part looks like:
+
+`myenv.yaml`:
+
+```yaml
+environments:
+  test:
+    values:
+      - test.env.yaml
+```
+
+`test.env.yaml`:
+
+```yaml
+kubeContext: test
+wait: false
+cvOnly: false
+myname: "dog"
+```
+
+Where the gotmpl file loaded in the second part looks like:
+
+`mydefaults.yaml.gotmpl`:
+
+```yaml
+helmDefaults:
+  tillerNamespace: kube-system
+  kubeContext: {{ .Values.kubeContext }}
+  verify: false
+  {{ if .Values.wait }}
+  wait: true
+  {{ else }}
+  wait: false
+  {{ end }}
+  timeout: 600
+  recreatePods: false
+  force: true
+```
+
+Each go template is rendered in the context where `.Values` is inherited from the previous part.
+
+So in `mydefaults.yaml.gotmpl`, both `.Values.kubeContext` and `.Values.wait` are valid as they do exist in the environment values inherited from the previous part(=the first part) of your `helmfile.yaml.gotmpl`, and therefore the template is rendered to:
+
+```yaml
+helmDefaults:
+  tillerNamespace: kube-system
+  kubeContext: test
+  verify: false
+  wait: false
+  timeout: 600
+  recreatePods: false
+  force: true
+```
+
+Similarly, the third part of the top-level `helmfile.yaml.gotmpl`, `.Values.myname` is valid as it is included in the environment values inherited from the previous parts:
+
+```yaml
+# Part 3: Dynamic Releases
+releases:
+  - name: test1
+    chart: mychart-{{ .Values.myname }}
+    values:
+      replicaCount: 1
+      image:
+        repository: "nginx"
+        tag: "latest"
+````
+
+hence rendered to:
+
+```yaml
+# Part 3: Dynamic Releases
+releases:
+  - name: test1
+    chart: mychart-dog
+    values:
+      replicaCount: 1
+      image:
+        repository: "nginx"
+        tag: "latest"
+```
+
+## Re-using environment state in sub-helmfiles
+
+Do you want to decouple the environment state loading from the sub-helmfiles and load it only once?
+
+This example shows how to do this:
+
+```yaml
+environments:
+  stage:
+    values:
+    - env/stage.yaml
+  prod:
+    values:
+    - env/prod.yaml
+---
+
+helmfiles:
+- path: releases/myrelease/helmfile.yaml
+  values:
+  - {{ toYaml .Values | nindent 4 }}
+  # pass the current state values to the sub-helmfile
+  # add other values to use overlay logic here
+```
+
+and `releases/myrelease/helmfile.yaml` is as DRY as
+
+```yaml
+releases:
+- name: mychart-{{ .Values.myrelease.myname }}
+  installed: {{ .Values | get "myrelease.enabled" false }}
+  chart: mychart
+  version: {{ .Values.myrelease.version }}
+  labels:
+    chart: mychart
+  values:
+  - values.yaml.gotmpl
+  # templated values would also inherit the values passed from upstream
+```

environment/environment.go

@@ -1,8 +0,0 @@
-package environment
-
-type Environment struct {
-	Name   string
-	Values map[string]interface{}
-}
-
-var EmptyEnvironment Environment

event/bus.go

@@ -1,102 +0,0 @@
-package event
-
-import (
-	"fmt"
-	"github.com/roboll/helmfile/environment"
-	"github.com/roboll/helmfile/helmexec"
-	"github.com/roboll/helmfile/tmpl"
-	"go.uber.org/zap"
-	"os"
-)
-
-type Hook struct {
-	Name    string   `yaml:"name"`
-	Events  []string `yaml:"events"`
-	Command string   `yaml:"command"`
-	Args    []string `yaml:"args"`
-}
-
-type event struct {
-	Name string
-}
-
-type Bus struct {
-	Runner helmexec.Runner
-	Hooks  []Hook
-
-	BasePath      string
-	StateFilePath string
-	Namespace     string
-
-	Env environment.Environment
-
-	ReadFile func(string) ([]byte, error)
-	Logger   *zap.SugaredLogger
-}
-
-func (bus *Bus) Trigger(evt string, context map[string]interface{}) (bool, error) {
-	if bus.Runner == nil {
-		bus.Runner = helmexec.ShellRunner{
-			Dir: bus.BasePath,
-		}
-	}
-
-	executed := false
-
-	for _, hook := range bus.Hooks {
-		contained := false
-		for _, e := range hook.Events {
-			contained = contained || e == evt
-		}
-		if !contained {
-			continue
-		}
-
-		var err error
-
-		name := hook.Name
-		if name == "" {
-			name = hook.Command
-		}
-
-		fmt.Fprintf(os.Stderr, "%s: basePath=%s\n", bus.StateFilePath, bus.BasePath)
-
-		data := map[string]interface{}{
-			"Environment": bus.Env,
-			"Namespace":   bus.Namespace,
-			"Event": event{
-				Name: evt,
-			},
-		}
-		for k, v := range context {
-			data[k] = v
-		}
-		render := tmpl.NewTextRenderer(bus.ReadFile, bus.BasePath, data)
-
-		bus.Logger.Debugf("hook[%s]: triggered by event \"%s\"\n", name, evt)
-
-		command, err := render.RenderTemplateText(hook.Command)
-		if err != nil {
-			return false, fmt.Errorf("hook[%s]: %v", name, err)
-		}
-
-		args := make([]string, len(hook.Args))
-		for i, raw := range hook.Args {
-			args[i], err = render.RenderTemplateText(raw)
-			if err != nil {
-				return false, fmt.Errorf("hook[%s]: %v", name, err)
-			}
-		}
-
-		bytes, err := bus.Runner.Execute(command, args)
-		bus.Logger.Debugf("hook[%s]: %s\n", name, string(bytes))
-
-		if err != nil {
-			return false, fmt.Errorf("hook[%s]: command `%s` failed: %v", name, command, err)
-		}
-
-		executed = true
-	}
-
-	return executed, nil
-}

event/bus_test.go

@@ -1,113 +0,0 @@
-package event
-
-import (
-	"fmt"
-	"github.com/roboll/helmfile/environment"
-	"github.com/roboll/helmfile/helmexec"
-	"os"
-	"testing"
-)
-
-var logger = helmexec.NewLogger(os.Stdout, "warn")
-
-type runner struct {
-}
-
-func (r *runner) Execute(cmd string, args []string) ([]byte, error) {
-	if cmd == "ng" {
-		return nil, fmt.Errorf("cmd failed due to invalid cmd: %s", cmd)
-	}
-	for _, a := range args {
-		if a == "ng" {
-			return nil, fmt.Errorf("cmd failed due to invalid arg: %s", a)
-		}
-	}
-	return []byte(""), nil
-}
-
-func TestTrigger(t *testing.T) {
-	cases := []struct {
-		name           string
-		hook           *Hook
-		triggeredEvt   string
-		expectedResult bool
-		expectedErr    string
-	}{
-		{
-			"okhook1",
-			&Hook{"okhook1", []string{"foo"}, "ok", []string{}},
-			"foo",
-			true,
-			"",
-		},
-		{
-			"missinghook1",
-			&Hook{"okhook1", []string{"foo"}, "ok", []string{}},
-			"bar",
-			false,
-			"",
-		},
-		{
-			"nohook1",
-			nil,
-			"bar",
-			false,
-			"",
-		},
-		{
-			"nghook1",
-			&Hook{"nghook1", []string{"foo"}, "ng", []string{}},
-			"foo",
-			false,
-			"hook[nghook1]: command `ng` failed: cmd failed due to invalid cmd: ng",
-		},
-		{
-			"nghook2",
-			&Hook{"nghook2", []string{"foo"}, "ok", []string{"ng"}},
-			"foo",
-			false,
-			"hook[nghook2]: command `ok` failed: cmd failed due to invalid arg: ng",
-		},
-	}
-	readFile := func(filename string) ([]byte, error) {
-		return nil, fmt.Errorf("unexpected call to readFile: %s", filename)
-	}
-	for _, c := range cases {
-		hooks := []Hook{}
-		if c.hook != nil {
-			hooks = append(hooks, *c.hook)
-		}
-		bus := &Bus{
-			Hooks:         hooks,
-			StateFilePath: "path/to/helmfile.yaml",
-			BasePath:      "path/to",
-			Namespace:     "myns",
-			Env:           environment.Environment{Name: "prod"},
-			Logger:        logger,
-			ReadFile:      readFile,
-		}
-
-		bus.Runner = &runner{}
-		data := map[string]interface{}{
-			"Release":         "myrel",
-			"HelmfileCommand": "mycmd",
-		}
-		ok, err := bus.Trigger(c.triggeredEvt, data)
-
-		if ok != c.expectedResult {
-			t.Errorf("unexpected result for case \"%s\": expected=%v, actual=%v", c.name, c.expectedResult, ok)
-		}
-
-		if c.expectedErr != "" {
-			if err == nil {
-				t.Error("error expected, but not occurred")
-			} else if err.Error() != c.expectedErr {
-				t.Errorf("unexpected error for case \"%s\": expected=%s, actual=%v", c.name, c.expectedErr, err)
-			}
-		} else {
-			if err != nil {
-				t.Errorf("unexpected error for case \"%s\": %v", c.name, err)
-			}
-		}
-	}
-}

examples/README.md

@@ -26,7 +26,7 @@ You would then start a database migration job by executing:
 
 ```console
 # Start a database migration for the prod environment
-$ RAILS_ENV=prod helmfile sync --selector job=dbmigrator
+$ RAILS_ENV=prod helmfile --selector job=dbmigrator sync
 
 # Tail log until you are satisfied
 $ kubectl logs -l job=dbmigrator

go.mod

@@ -0,0 +1,42 @@
+module github.com/roboll/helmfile
+
+go 1.14
+
+require (
+	github.com/Azure/azure-sdk-for-go v35.0.0+incompatible // indirect
+	github.com/Masterminds/semver/v3 v3.1.0
+	github.com/Masterminds/sprig/v3 v3.1.0
+	github.com/aryann/difflib v0.0.0-20170710044230-e206f873d14a
+	github.com/davecgh/go-spew v1.1.1
+	github.com/frankban/quicktest v1.11.2 // indirect
+	github.com/ghodss/yaml v1.0.1-0.20190212211648-25d852aebe32
+	github.com/go-test/deep v1.0.7
+	github.com/golang/mock v1.5.0
+	github.com/google/go-cmp v0.5.5
+	github.com/gosuri/uitable v0.0.4
+	github.com/hashicorp/go-getter v1.5.0
+	github.com/hashicorp/go-retryablehttp v0.6.3 // indirect
+	github.com/hashicorp/go-version v1.2.1
+	github.com/howeyc/gopass v0.0.0-20190910152052-7cb4b85ec19c // indirect
+	github.com/imdario/mergo v0.3.11
+	github.com/jessevdk/go-flags v1.4.0
+	github.com/kylelemons/godebug v1.1.0
+	github.com/logrusorgru/aurora v2.0.3+incompatible
+	github.com/mattn/go-isatty v0.0.12
+	github.com/pierrec/lz4 v2.3.0+incompatible // indirect
+	github.com/r3labs/diff v1.1.0
+	github.com/spf13/cobra v1.1.1
+	github.com/tatsushid/go-prettytable v0.0.0-20141013043238-ed2d14c29939
+	github.com/urfave/cli v1.22.5
+	github.com/variantdev/chartify v0.8.5
+	github.com/variantdev/dag v1.0.0
+	github.com/variantdev/vals v0.14.0
+	go.uber.org/multierr v1.6.0
+	go.uber.org/zap v1.16.0
+	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c
+	gopkg.in/square/go-jose.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v2 v2.3.0
+	gotest.tools v2.2.0+incompatible
+	gotest.tools/v3 v3.0.3
+	k8s.io/apimachinery v0.19.3
+)

helmexec/exec.go

@@ -1,221 +0,0 @@
-package helmexec
-
-import (
-	"io"
-	"io/ioutil"
-	"os"
-	"strings"
-
-	"sync"
-
-	"go.uber.org/zap"
-	"go.uber.org/zap/zapcore"
-)
-
-const (
-	command = "helm"
-)
-
-type execer struct {
-	helmBinary      string
-	runner          Runner
-	logger          *zap.SugaredLogger
-	kubeContext     string
-	extra           []string
-	decryptionMutex sync.Mutex
-}
-
-func NewLogger(writer io.Writer, logLevel string) *zap.SugaredLogger {
-	var cfg zapcore.EncoderConfig
-	cfg.MessageKey = "message"
-	out := zapcore.AddSync(writer)
-	var level zapcore.Level
-	err := level.Set(logLevel)
-	if err != nil {
-		panic(err)
-	}
-	core := zapcore.NewCore(
-		zapcore.NewConsoleEncoder(cfg),
-		out,
-		level,
-	)
-	return zap.New(core).Sugar()
-}
-
-// New for running helm commands
-func New(logger *zap.SugaredLogger, kubeContext string) *execer {
-	return &execer{
-		helmBinary:  command,
-		logger:      logger,
-		kubeContext: kubeContext,
-		runner:      &ShellRunner{},
-	}
-}
-
-func (helm *execer) SetExtraArgs(args ...string) {
-	helm.extra = args
-}
-
-func (helm *execer) SetHelmBinary(bin string) {
-	helm.helmBinary = bin
-}
-
-func (helm *execer) AddRepo(name, repository, certfile, keyfile, username, password string) error {
-	var args []string
-	args = append(args, "repo", "add", name, repository)
-	if certfile != "" && keyfile != "" {
-		args = append(args, "--cert-file", certfile, "--key-file", keyfile)
-	}
-	if username != "" && password != "" {
-		args = append(args, "--username", username, "--password", password)
-	}
-	helm.logger.Infof("Adding repo %v %v", name, repository)
-	out, err := helm.exec(args...)
-	helm.write(out)
-	return err
-}
-
-func (helm *execer) UpdateRepo() error {
-	helm.logger.Info("Updating repo")
-	out, err := helm.exec("repo", "update")
-	helm.write(out)
-	return err
-}
-
-func (helm *execer) UpdateDeps(chart string) error {
-	helm.logger.Infof("Updating dependency %v", chart)
-	out, err := helm.exec("dependency", "update", chart)
-	helm.write(out)
-	return err
-}
-
-func (helm *execer) BuildDeps(chart string) error {
-	helm.logger.Infof("Building dependency %v", chart)
-	out, err := helm.exec("dependency", "build", chart)
-	helm.write(out)
-	return err
-}
-
-func (helm *execer) SyncRelease(name, chart string, flags ...string) error {
-	helm.logger.Infof("Upgrading %v", chart)
-	out, err := helm.exec(append([]string{"upgrade", "--install", "--reset-values", name, chart}, flags...)...)
-	helm.write(out)
-	return err
-}
-
-func (helm *execer) ReleaseStatus(name string, flags ...string) error {
-	helm.logger.Infof("Getting status %v", name)
-	out, err := helm.exec(append([]string{"status", name}, flags...)...)
-	helm.write(out)
-	return err
-}
-
-func (helm *execer) List(filter string, flags ...string) (string, error) {
-	helm.logger.Infof("Listing releases matching %v", filter)
-	out, err := helm.exec(append([]string{"list", filter}, flags...)...)
-	helm.write(out)
-	return string(out), err
-}
-
-func (helm *execer) DecryptSecret(name string) (string, error) {
-	// Prevents https://github.com/roboll/helmfile/issues/258
-	helm.decryptionMutex.Lock()
-	defer helm.decryptionMutex.Unlock()
-
-	helm.logger.Infof("Decrypting secret %v", name)
-	out, err := helm.exec(append([]string{"secrets", "dec", name})...)
-	helm.write(out)
-	if err != nil {
-		return "", err
-	}
-
-	tmpFile, err := ioutil.TempFile("", "secret")
-	if err != nil {
-		return "", err
-	}
-	defer tmpFile.Close()
-
-	// os.Rename seems to results in "cross-device link` errors in some cases
-	// Instead of moving, copy it to the destination temp file as a work-around
-	// See https://github.com/roboll/helmfile/issues/251#issuecomment-417166296f
-	decFilename := name + ".dec"
-	decFile, err := os.Open(decFilename)
-	if err != nil {
-		return "", err
-	}
-	defer decFile.Close()
-
-	_, err = io.Copy(tmpFile, decFile)
-	if err != nil {
-		return "", err
-	}
-
-	if err := decFile.Close(); err != nil {
-		return "", err
-	}
-
-	if err := os.Remove(decFilename); err != nil {
-		return "", err
-	}
-
-	return tmpFile.Name(), err
-}
-
-func (helm *execer) TemplateRelease(chart string, flags ...string) error {
-	out, err := helm.exec(append([]string{"template", chart}, flags...)...)
-	helm.write(out)
-	return err
-}
-
-func (helm *execer) DiffRelease(name, chart string, flags ...string) error {
-	helm.logger.Infof("Comparing %v %v", name, chart)
-	out, err := helm.exec(append([]string{"diff", "upgrade", "--allow-unreleased", name, chart}, flags...)...)
-	helm.write(out)
-	return err
-}
-
-func (helm *execer) Lint(chart string, flags ...string) error {
-	helm.logger.Infof("Linting %v", chart)
-	out, err := helm.exec(append([]string{"lint", chart}, flags...)...)
-	helm.write(out)
-	return err
-}
-
-func (helm *execer) Fetch(chart string, flags ...string) error {
-	helm.logger.Infof("Fetching %v", chart)
-	out, err := helm.exec(append([]string{"fetch", chart}, flags...)...)
-	helm.write(out)
-	return err
-}
-
-func (helm *execer) DeleteRelease(name string, flags ...string) error {
-	helm.logger.Infof("Deleting %v", name)
-	out, err := helm.exec(append([]string{"delete", name}, flags...)...)
-	helm.write(out)
-	return err
-}
-
-func (helm *execer) TestRelease(name string, flags ...string) error {
-	helm.logger.Infof("Testing %v", name)
-	out, err := helm.exec(append([]string{"test", name}, flags...)...)
-	helm.write(out)
-	return err
-}
-
-func (helm *execer) exec(args ...string) ([]byte, error) {
-	cmdargs := args
-	if len(helm.extra) > 0 {
-		cmdargs = append(cmdargs, helm.extra...)
-	}
-	if helm.kubeContext != "" {
-		cmdargs = append(cmdargs, "--kube-context", helm.kubeContext)
-	}
-	helm.logger.Debugf("exec: %s %s", helm.helmBinary, strings.Join(cmdargs, " "))
-	return helm.runner.Execute(helm.helmBinary, cmdargs)
-}
-
-func (helm *execer) write(out []byte) {
-	if len(out) > 0 {
-		helm.logger.Infof("%s", out)
-	}
-}

helmexec/exec_test.go

@@ -1,378 +0,0 @@
-package helmexec
-
-import (
-	"bytes"
-	"os"
-	"reflect"
-	"testing"
-
-	"go.uber.org/zap"
-)
-
-// Mocking the command-line runner
-
-type mockRunner struct {
-	output []byte
-	err    error
-}
-
-func (mock *mockRunner) Execute(cmd string, args []string) ([]byte, error) {
-	return []byte{}, nil
-}
-
-func MockExecer(logger *zap.SugaredLogger, kubeContext string) *execer {
-	execer := New(logger, kubeContext)
-	execer.runner = &mockRunner{}
-	return execer
-}
-
-// Test methods
-
-func TestNewHelmExec(t *testing.T) {
-	buffer := bytes.NewBufferString("something")
-	logger := NewLogger(buffer, "debug")
-	helm := New(logger, "dev")
-	if helm.kubeContext != "dev" {
-		t.Error("helmexec.New() - kubeContext")
-	}
-	if buffer.String() != "something" {
-		t.Error("helmexec.New() - changed buffer")
-	}
-	if len(helm.extra) != 0 {
-		t.Error("helmexec.New() - extra args not empty")
-	}
-}
-
-func Test_SetExtraArgs(t *testing.T) {
-	helm := New(NewLogger(os.Stdout, "info"), "dev")
-	helm.SetExtraArgs()
-	if len(helm.extra) != 0 {
-		t.Error("helmexec.SetExtraArgs() - passing no arguments should not change extra field")
-	}
-	helm.SetExtraArgs("foo")
-	if !reflect.DeepEqual(helm.extra, []string{"foo"}) {
-		t.Error("helmexec.SetExtraArgs() - one extra argument missing")
-	}
-	helm.SetExtraArgs("alpha", "beta")
-	if !reflect.DeepEqual(helm.extra, []string{"alpha", "beta"}) {
-		t.Error("helmexec.SetExtraArgs() - two extra arguments missing (overwriting the previous value)")
-	}
-}
-
-func Test_SetHelmBinary(t *testing.T) {
-	helm := New(NewLogger(os.Stdout, "info"), "dev")
-	if helm.helmBinary != "helm" {
-		t.Error("helmexec.command - default command is not helm")
-	}
-	helm.SetHelmBinary("foo")
-	if helm.helmBinary != "foo" {
-		t.Errorf("helmexec.SetHelmBinary() - actual = %s expect = foo", helm.helmBinary)
-	}
-}
-
-func Test_AddRepo(t *testing.T) {
-	var buffer bytes.Buffer
-	logger := NewLogger(&buffer, "debug")
-	helm := MockExecer(logger, "dev")
-	helm.AddRepo("myRepo", "https://repo.example.com/", "cert.pem", "key.pem", "", "")
-	expected := `Adding repo myRepo https://repo.example.com/
-exec: helm repo add myRepo https://repo.example.com/ --cert-file cert.pem --key-file key.pem --kube-context dev
-`
-	if buffer.String() != expected {
-		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-
-	buffer.Reset()
-	helm.AddRepo("myRepo", "https://repo.example.com/", "", "", "", "")
-	expected = `Adding repo myRepo https://repo.example.com/
-exec: helm repo add myRepo https://repo.example.com/ --kube-context dev
-`
-	if buffer.String() != expected {
-		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-
-	buffer.Reset()
-	helm.AddRepo("myRepo", "https://repo.example.com/", "", "", "example_user", "example_password")
-	expected = `Adding repo myRepo https://repo.example.com/
-exec: helm repo add myRepo https://repo.example.com/ --username example_user --password example_password --kube-context dev
-`
-	if buffer.String() != expected {
-		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-}
-
-func Test_UpdateRepo(t *testing.T) {
-	var buffer bytes.Buffer
-	logger := NewLogger(&buffer, "debug")
-	helm := MockExecer(logger, "dev")
-	helm.UpdateRepo()
-	expected := `Updating repo
-exec: helm repo update --kube-context dev
-`
-	if buffer.String() != expected {
-		t.Errorf("helmexec.UpdateRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-}
-
-func Test_SyncRelease(t *testing.T) {
-	var buffer bytes.Buffer
-	logger := NewLogger(&buffer, "debug")
-	helm := MockExecer(logger, "dev")
-	helm.SyncRelease("release", "chart", "--timeout 10", "--wait")
-	expected := `Upgrading chart
-exec: helm upgrade --install --reset-values release chart --timeout 10 --wait --kube-context dev
-`
-	if buffer.String() != expected {
-		t.Errorf("helmexec.SyncRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-
-	buffer.Reset()
-	helm.SyncRelease("release", "chart")
-	expected = `Upgrading chart
-exec: helm upgrade --install --reset-values release chart --kube-context dev
-`
-	if buffer.String() != expected {
-		t.Errorf("helmexec.SyncRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-}
-
-func Test_UpdateDeps(t *testing.T) {
-	var buffer bytes.Buffer
-	logger := NewLogger(&buffer, "debug")
-	helm := MockExecer(logger, "dev")
-	helm.UpdateDeps("./chart/foo")
-	expected := `Updating dependency ./chart/foo
-exec: helm dependency update ./chart/foo --kube-context dev
-`
-	if buffer.String() != expected {
-		t.Errorf("helmexec.UpdateDeps()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-
-	buffer.Reset()
-	helm.SetExtraArgs("--verify")
-	helm.UpdateDeps("./chart/foo")
-	expected = `Updating dependency ./chart/foo
-exec: helm dependency update ./chart/foo --verify --kube-context dev
-`
-	if buffer.String() != expected {
-		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-}
-
-func Test_BuildDeps(t *testing.T) {
-	var buffer bytes.Buffer
-	logger := NewLogger(&buffer, "debug")
-	helm := MockExecer(logger, "dev")
-	helm.BuildDeps("./chart/foo")
-	expected := `Building dependency ./chart/foo
-exec: helm dependency build ./chart/foo --kube-context dev
-`
-	if buffer.String() != expected {
-		t.Errorf("helmexec.BuildDeps()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-
-	buffer.Reset()
-	helm.SetExtraArgs("--verify")
-	helm.BuildDeps("./chart/foo")
-	expected = `Building dependency ./chart/foo
-exec: helm dependency build ./chart/foo --verify --kube-context dev
-`
-	if buffer.String() != expected {
-		t.Errorf("helmexec.BuildDeps()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-}
-
-func Test_DecryptSecret(t *testing.T) {
-	var buffer bytes.Buffer
-	logger := NewLogger(&buffer, "debug")
-	helm := MockExecer(logger, "dev")
-	helm.DecryptSecret("secretName")
-	expected := `Decrypting secret secretName
-exec: helm secrets dec secretName --kube-context dev
-`
-	if buffer.String() != expected {
-		t.Errorf("helmexec.DecryptSecret()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-}
-
-func Test_DiffRelease(t *testing.T) {
-	var buffer bytes.Buffer
-	logger := NewLogger(&buffer, "debug")
-	helm := MockExecer(logger, "dev")
-	helm.DiffRelease("release", "chart", "--timeout 10", "--wait")
-	expected := `Comparing release chart
-exec: helm diff upgrade --allow-unreleased release chart --timeout 10 --wait --kube-context dev
-`
-	if buffer.String() != expected {
-		t.Errorf("helmexec.DiffRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-
-	buffer.Reset()
-	helm.DiffRelease("release", "chart")
-	expected = `Comparing release chart
-exec: helm diff upgrade --allow-unreleased release chart --kube-context dev
-`
-	if buffer.String() != expected {
-		t.Errorf("helmexec.DiffRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-}
-
-func Test_DeleteRelease(t *testing.T) {
-	var buffer bytes.Buffer
-	logger := NewLogger(&buffer, "debug")
-	helm := MockExecer(logger, "dev")
-	helm.DeleteRelease("release")
-	expected := `Deleting release
-exec: helm delete release --kube-context dev
-`
-	if buffer.String() != expected {
-		t.Errorf("helmexec.DeleteRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-}
-func Test_DeleteRelease_Flags(t *testing.T) {
-	var buffer bytes.Buffer
-	logger := NewLogger(&buffer, "debug")
-	helm := MockExecer(logger, "dev")
-	helm.DeleteRelease("release", "--purge")
-	expected := `Deleting release
-exec: helm delete release --purge --kube-context dev
-`
-	if buffer.String() != expected {
-		t.Errorf("helmexec.DeleteRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-}
-
-func Test_TestRelease(t *testing.T) {
-	var buffer bytes.Buffer
-	logger := NewLogger(&buffer, "debug")
-	helm := MockExecer(logger, "dev")
-	helm.TestRelease("release")
-	expected := `Testing release
-exec: helm test release --kube-context dev
-`
-	if buffer.String() != expected {
-		t.Errorf("helmexec.TestRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-}
-func Test_TestRelease_Flags(t *testing.T) {
-	var buffer bytes.Buffer
-	logger := NewLogger(&buffer, "debug")
-	helm := MockExecer(logger, "dev")
-	helm.TestRelease("release", "--cleanup", "--timeout", "60")
-	expected := `Testing release
-exec: helm test release --cleanup --timeout 60 --kube-context dev
-`
-	if buffer.String() != expected {
-		t.Errorf("helmexec.TestRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-}
-
-func Test_ReleaseStatus(t *testing.T) {
-	var buffer bytes.Buffer
-	logger := NewLogger(&buffer, "debug")
-	helm := MockExecer(logger, "dev")
-	helm.ReleaseStatus("myRelease")
-	expected := `Getting status myRelease
-exec: helm status myRelease --kube-context dev
-`
-	if buffer.String() != expected {
-		t.Errorf("helmexec.ReleaseStatus()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-}
-
-func Test_exec(t *testing.T) {
-	var buffer bytes.Buffer
-	logger := NewLogger(&buffer, "debug")
-	helm := MockExecer(logger, "")
-	helm.exec("version")
-	expected := "exec: helm version\n"
-	if buffer.String() != expected {
-		t.Errorf("helmexec.exec()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-
-	helm = MockExecer(logger, "dev")
-	ret, _ := helm.exec("diff")
-	if len(ret) != 0 {
-		t.Error("helmexec.exec() - expected empty return value")
-	}
-
-	buffer.Reset()
-	helm = MockExecer(logger, "dev")
-	helm.exec("diff", "release", "chart", "--timeout 10", "--wait")
-	expected = "exec: helm diff release chart --timeout 10 --wait --kube-context dev\n"
-	if buffer.String() != expected {
-		t.Errorf("helmexec.exec()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-
-	buffer.Reset()
-	helm.exec("version")
-	expected = "exec: helm version --kube-context dev\n"
-	if buffer.String() != expected {
-		t.Errorf("helmexec.exec()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-
-	buffer.Reset()
-	helm.SetExtraArgs("foo")
-	helm.exec("version")
-	expected = "exec: helm version foo --kube-context dev\n"
-	if buffer.String() != expected {
-		t.Errorf("helmexec.exec()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-
-	buffer.Reset()
-	helm = MockExecer(logger, "")
-	helm.SetHelmBinary("overwritten")
-	helm.exec("version")
-	expected = "exec: overwritten version\n"
-	if buffer.String() != expected {
-		t.Errorf("helmexec.exec()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-}
-
-func Test_Lint(t *testing.T) {
-	var buffer bytes.Buffer
-	logger := NewLogger(&buffer, "debug")
-	helm := MockExecer(logger, "dev")
-	helm.Lint("path/to/chart", "--values", "file.yml")
-	expected := `Linting path/to/chart
-exec: helm lint path/to/chart --values file.yml --kube-context dev
-`
-	if buffer.String() != expected {
-		t.Errorf("helmexec.Lint()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-}
-
-func Test_Fetch(t *testing.T) {
-	var buffer bytes.Buffer
-	logger := NewLogger(&buffer, "debug")
-	helm := MockExecer(logger, "dev")
-	helm.Fetch("chart", "--version", "1.2.3", "--untar", "--untardir", "/tmp/dir")
-	expected := `Fetching chart
-exec: helm fetch chart --version 1.2.3 --untar --untardir /tmp/dir --kube-context dev
-`
-	if buffer.String() != expected {
-		t.Errorf("helmexec.Lint()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-}
-
-var logLevelTests = map[string]string{
-	"debug": `Adding repo myRepo https://repo.example.com/
-exec: helm repo add myRepo https://repo.example.com/ --username example_user --password example_password
-`,
-	"info": `Adding repo myRepo https://repo.example.com/
-`,
-	"warn": ``,
-}
-
-func Test_LogLevels(t *testing.T) {
-	var buffer bytes.Buffer
-	for logLevel, expected := range logLevelTests {
-		buffer.Reset()
-		logger := NewLogger(&buffer, logLevel)
-		helm := MockExecer(logger, "")
-		helm.AddRepo("myRepo", "https://repo.example.com/", "", "", "example_user", "example_password")
-		if buffer.String() != expected {
-			t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
-		}
-	}
-}

helmexec/helmexec.go

@@ -1,22 +0,0 @@
-package helmexec
-
-// Interface for executing helm commands
-type Interface interface {
-	SetExtraArgs(args ...string)
-	SetHelmBinary(bin string)
-
-	AddRepo(name, repository, certfile, keyfile, username, password string) error
-	UpdateRepo() error
-	BuildDeps(chart string) error
-	UpdateDeps(chart string) error
-	SyncRelease(name, chart string, flags ...string) error
-	DiffRelease(name, chart string, flags ...string) error
-	TemplateRelease(chart string, flags ...string) error
-	Fetch(chart string, flags ...string) error
-	Lint(chart string, flags ...string) error
-	ReleaseStatus(name string, flags ...string) error
-	DeleteRelease(name string, flags ...string) error
-	TestRelease(name string, flags ...string) error
-	List(filter string, flags ...string) (string, error)
-	DecryptSecret(name string) (string, error)
-}

helmexec/runner.go

@@ -1,27 +0,0 @@
-package helmexec
-
-import (
-	"os/exec"
-)
-
-const (
-	tmpPrefix = "helmfile-"
-	tmpSuffix = "-exec"
-)
-
-// Runner interface for shell commands
-type Runner interface {
-	Execute(cmd string, args []string) ([]byte, error)
-}
-
-// ShellRunner implemention for shell commands
-type ShellRunner struct {
-	Dir string
-}
-
-// Execute a shell command
-func (shell ShellRunner) Execute(cmd string, args []string) ([]byte, error) {
-	preparedCmd := exec.Command(cmd, args...)
-	preparedCmd.Dir = shell.Dir
-	return preparedCmd.CombinedOutput()
-}

hooks/build

@@ -0,0 +1,6 @@
+#!/bin/bash
+
+echo "=> Building container"
+docker build \
+  --tag "$IMAGE_NAME" \
+  --file Dockerfile .

hooks/pre_build

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+go()
+{
+  docker run --rm -v "$(pwd):/workspace" -w /workspace golang:latest go $@;
+}
+
+go get -u github.com/tcnksm/ghr github.com/mitchellh/gox
+go mod vendor

hooks/push

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+echo "=> Fetch unshallow origin"
+git fetch --unshallow origin || true
+
+echo "=> Tag image:"
+docker tag "${IMAGE_NAME}" "${DOCKER_REPO}:$(git describe --tags --abbrev=0 HEAD^)"
+docker tag "${IMAGE_NAME}" "${DOCKER_REPO}:$(git describe --tags --abbrev=0 HEAD)"
+
+echo "=> Push images"
+docker push "${DOCKER_REPO}"

pkg/app/app_sync_test.go

@@ -0,0 +1,790 @@
+package app
+
+import (
+	"bufio"
+	"bytes"
+	"io"
+	"path/filepath"
+	"sync"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/roboll/helmfile/pkg/exectest"
+	"github.com/roboll/helmfile/pkg/helmexec"
+	"github.com/roboll/helmfile/pkg/testhelper"
+	"github.com/variantdev/vals"
+)
+
+func TestSync(t *testing.T) {
+	type fields struct {
+		skipNeeds    bool
+		includeNeeds bool
+	}
+
+	type testcase struct {
+		fields            fields
+		ns                string
+		concurrency       int
+		skipDiffOnInstall bool
+		error             string
+		files             map[string]string
+		selectors         []string
+		lists             map[exectest.ListKey]string
+		upgraded          []exectest.Release
+		deleted           []exectest.Release
+		log               string
+	}
+
+	check := func(t *testing.T, tc testcase) {
+		t.Helper()
+
+		wantUpgrades := tc.upgraded
+		wantDeletes := tc.deleted
+
+		var helm = &exectest.Helm{
+			FailOnUnexpectedList: true,
+			FailOnUnexpectedDiff: true,
+			Lists:                tc.lists,
+			DiffMutex:            &sync.Mutex{},
+			ChartsMutex:          &sync.Mutex{},
+			ReleasesMutex:        &sync.Mutex{},
+		}
+
+		bs := &bytes.Buffer{}
+
+		func() {
+			t.Helper()
+
+			logReader, logWriter := io.Pipe()
+
+			logFlushed := &sync.WaitGroup{}
+			// Ensure all the log is consumed into `bs` by calling `logWriter.Close()` followed by `logFlushed.Wait()`
+			logFlushed.Add(1)
+			go func() {
+				scanner := bufio.NewScanner(logReader)
+				for scanner.Scan() {
+					bs.Write(scanner.Bytes())
+					bs.WriteString("\n")
+				}
+				logFlushed.Done()
+			}()
+
+			defer func() {
+				// This is here to avoid data-trace on bytes buffer `bs` to capture logs
+				if err := logWriter.Close(); err != nil {
+					panic(err)
+				}
+				logFlushed.Wait()
+			}()
+
+			logger := helmexec.NewLogger(logWriter, "debug")
+
+			valsRuntime, err := vals.New(vals.Options{CacheSize: 32})
+			if err != nil {
+				t.Errorf("unexpected error creating vals runtime: %v", err)
+			}
+
+			app := appWithFs(&App{
+				OverrideHelmBinary:  DefaultHelmBinary,
+				glob:                filepath.Glob,
+				abs:                 filepath.Abs,
+				OverrideKubeContext: "default",
+				Env:                 "default",
+				Logger:              logger,
+				helms: map[helmKey]helmexec.Interface{
+					createHelmKey("helm", "default"): helm,
+				},
+				valsRuntime: valsRuntime,
+			}, tc.files)
+
+			if tc.ns != "" {
+				app.Namespace = tc.ns
+			}
+
+			if tc.selectors != nil {
+				app.Selectors = tc.selectors
+			}
+
+			syncErr := app.Sync(applyConfig{
+				// if we check log output, concurrency must be 1. otherwise the test becomes non-deterministic.
+				concurrency:       tc.concurrency,
+				logger:            logger,
+				skipDiffOnInstall: tc.skipDiffOnInstall,
+				skipNeeds:         tc.fields.skipNeeds,
+				includeNeeds:      tc.fields.includeNeeds,
+			})
+
+			var gotErr string
+			if syncErr != nil {
+				gotErr = syncErr.Error()
+			}
+
+			if d := cmp.Diff(tc.error, gotErr); d != "" {
+				t.Fatalf("unexpected error: want (-), got (+): %s", d)
+			}
+
+			if len(wantUpgrades) > len(helm.Releases) {
+				t.Fatalf("insufficient number of upgrades: got %d, want %d", len(helm.Releases), len(wantUpgrades))
+			}
+
+			for relIdx := range wantUpgrades {
+				if wantUpgrades[relIdx].Name != helm.Releases[relIdx].Name {
+					t.Errorf("releases[%d].name: got %q, want %q", relIdx, helm.Releases[relIdx].Name, wantUpgrades[relIdx].Name)
+				}
+				for flagIdx := range wantUpgrades[relIdx].Flags {
+					if wantUpgrades[relIdx].Flags[flagIdx] != helm.Releases[relIdx].Flags[flagIdx] {
+						t.Errorf("releaes[%d].flags[%d]: got %v, want %v", relIdx, flagIdx, helm.Releases[relIdx].Flags[flagIdx], wantUpgrades[relIdx].Flags[flagIdx])
+					}
+				}
+			}
+
+			if len(wantDeletes) > len(helm.Deleted) {
+				t.Fatalf("insufficient number of deletes: got %d, want %d", len(helm.Deleted), len(wantDeletes))
+			}
+
+			for relIdx := range wantDeletes {
+				if wantDeletes[relIdx].Name != helm.Deleted[relIdx].Name {
+					t.Errorf("releases[%d].name: got %q, want %q", relIdx, helm.Deleted[relIdx].Name, wantDeletes[relIdx].Name)
+				}
+				for flagIdx := range wantDeletes[relIdx].Flags {
+					if wantDeletes[relIdx].Flags[flagIdx] != helm.Deleted[relIdx].Flags[flagIdx] {
+						t.Errorf("releaes[%d].flags[%d]: got %v, want %v", relIdx, flagIdx, helm.Deleted[relIdx].Flags[flagIdx], wantDeletes[relIdx].Flags[flagIdx])
+					}
+				}
+			}
+		}()
+
+		if tc.log != "" {
+			actual := bs.String()
+
+			diff, exists := testhelper.Diff(tc.log, actual, 3)
+			if exists {
+				t.Errorf("unexpected log:\nDIFF\n%s\nEOD", diff)
+			}
+		}
+	}
+
+	t.Run("skip-needs=true", func(t *testing.T) {
+		check(t, testcase{
+			fields: fields{
+				skipNeeds: true,
+			},
+			files: map[string]string{
+				"/path/to/helmfile.yaml": `
+{{ $mark := "a" }}
+
+releases:
+- name: kubernetes-external-secrets
+  chart: incubator/raw
+  namespace: kube-system
+
+- name: external-secrets
+  chart: incubator/raw
+  namespace: default
+  labels:
+    app: test
+  needs:
+  - kube-system/kubernetes-external-secrets
+
+- name: my-release
+  chart: incubator/raw
+  namespace: default
+  labels:
+    app: test
+  needs:
+  - default/external-secrets
+`,
+			},
+			selectors: []string{"app=test"},
+			upgraded: []exectest.Release{
+				{Name: "external-secrets", Flags: []string{"--kube-context", "default", "--namespace", "default"}},
+				{Name: "my-release", Flags: []string{"--kube-context", "default", "--namespace", "default"}},
+			},
+			// as we check for log output, set concurrency to 1 to avoid non-deterministic test result
+			concurrency: 1,
+			log: `processing file "helmfile.yaml" in directory "."
+first-pass rendering starting for "helmfile.yaml.part.0": inherited=&{default map[] map[]}, overrode=<nil>
+first-pass uses: &{default map[] map[]}
+first-pass rendering output of "helmfile.yaml.part.0":
+ 0: 
+ 1: 
+ 2: 
+ 3: releases:
+ 4: - name: kubernetes-external-secrets
+ 5:   chart: incubator/raw
+ 6:   namespace: kube-system
+ 7: 
+ 8: - name: external-secrets
+ 9:   chart: incubator/raw
+10:   namespace: default
+11:   labels:
+12:     app: test
+13:   needs:
+14:   - kube-system/kubernetes-external-secrets
+15: 
+16: - name: my-release
+17:   chart: incubator/raw
+18:   namespace: default
+19:   labels:
+20:     app: test
+21:   needs:
+22:   - default/external-secrets
+23: 
+
+first-pass produced: &{default map[] map[]}
+first-pass rendering result of "helmfile.yaml.part.0": {default map[] map[]}
+vals:
+map[]
+defaultVals:[]
+second-pass rendering result of "helmfile.yaml.part.0":
+ 0: 
+ 1: 
+ 2: 
+ 3: releases:
+ 4: - name: kubernetes-external-secrets
+ 5:   chart: incubator/raw
+ 6:   namespace: kube-system
+ 7: 
+ 8: - name: external-secrets
+ 9:   chart: incubator/raw
+10:   namespace: default
+11:   labels:
+12:     app: test
+13:   needs:
+14:   - kube-system/kubernetes-external-secrets
+15: 
+16: - name: my-release
+17:   chart: incubator/raw
+18:   namespace: default
+19:   labels:
+20:     app: test
+21:   needs:
+22:   - default/external-secrets
+23: 
+
+merged environment: &{default map[] map[]}
+2 release(s) matching app=test found in helmfile.yaml
+
+Affected releases are:
+  external-secrets (incubator/raw) UPDATED
+  my-release (incubator/raw) UPDATED
+
+processing 2 groups of releases in this order:
+GROUP RELEASES
+1     default/default/external-secrets
+2     default/default/my-release
+
+processing releases in group 1/2: default/default/external-secrets
+getting deployed release version failed:unexpected list key: {^external-secrets$ --kube-contextdefault--deleting--deployed--failed--pending}
+processing releases in group 2/2: default/default/my-release
+getting deployed release version failed:unexpected list key: {^my-release$ --kube-contextdefault--deleting--deployed--failed--pending}
+
+UPDATED RELEASES:
+NAME               CHART           VERSION
+external-secrets   incubator/raw          
+my-release         incubator/raw          
+
+`,
+		})
+	})
+
+	t.Run("skip-needs=false include-needs=true", func(t *testing.T) {
+		check(t, testcase{
+			fields: fields{
+				skipNeeds:    false,
+				includeNeeds: true,
+			},
+			error: ``,
+			files: map[string]string{
+				"/path/to/helmfile.yaml": `
+{{ $mark := "a" }}
+
+releases:
+- name: kubernetes-external-secrets
+  chart: incubator/raw
+  namespace: kube-system
+
+- name: external-secrets
+  chart: incubator/raw
+  namespace: default
+  labels:
+    app: test
+  needs:
+  - kube-system/kubernetes-external-secrets
+
+- name: my-release
+  chart: incubator/raw
+  namespace: default
+  labels:
+    app: test
+  needs:
+  - default/external-secrets
+`,
+			},
+			selectors: []string{"app=test"},
+			upgraded:  []exectest.Release{},
+			// as we check for log output, set concurrency to 1 to avoid non-deterministic test result
+			concurrency: 1,
+			log: `processing file "helmfile.yaml" in directory "."
+first-pass rendering starting for "helmfile.yaml.part.0": inherited=&{default map[] map[]}, overrode=<nil>
+first-pass uses: &{default map[] map[]}
+first-pass rendering output of "helmfile.yaml.part.0":
+ 0: 
+ 1: 
+ 2: 
+ 3: releases:
+ 4: - name: kubernetes-external-secrets
+ 5:   chart: incubator/raw
+ 6:   namespace: kube-system
+ 7: 
+ 8: - name: external-secrets
+ 9:   chart: incubator/raw
+10:   namespace: default
+11:   labels:
+12:     app: test
+13:   needs:
+14:   - kube-system/kubernetes-external-secrets
+15: 
+16: - name: my-release
+17:   chart: incubator/raw
+18:   namespace: default
+19:   labels:
+20:     app: test
+21:   needs:
+22:   - default/external-secrets
+23: 
+
+first-pass produced: &{default map[] map[]}
+first-pass rendering result of "helmfile.yaml.part.0": {default map[] map[]}
+vals:
+map[]
+defaultVals:[]
+second-pass rendering result of "helmfile.yaml.part.0":
+ 0: 
+ 1: 
+ 2: 
+ 3: releases:
+ 4: - name: kubernetes-external-secrets
+ 5:   chart: incubator/raw
+ 6:   namespace: kube-system
+ 7: 
+ 8: - name: external-secrets
+ 9:   chart: incubator/raw
+10:   namespace: default
+11:   labels:
+12:     app: test
+13:   needs:
+14:   - kube-system/kubernetes-external-secrets
+15: 
+16: - name: my-release
+17:   chart: incubator/raw
+18:   namespace: default
+19:   labels:
+20:     app: test
+21:   needs:
+22:   - default/external-secrets
+23: 
+
+merged environment: &{default map[] map[]}
+2 release(s) matching app=test found in helmfile.yaml
+
+Affected releases are:
+  external-secrets (incubator/raw) UPDATED
+  kubernetes-external-secrets (incubator/raw) UPDATED
+  my-release (incubator/raw) UPDATED
+
+processing 3 groups of releases in this order:
+GROUP RELEASES
+1     default/kube-system/kubernetes-external-secrets
+2     default/default/external-secrets
+3     default/default/my-release
+
+processing releases in group 1/3: default/kube-system/kubernetes-external-secrets
+getting deployed release version failed:unexpected list key: {^kubernetes-external-secrets$ --kube-contextdefault--deleting--deployed--failed--pending}
+processing releases in group 2/3: default/default/external-secrets
+getting deployed release version failed:unexpected list key: {^external-secrets$ --kube-contextdefault--deleting--deployed--failed--pending}
+processing releases in group 3/3: default/default/my-release
+getting deployed release version failed:unexpected list key: {^my-release$ --kube-contextdefault--deleting--deployed--failed--pending}
+
+UPDATED RELEASES:
+NAME                          CHART           VERSION
+kubernetes-external-secrets   incubator/raw          
+external-secrets              incubator/raw          
+my-release                    incubator/raw          
+
+`,
+		})
+	})
+
+	t.Run("skip-needs=false include-needs=true with installed but disabled release", func(t *testing.T) {
+		check(t, testcase{
+			fields: fields{
+				skipNeeds:    false,
+				includeNeeds: true,
+			},
+			error: ``,
+			files: map[string]string{
+				"/path/to/helmfile.yaml": `
+{{ $mark := "a" }}
+
+releases:
+- name: kubernetes-external-secrets
+  chart: incubator/raw
+  namespace: kube-system
+  installed: false
+
+- name: external-secrets
+  chart: incubator/raw
+  namespace: default
+  labels:
+    app: test
+  needs:
+  - kube-system/kubernetes-external-secrets
+
+- name: my-release
+  chart: incubator/raw
+  namespace: default
+  labels:
+    app: test
+  needs:
+  - default/external-secrets
+`,
+			},
+			selectors: []string{"app=test"},
+			upgraded:  []exectest.Release{},
+			lists: map[exectest.ListKey]string{
+				// delete frontend-v1 and backend-v1
+				exectest.ListKey{Filter: "^kubernetes-external-secrets$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+^kubernetes-external-secrets$ 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	backend-3.1.0	3.1.0      	default
+`,
+			},
+			// as we check for log output, set concurrency to 1 to avoid non-deterministic test result
+			concurrency: 1,
+			log: `processing file "helmfile.yaml" in directory "."
+first-pass rendering starting for "helmfile.yaml.part.0": inherited=&{default map[] map[]}, overrode=<nil>
+first-pass uses: &{default map[] map[]}
+first-pass rendering output of "helmfile.yaml.part.0":
+ 0: 
+ 1: 
+ 2: 
+ 3: releases:
+ 4: - name: kubernetes-external-secrets
+ 5:   chart: incubator/raw
+ 6:   namespace: kube-system
+ 7:   installed: false
+ 8: 
+ 9: - name: external-secrets
+10:   chart: incubator/raw
+11:   namespace: default
+12:   labels:
+13:     app: test
+14:   needs:
+15:   - kube-system/kubernetes-external-secrets
+16: 
+17: - name: my-release
+18:   chart: incubator/raw
+19:   namespace: default
+20:   labels:
+21:     app: test
+22:   needs:
+23:   - default/external-secrets
+24: 
+
+first-pass produced: &{default map[] map[]}
+first-pass rendering result of "helmfile.yaml.part.0": {default map[] map[]}
+vals:
+map[]
+defaultVals:[]
+second-pass rendering result of "helmfile.yaml.part.0":
+ 0: 
+ 1: 
+ 2: 
+ 3: releases:
+ 4: - name: kubernetes-external-secrets
+ 5:   chart: incubator/raw
+ 6:   namespace: kube-system
+ 7:   installed: false
+ 8: 
+ 9: - name: external-secrets
+10:   chart: incubator/raw
+11:   namespace: default
+12:   labels:
+13:     app: test
+14:   needs:
+15:   - kube-system/kubernetes-external-secrets
+16: 
+17: - name: my-release
+18:   chart: incubator/raw
+19:   namespace: default
+20:   labels:
+21:     app: test
+22:   needs:
+23:   - default/external-secrets
+24: 
+
+merged environment: &{default map[] map[]}
+2 release(s) matching app=test found in helmfile.yaml
+
+Affected releases are:
+  external-secrets (incubator/raw) UPDATED
+  kubernetes-external-secrets (incubator/raw) DELETED
+  my-release (incubator/raw) UPDATED
+
+processing 1 groups of releases in this order:
+GROUP RELEASES
+1     default/kube-system/kubernetes-external-secrets
+
+processing releases in group 1/1: default/kube-system/kubernetes-external-secrets
+processing 2 groups of releases in this order:
+GROUP RELEASES
+1     default/default/external-secrets
+2     default/default/my-release
+
+processing releases in group 1/2: default/default/external-secrets
+getting deployed release version failed:unexpected list key: {^external-secrets$ --kube-contextdefault--deleting--deployed--failed--pending}
+processing releases in group 2/2: default/default/my-release
+getting deployed release version failed:unexpected list key: {^my-release$ --kube-contextdefault--deleting--deployed--failed--pending}
+
+UPDATED RELEASES:
+NAME               CHART           VERSION
+external-secrets   incubator/raw          
+my-release         incubator/raw          
+
+
+DELETED RELEASES:
+NAME
+kubernetes-external-secrets
+`,
+		})
+	})
+
+	t.Run("skip-needs=false include-needs=true with not installed and disabled release", func(t *testing.T) {
+		check(t, testcase{
+			fields: fields{
+				skipNeeds:    false,
+				includeNeeds: true,
+			},
+			error: ``,
+			files: map[string]string{
+				"/path/to/helmfile.yaml": `
+{{ $mark := "a" }}
+
+releases:
+- name: kubernetes-external-secrets
+  chart: incubator/raw
+  namespace: kube-system
+  installed: false
+
+- name: external-secrets
+  chart: incubator/raw
+  namespace: default
+  labels:
+    app: test
+  needs:
+  - kube-system/kubernetes-external-secrets
+
+- name: my-release
+  chart: incubator/raw
+  namespace: default
+  labels:
+    app: test
+  needs:
+  - default/external-secrets
+`,
+			},
+			selectors: []string{"app=test"},
+			upgraded:  []exectest.Release{},
+			lists: map[exectest.ListKey]string{
+				// delete frontend-v1 and backend-v1
+				exectest.ListKey{Filter: "^kubernetes-external-secrets$", Flags: helmV2ListFlags}: ``,
+			},
+			// as we check for log output, set concurrency to 1 to avoid non-deterministic test result
+			concurrency: 1,
+			log: `processing file "helmfile.yaml" in directory "."
+first-pass rendering starting for "helmfile.yaml.part.0": inherited=&{default map[] map[]}, overrode=<nil>
+first-pass uses: &{default map[] map[]}
+first-pass rendering output of "helmfile.yaml.part.0":
+ 0: 
+ 1: 
+ 2: 
+ 3: releases:
+ 4: - name: kubernetes-external-secrets
+ 5:   chart: incubator/raw
+ 6:   namespace: kube-system
+ 7:   installed: false
+ 8: 
+ 9: - name: external-secrets
+10:   chart: incubator/raw
+11:   namespace: default
+12:   labels:
+13:     app: test
+14:   needs:
+15:   - kube-system/kubernetes-external-secrets
+16: 
+17: - name: my-release
+18:   chart: incubator/raw
+19:   namespace: default
+20:   labels:
+21:     app: test
+22:   needs:
+23:   - default/external-secrets
+24: 
+
+first-pass produced: &{default map[] map[]}
+first-pass rendering result of "helmfile.yaml.part.0": {default map[] map[]}
+vals:
+map[]
+defaultVals:[]
+second-pass rendering result of "helmfile.yaml.part.0":
+ 0: 
+ 1: 
+ 2: 
+ 3: releases:
+ 4: - name: kubernetes-external-secrets
+ 5:   chart: incubator/raw
+ 6:   namespace: kube-system
+ 7:   installed: false
+ 8: 
+ 9: - name: external-secrets
+10:   chart: incubator/raw
+11:   namespace: default
+12:   labels:
+13:     app: test
+14:   needs:
+15:   - kube-system/kubernetes-external-secrets
+16: 
+17: - name: my-release
+18:   chart: incubator/raw
+19:   namespace: default
+20:   labels:
+21:     app: test
+22:   needs:
+23:   - default/external-secrets
+24: 
+
+merged environment: &{default map[] map[]}
+2 release(s) matching app=test found in helmfile.yaml
+
+Affected releases are:
+  external-secrets (incubator/raw) UPDATED
+  my-release (incubator/raw) UPDATED
+
+processing 2 groups of releases in this order:
+GROUP RELEASES
+1     default/default/external-secrets
+2     default/default/my-release
+
+processing releases in group 1/2: default/default/external-secrets
+getting deployed release version failed:unexpected list key: {^external-secrets$ --kube-contextdefault--deleting--deployed--failed--pending}
+processing releases in group 2/2: default/default/my-release
+getting deployed release version failed:unexpected list key: {^my-release$ --kube-contextdefault--deleting--deployed--failed--pending}
+
+UPDATED RELEASES:
+NAME               CHART           VERSION
+external-secrets   incubator/raw          
+my-release         incubator/raw          
+
+`,
+		})
+	})
+
+	t.Run("bad --selector", func(t *testing.T) {
+		check(t, testcase{
+			files: map[string]string{
+				"/path/to/helmfile.yaml": `
+{{ $mark := "a" }}
+
+releases:
+- name: kubernetes-external-secrets
+  chart: incubator/raw
+  namespace: kube-system
+
+- name: external-secrets
+  chart: incubator/raw
+  namespace: default
+  labels:
+    app: test
+  needs:
+  - kube-system/kubernetes-external-secrets
+
+- name: my-release
+  chart: incubator/raw
+  namespace: default
+  labels:
+    app: test
+  needs:
+  - default/external-secrets
+`,
+			},
+			selectors: []string{"app=test_non_existent"},
+			upgraded:  []exectest.Release{},
+			error:     "err: no releases found that matches specified selector(app=test_non_existent) and environment(default), in any helmfile",
+			// as we check for log output, set concurrency to 1 to avoid non-deterministic test result
+			concurrency: 1,
+			log: `processing file "helmfile.yaml" in directory "."
+first-pass rendering starting for "helmfile.yaml.part.0": inherited=&{default map[] map[]}, overrode=<nil>
+first-pass uses: &{default map[] map[]}
+first-pass rendering output of "helmfile.yaml.part.0":
+ 0: 
+ 1: 
+ 2: 
+ 3: releases:
+ 4: - name: kubernetes-external-secrets
+ 5:   chart: incubator/raw
+ 6:   namespace: kube-system
+ 7: 
+ 8: - name: external-secrets
+ 9:   chart: incubator/raw
+10:   namespace: default
+11:   labels:
+12:     app: test
+13:   needs:
+14:   - kube-system/kubernetes-external-secrets
+15: 
+16: - name: my-release
+17:   chart: incubator/raw
+18:   namespace: default
+19:   labels:
+20:     app: test
+21:   needs:
+22:   - default/external-secrets
+23: 
+
+first-pass produced: &{default map[] map[]}
+first-pass rendering result of "helmfile.yaml.part.0": {default map[] map[]}
+vals:
+map[]
+defaultVals:[]
+second-pass rendering result of "helmfile.yaml.part.0":
+ 0: 
+ 1: 
+ 2: 
+ 3: releases:
+ 4: - name: kubernetes-external-secrets
+ 5:   chart: incubator/raw
+ 6:   namespace: kube-system
+ 7: 
+ 8: - name: external-secrets
+ 9:   chart: incubator/raw
+10:   namespace: default
+11:   labels:
+12:     app: test
+13:   needs:
+14:   - kube-system/kubernetes-external-secrets
+15: 
+16: - name: my-release
+17:   chart: incubator/raw
+18:   namespace: default
+19:   labels:
+20:     app: test
+21:   needs:
+22:   - default/external-secrets
+23: 
+
+merged environment: &{default map[] map[]}
+0 release(s) matching app=test_non_existent found in helmfile.yaml
+
+`,
+		})
+	})
+}

pkg/app/ask.go

@@ -1,4 +1,4 @@
-package main
+package app
 
 import (
 	"bufio"
@@ -11,7 +11,7 @@ import (
 // Copyright (c) 2017 Roland Singer [roland.singer@desertbit.com]
 //
 // Shamelessly borrowed from @r0l1's awesome work that is available at https://gist.github.com/r0l1/3dcbb0c8f6cfe9c66ab8008f55f8f28b
-func askForConfirmation(s string) bool {
+func AskForConfirmation(s string) bool {
 	reader := bufio.NewReader(os.Stdin)
 
 	for {

pkg/app/config.go

@@ -0,0 +1,209 @@
+package app
+
+import "go.uber.org/zap"
+
+type ConfigProvider interface {
+	Args() string
+	HelmBinary() string
+
+	FileOrDir() string
+	KubeContext() string
+	Namespace() string
+	Chart() string
+	Selectors() []string
+	StateValuesSet() map[string]interface{}
+	StateValuesFiles() []string
+	Env() string
+
+	loggingConfig
+}
+
+type DeprecatedChartsConfigProvider interface {
+	Values() []string
+
+	concurrencyConfig
+	loggingConfig
+}
+
+type DepsConfigProvider interface {
+	Args() string
+	SkipRepos() bool
+}
+
+type ReposConfigProvider interface {
+	Args() string
+}
+
+type ApplyConfigProvider interface {
+	Args() string
+
+	Values() []string
+	Set() []string
+	SkipCRDs() bool
+	SkipDeps() bool
+	Wait() bool
+	WaitForJobs() bool
+
+	IncludeTests() bool
+
+	SuppressSecrets() bool
+	ShowSecrets() bool
+	SuppressDiff() bool
+
+	DetailedExitcode() bool
+
+	NoColor() bool
+	Context() int
+	DiffOutput() string
+
+	RetainValuesFiles() bool
+	SkipCleanup() bool
+	SkipDiffOnInstall() bool
+
+	SkipNeeds() bool
+	IncludeNeeds() bool
+
+	concurrencyConfig
+	interactive
+	loggingConfig
+}
+
+type SyncConfigProvider interface {
+	Args() string
+
+	Values() []string
+	Set() []string
+	SkipCRDs() bool
+	SkipDeps() bool
+	Wait() bool
+	WaitForJobs() bool
+
+	SkipNeeds() bool
+	IncludeNeeds() bool
+
+	concurrencyConfig
+	loggingConfig
+}
+
+type DiffConfigProvider interface {
+	Args() string
+
+	Values() []string
+	Set() []string
+	SkipCRDs() bool
+	SkipDeps() bool
+
+	IncludeTests() bool
+
+	SuppressSecrets() bool
+	ShowSecrets() bool
+	SuppressDiff() bool
+
+	SkipNeeds() bool
+	IncludeNeeds() bool
+
+	DetailedExitcode() bool
+	NoColor() bool
+	Context() int
+	DiffOutput() string
+
+	concurrencyConfig
+}
+
+type DeleteConfigProvider interface {
+	Args() string
+
+	Purge() bool
+	SkipDeps() bool
+
+	interactive
+	loggingConfig
+	concurrencyConfig
+}
+
+type DestroyConfigProvider interface {
+	Args() string
+
+	SkipDeps() bool
+
+	interactive
+	loggingConfig
+	concurrencyConfig
+}
+
+type TestConfigProvider interface {
+	Args() string
+
+	SkipDeps() bool
+	Timeout() int
+	Cleanup() bool
+	Logs() bool
+
+	concurrencyConfig
+}
+
+type LintConfigProvider interface {
+	Args() string
+
+	Values() []string
+	Set() []string
+	SkipDeps() bool
+
+	concurrencyConfig
+}
+
+type FetchConfigProvider interface {
+	SkipDeps() bool
+	OutputDir() string
+
+	concurrencyConfig
+}
+
+type TemplateConfigProvider interface {
+	Args() string
+
+	Values() []string
+	Set() []string
+	OutputDirTemplate() string
+	Validate() bool
+	SkipDeps() bool
+	SkipCleanup() bool
+	OutputDir() string
+	IncludeCRDs() bool
+	IncludeNeeds() bool
+
+	concurrencyConfig
+}
+
+type WriteValuesConfigProvider interface {
+	Values() []string
+	Set() []string
+	OutputFileTemplate() string
+	SkipDeps() bool
+}
+
+type StatusesConfigProvider interface {
+	Args() string
+
+	concurrencyConfig
+}
+
+type StateConfigProvider interface {
+	EmbedValues() bool
+}
+
+type concurrencyConfig interface {
+	Concurrency() int
+}
+
+type loggingConfig interface {
+	Logger() *zap.SugaredLogger
+}
+
+type interactive interface {
+	Interactive() bool
+}
+
+type ListConfigProvider interface {
+	Output() string
+}

pkg/app/constants.go

@@ -1,7 +1,22 @@
 package app
 
-const (
-	DefaultHelmfile          = "helmfile.yaml"
-	DeprecatedHelmfile       = "charts.yaml"
-	DefaultHelmfileDirectory = "helmfile.d"
+import (
+	"os"
+	"strings"
 )
+
+const (
+	DefaultHelmfile              = "helmfile.yaml"
+	DeprecatedHelmfile           = "charts.yaml"
+	DefaultHelmfileDirectory     = "helmfile.d"
+	ExperimentalEnvVar           = "HELMFILE_EXPERIMENTAL"         // environment variable for experimental features, expecting "true" lower case
+	ExperimentalSelectorExplicit = "explicit-selector-inheritance" // value to remove default selector inheritance to sub-helmfiles and use the explicit one
+)
+
+func experimentalModeEnabled() bool {
+	return os.Getenv(ExperimentalEnvVar) == "true"
+}
+
+func isExplicitSelectorInheritanceEnabled() bool {
+	return experimentalModeEnabled() || strings.Contains(os.Getenv(ExperimentalEnvVar), ExperimentalSelectorExplicit)
+}

pkg/app/constants_test.go

@@ -0,0 +1,27 @@
+package app
+
+import (
+	"gotest.tools/v3/assert"
+	is "gotest.tools/v3/assert/cmp"
+	"gotest.tools/v3/env"
+	"os"
+	"testing"
+)
+
+func TestIsExplicitSelectorInheritanceEnabled(t *testing.T) {
+	//env var ExperimentalEnvVar is set
+	assert.Assert(t, is.Equal(os.Getenv(ExperimentalEnvVar), ""))
+	assert.Check(t, !isExplicitSelectorInheritanceEnabled())
+
+	//check for env var ExperimentalEnvVar set to true
+	defer env.Patch(t, ExperimentalEnvVar, "true")()
+	assert.Check(t, isExplicitSelectorInheritanceEnabled())
+
+	//check for env var ExperimentalEnvVar set to anything
+	defer env.Patch(t, ExperimentalEnvVar, "foo")()
+	assert.Check(t, !isExplicitSelectorInheritanceEnabled())
+
+	//check for env var ExperimentalEnvVar set to ExperimentalSelectorExplicit
+	defer env.Patch(t, ExperimentalEnvVar, ExperimentalSelectorExplicit)()
+	assert.Check(t, isExplicitSelectorInheritanceEnabled())
+}

pkg/app/context.go

@@ -1,33 +1,36 @@
 package app
 
-import "github.com/roboll/helmfile/state"
+import (
+	"github.com/roboll/helmfile/pkg/state"
+)
 
 type Context struct {
-	updatedRepos map[string]struct{}
+	updatedRepos   map[string]bool
+	updatedReposV2 map[string]bool
 }
 
 func NewContext() Context {
 	return Context{
-		updatedRepos: map[string]struct{}{},
+		updatedRepos:   map[string]bool{},
+		updatedReposV2: map[string]bool{},
 	}
 }
 
-func (ctx Context) SyncReposOnce(st *state.HelmState, helm state.RepoUpdater) []error {
-	var errs []error
+func (ctx Context) SyncReposOnce(st *state.HelmState, helm state.RepoUpdater) error {
+	var (
+		updated []string
+		err     error
+	)
 
-	allUpdated := true
-	for _, r := range st.Repositories {
-		_, exists := ctx.updatedRepos[r.Name]
-		allUpdated = allUpdated && exists
+	if helm.IsHelm3() {
+		updated, err = st.SyncRepos(helm, ctx.updatedRepos)
+	} else {
+		updated, err = st.SyncRepos(helm, ctx.updatedReposV2)
 	}
 
-	if !allUpdated {
-		errs = st.SyncRepos(helm)
-
-		for _, r := range st.Repositories {
-			ctx.updatedRepos[r.Name] = struct{}{}
-		}
+	for _, r := range updated {
+		ctx.updatedRepos[r] = true
 	}
 
-	return errs
+	return err
 }

pkg/app/desired_state_file_loader.go

@@ -0,0 +1,245 @@
+package app
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"path/filepath"
+
+	"github.com/imdario/mergo"
+	"github.com/roboll/helmfile/pkg/environment"
+	"github.com/roboll/helmfile/pkg/helmexec"
+	"github.com/roboll/helmfile/pkg/remote"
+	"github.com/roboll/helmfile/pkg/state"
+	"github.com/variantdev/vals"
+	"go.uber.org/zap"
+)
+
+const (
+	DefaultHelmBinary = state.DefaultHelmBinary
+)
+
+type desiredStateLoader struct {
+	overrideKubeContext string
+	overrideHelmBinary  string
+
+	env       string
+	namespace string
+	chart     string
+
+	readFile          func(string) ([]byte, error)
+	deleteFile        func(string) error
+	fileExists        func(string) (bool, error)
+	abs               func(string) (string, error)
+	glob              func(string) ([]string, error)
+	directoryExistsAt func(string) bool
+	getHelm           func(*state.HelmState) helmexec.Interface
+
+	remote      *remote.Remote
+	logger      *zap.SugaredLogger
+	valsRuntime vals.Evaluator
+}
+
+func (ld *desiredStateLoader) Load(f string, opts LoadOpts) (*state.HelmState, error) {
+	var overrodeEnv *environment.Environment
+
+	args := opts.Environment.OverrideValues
+
+	if len(args) > 0 {
+		if opts.CalleePath == "" {
+			return nil, fmt.Errorf("bug: opts.CalleePath was nil: f=%s, opts=%v", f, opts)
+		}
+		storage := state.NewStorage(opts.CalleePath, ld.logger, ld.glob)
+		envld := state.NewEnvironmentValuesLoader(storage, ld.readFile, ld.logger, ld.remote)
+		handler := state.MissingFileHandlerError
+		vals, err := envld.LoadEnvironmentValues(&handler, args)
+		if err != nil {
+			return nil, err
+		}
+
+		overrodeEnv = &environment.Environment{
+			Name:   ld.env,
+			Values: vals,
+		}
+	}
+
+	st, err := ld.loadFileWithOverrides(nil, overrodeEnv, filepath.Dir(f), filepath.Base(f), true)
+	if err != nil {
+		return nil, err
+	}
+
+	if opts.Reverse {
+		st.Reverse()
+	}
+
+	if ld.overrideKubeContext != "" {
+		if st.OverrideKubeContext != "" {
+			return nil, errors.New("err: Cannot use option --kube-context and set attribute kubeContext.")
+		}
+		st.OverrideKubeContext = ld.overrideKubeContext
+		// HelmDefaults.KubeContext is also overriden in here
+		// to set default release value properly.
+		st.HelmDefaults.KubeContext = ld.overrideKubeContext
+	}
+
+	if ld.namespace != "" {
+		if st.OverrideNamespace != "" {
+			return nil, errors.New("err: Cannot use option --namespace and set attribute namespace.")
+		}
+		st.OverrideNamespace = ld.namespace
+	}
+
+	if ld.chart != "" {
+		if st.OverrideChart != "" {
+			return nil, errors.New("err: Cannot use option --chart and set attribute chart.")
+		}
+		st.OverrideChart = ld.chart
+	}
+
+	return st, nil
+}
+
+func (ld *desiredStateLoader) loadFile(inheritedEnv *environment.Environment, baseDir, file string, evaluateBases bool) (*state.HelmState, error) {
+	return ld.loadFileWithOverrides(inheritedEnv, nil, baseDir, file, evaluateBases)
+}
+
+func (ld *desiredStateLoader) loadFileWithOverrides(inheritedEnv, overrodeEnv *environment.Environment, baseDir, file string, evaluateBases bool) (*state.HelmState, error) {
+	var f string
+	if filepath.IsAbs(file) {
+		f = file
+	} else {
+		f = filepath.Join(baseDir, file)
+	}
+
+	fileBytes, err := ld.readFile(f)
+	if err != nil {
+		return nil, err
+	}
+
+	ext := filepath.Ext(f)
+
+	var self *state.HelmState
+
+	if !experimentalModeEnabled() || ext == ".gotmpl" {
+		self, err = ld.renderAndLoad(
+			inheritedEnv,
+			overrodeEnv,
+			baseDir,
+			f,
+			fileBytes,
+			evaluateBases,
+		)
+	} else {
+		self, err = ld.load(
+			fileBytes,
+			baseDir,
+			file,
+			evaluateBases,
+			inheritedEnv,
+			overrodeEnv,
+		)
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	for i, h := range self.Helmfiles {
+		if h.Path == f {
+			return nil, fmt.Errorf("%s contains a recursion into the same sub-helmfile at helmfiles[%d]", f, i)
+		}
+		if h.Path == "." {
+			return nil, fmt.Errorf("%s contains a recursion into the the directory containing this helmfile at helmfiles[%d]", f, i)
+		}
+	}
+
+	return self, nil
+}
+
+func (a *desiredStateLoader) underlying() *state.StateCreator {
+	c := state.NewCreator(a.logger, a.readFile, a.fileExists, a.abs, a.glob, a.directoryExistsAt, a.valsRuntime, a.getHelm, a.overrideHelmBinary, a.remote)
+	c.DeleteFile = a.deleteFile
+	c.LoadFile = a.loadFile
+	return c
+}
+
+func (a *desiredStateLoader) load(yaml []byte, baseDir, file string, evaluateBases bool, env, overrodeEnv *environment.Environment) (*state.HelmState, error) {
+	merged, err := env.Merge(overrodeEnv)
+	if err != nil {
+		return nil, err
+	}
+
+	st, err := a.underlying().ParseAndLoad(yaml, baseDir, file, a.env, evaluateBases, merged)
+	if err != nil {
+		return nil, err
+	}
+
+	helmfiles, err := st.ExpandedHelmfiles()
+	if err != nil {
+		return nil, err
+	}
+	st.Helmfiles = helmfiles
+
+	return st, nil
+}
+
+func (ld *desiredStateLoader) renderAndLoad(env, overrodeEnv *environment.Environment, baseDir, filename string, content []byte, evaluateBases bool) (*state.HelmState, error) {
+	// Allows part-splitting to work with CLRF-ed content
+	normalizedContent := bytes.ReplaceAll(content, []byte("\r\n"), []byte("\n"))
+	parts := bytes.Split(normalizedContent, []byte("\n---\n"))
+
+	var finalState *state.HelmState
+
+	for i, part := range parts {
+		var yamlBuf *bytes.Buffer
+		var err error
+
+		id := fmt.Sprintf("%s.part.%d", filename, i)
+
+		if env == nil && overrodeEnv == nil {
+			yamlBuf, err = ld.renderTemplatesToYaml(baseDir, id, part)
+			if err != nil {
+				return nil, fmt.Errorf("error during %s parsing: %v", id, err)
+			}
+		} else {
+			yamlBuf, err = ld.renderTemplatesToYamlWithEnv(baseDir, id, part, env, overrodeEnv)
+			if err != nil {
+				return nil, fmt.Errorf("error during %s parsing: %v", id, err)
+			}
+		}
+
+		currentState, err := ld.load(
+			yamlBuf.Bytes(),
+			baseDir,
+			filename,
+			evaluateBases,
+			env,
+			overrodeEnv,
+		)
+		if err != nil {
+			return nil, err
+		}
+
+		for i, r := range currentState.Releases {
+			if r.Chart == "" {
+				return nil, fmt.Errorf("error during %s parsing: encountered empty chart while reading release %q at index %d", id, r.Name, i)
+			}
+		}
+
+		if finalState == nil {
+			finalState = currentState
+		} else {
+			if err := mergo.Merge(&finalState.ReleaseSetSpec, &currentState.ReleaseSetSpec, mergo.WithOverride); err != nil {
+				return nil, err
+			}
+
+			finalState.RenderedValues = currentState.RenderedValues
+		}
+
+		env = &finalState.Env
+
+		ld.logger.Debugf("merged environment: %v", env)
+	}
+
+	return finalState, nil
+}

pkg/app/destroy_nokubectx_test.go

@@ -0,0 +1,765 @@
+package app
+
+import (
+	"bufio"
+	"bytes"
+	"io"
+	"path/filepath"
+	"sync"
+	"testing"
+
+	"github.com/roboll/helmfile/pkg/exectest"
+	"github.com/roboll/helmfile/pkg/helmexec"
+	"github.com/roboll/helmfile/pkg/testhelper"
+	"github.com/variantdev/vals"
+)
+
+func TestDestroy_2(t *testing.T) {
+	type testcase struct {
+		helm3       bool
+		ns          string
+		concurrency int
+		error       string
+		files       map[string]string
+		selectors   []string
+		lists       map[exectest.ListKey]string
+		diffs       map[exectest.DiffKey]error
+		upgraded    []exectest.Release
+		deleted     []exectest.Release
+		log         string
+	}
+
+	check := func(t *testing.T, tc testcase) {
+		t.Helper()
+
+		wantUpgrades := tc.upgraded
+		wantDeletes := tc.deleted
+
+		var helm = &exectest.Helm{
+			Helm3:                tc.helm3,
+			FailOnUnexpectedList: true,
+			FailOnUnexpectedDiff: true,
+			Lists:                tc.lists,
+			Diffs:                tc.diffs,
+			DiffMutex:            &sync.Mutex{},
+			ChartsMutex:          &sync.Mutex{},
+			ReleasesMutex:        &sync.Mutex{},
+		}
+
+		bs := &bytes.Buffer{}
+
+		func() {
+			t.Helper()
+
+			logReader, logWriter := io.Pipe()
+
+			logFlushed := &sync.WaitGroup{}
+			// Ensure all the log is consumed into `bs` by calling `logWriter.Close()` followed by `logFlushed.Wait()`
+			logFlushed.Add(1)
+			go func() {
+				scanner := bufio.NewScanner(logReader)
+				for scanner.Scan() {
+					bs.Write(scanner.Bytes())
+					bs.WriteString("\n")
+				}
+				logFlushed.Done()
+			}()
+
+			defer func() {
+				// This is here to avoid data-trace on bytes buffer `bs` to capture logs
+				if err := logWriter.Close(); err != nil {
+					panic(err)
+				}
+				logFlushed.Wait()
+			}()
+
+			logger := helmexec.NewLogger(logWriter, "debug")
+
+			valsRuntime, err := vals.New(vals.Options{CacheSize: 32})
+			if err != nil {
+				t.Errorf("unexpected error creating vals runtime: %v", err)
+			}
+
+			app := appWithFs(&App{
+				OverrideHelmBinary:  DefaultHelmBinary,
+				glob:                filepath.Glob,
+				abs:                 filepath.Abs,
+				OverrideKubeContext: "",
+				Env:                 "default",
+				Logger:              logger,
+				helms: map[helmKey]helmexec.Interface{
+					createHelmKey("helm", ""): helm,
+				},
+				valsRuntime: valsRuntime,
+			}, tc.files)
+
+			if tc.ns != "" {
+				app.Namespace = tc.ns
+			}
+
+			if tc.selectors != nil {
+				app.Selectors = tc.selectors
+			}
+
+			destroyErr := app.Destroy(destroyConfig{
+				// if we check log output, concurrency must be 1. otherwise the test becomes non-deterministic.
+				concurrency: tc.concurrency,
+				logger:      logger,
+			})
+
+			if tc.error == "" && destroyErr != nil {
+				t.Fatalf("unexpected error: %v", destroyErr)
+			} else if tc.error != "" && destroyErr == nil {
+				t.Fatal("expected error did not occur")
+			} else if tc.error != "" && destroyErr != nil && tc.error != destroyErr.Error() {
+				t.Fatalf("invalid error: expected %q, got %q", tc.error, destroyErr.Error())
+			}
+
+			if len(wantUpgrades) > len(helm.Releases) {
+				t.Fatalf("insufficient number of upgrades: got %d, want %d", len(helm.Releases), len(wantUpgrades))
+			}
+
+			for relIdx := range wantUpgrades {
+				if wantUpgrades[relIdx].Name != helm.Releases[relIdx].Name {
+					t.Errorf("releases[%d].name: got %q, want %q", relIdx, helm.Releases[relIdx].Name, wantUpgrades[relIdx].Name)
+				}
+				for flagIdx := range wantUpgrades[relIdx].Flags {
+					if wantUpgrades[relIdx].Flags[flagIdx] != helm.Releases[relIdx].Flags[flagIdx] {
+						t.Errorf("releaes[%d].flags[%d]: got %v, want %v", relIdx, flagIdx, helm.Releases[relIdx].Flags[flagIdx], wantUpgrades[relIdx].Flags[flagIdx])
+					}
+				}
+			}
+
+			if len(wantDeletes) > len(helm.Deleted) {
+				t.Fatalf("insufficient number of deletes: got %d, want %d", len(helm.Deleted), len(wantDeletes))
+			}
+
+			for relIdx := range wantDeletes {
+				if wantDeletes[relIdx].Name != helm.Deleted[relIdx].Name {
+					t.Errorf("releases[%d].name: got %q, want %q", relIdx, helm.Deleted[relIdx].Name, wantDeletes[relIdx].Name)
+				}
+				for flagIdx := range wantDeletes[relIdx].Flags {
+					if wantDeletes[relIdx].Flags[flagIdx] != helm.Deleted[relIdx].Flags[flagIdx] {
+						t.Errorf("releaes[%d].flags[%d]: got %v, want %v", relIdx, flagIdx, helm.Deleted[relIdx].Flags[flagIdx], wantDeletes[relIdx].Flags[flagIdx])
+					}
+				}
+			}
+		}()
+
+		if tc.log != "" {
+			actual := bs.String()
+
+			diff, exists := testhelper.Diff(tc.log, actual, 3)
+			if exists {
+				t.Errorf("unexpected log:\nDIFF\n%s\nEOD", diff)
+			}
+		}
+	}
+
+	files := map[string]string{
+		"/path/to/helmfile.yaml": `
+releases:
+- name: database
+  chart: charts/mysql
+  needs:
+  - logging
+- name: frontend-v1
+  chart: charts/frontend
+  installed: false
+  needs:
+  - servicemesh
+  - logging
+  - backend-v1
+- name: frontend-v2
+  chart: charts/frontend
+  needs:
+  - servicemesh
+  - logging
+  - backend-v2
+- name: frontend-v3
+  chart: charts/frontend
+  needs:
+  - servicemesh
+  - logging
+  - backend-v2
+- name: backend-v1
+  chart: charts/backend
+  installed: false
+  needs:
+  - servicemesh
+  - logging
+  - database
+  - anotherbackend
+- name: backend-v2
+  chart: charts/backend
+  needs:
+  - servicemesh
+  - logging
+  - database
+  - anotherbackend
+- name: anotherbackend
+  chart: charts/anotherbackend
+  needs:
+  - servicemesh
+  - logging
+  - database
+- name: servicemesh
+  chart: charts/istio
+  needs:
+  - logging
+- name: logging
+  chart: charts/fluent-bit
+- name: front-proxy
+  chart: stable/envoy
+`,
+	}
+
+	filesForTwoReleases := map[string]string{
+		"/path/to/helmfile.yaml": `
+releases:
+- name: backend-v1
+  chart: charts/backend
+  installed: false
+- name: frontend-v1
+  chart: charts/frontend
+  needs:
+  - backend-v1
+`,
+	}
+
+	t.Run("smoke", func(t *testing.T) {
+		//
+		// complex test cases for smoke testing
+		//
+		check(t, testcase{
+			files: files,
+			diffs: map[exectest.DiffKey]error{},
+			lists: map[exectest.ListKey]string{
+				exectest.ListKey{Filter: "^frontend-v1$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+`,
+				exectest.ListKey{Filter: "^frontend-v2$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+frontend-v2 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	frontend-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^frontend-v3$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+frontend-v3 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	frontend-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^backend-v1$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+`,
+				exectest.ListKey{Filter: "^backend-v2$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+backend-v2 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	backend-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^logging$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+logging	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	fluent-bit-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^front-proxy$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+front-proxy 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	envoy-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^servicemesh$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+servicemesh 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	istio-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^database$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+database 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	mysql-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^anotherbackend$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+anotherbackend 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	anotherbackend-3.1.0	3.1.0      	default
+`,
+			},
+			// Disable concurrency to avoid in-deterministic result
+			concurrency: 1,
+			upgraded:    []exectest.Release{},
+			deleted: []exectest.Release{
+				{Name: "frontend-v3", Flags: []string{}},
+				{Name: "frontend-v2", Flags: []string{}},
+				{Name: "frontend-v1", Flags: []string{}},
+				{Name: "backend-v2", Flags: []string{}},
+				{Name: "backend-v1", Flags: []string{}},
+				{Name: "anotherbackend", Flags: []string{}},
+				{Name: "servicemesh", Flags: []string{}},
+				{Name: "database", Flags: []string{}},
+				{Name: "front-proxy", Flags: []string{}},
+				{Name: "logging", Flags: []string{}},
+			},
+			log: `processing file "helmfile.yaml" in directory "."
+first-pass rendering starting for "helmfile.yaml.part.0": inherited=&{default map[] map[]}, overrode=<nil>
+first-pass uses: &{default map[] map[]}
+first-pass rendering output of "helmfile.yaml.part.0":
+ 0: 
+ 1: releases:
+ 2: - name: database
+ 3:   chart: charts/mysql
+ 4:   needs:
+ 5:   - logging
+ 6: - name: frontend-v1
+ 7:   chart: charts/frontend
+ 8:   installed: false
+ 9:   needs:
+10:   - servicemesh
+11:   - logging
+12:   - backend-v1
+13: - name: frontend-v2
+14:   chart: charts/frontend
+15:   needs:
+16:   - servicemesh
+17:   - logging
+18:   - backend-v2
+19: - name: frontend-v3
+20:   chart: charts/frontend
+21:   needs:
+22:   - servicemesh
+23:   - logging
+24:   - backend-v2
+25: - name: backend-v1
+26:   chart: charts/backend
+27:   installed: false
+28:   needs:
+29:   - servicemesh
+30:   - logging
+31:   - database
+32:   - anotherbackend
+33: - name: backend-v2
+34:   chart: charts/backend
+35:   needs:
+36:   - servicemesh
+37:   - logging
+38:   - database
+39:   - anotherbackend
+40: - name: anotherbackend
+41:   chart: charts/anotherbackend
+42:   needs:
+43:   - servicemesh
+44:   - logging
+45:   - database
+46: - name: servicemesh
+47:   chart: charts/istio
+48:   needs:
+49:   - logging
+50: - name: logging
+51:   chart: charts/fluent-bit
+52: - name: front-proxy
+53:   chart: stable/envoy
+54: 
+
+first-pass produced: &{default map[] map[]}
+first-pass rendering result of "helmfile.yaml.part.0": {default map[] map[]}
+vals:
+map[]
+defaultVals:[]
+second-pass rendering result of "helmfile.yaml.part.0":
+ 0: 
+ 1: releases:
+ 2: - name: database
+ 3:   chart: charts/mysql
+ 4:   needs:
+ 5:   - logging
+ 6: - name: frontend-v1
+ 7:   chart: charts/frontend
+ 8:   installed: false
+ 9:   needs:
+10:   - servicemesh
+11:   - logging
+12:   - backend-v1
+13: - name: frontend-v2
+14:   chart: charts/frontend
+15:   needs:
+16:   - servicemesh
+17:   - logging
+18:   - backend-v2
+19: - name: frontend-v3
+20:   chart: charts/frontend
+21:   needs:
+22:   - servicemesh
+23:   - logging
+24:   - backend-v2
+25: - name: backend-v1
+26:   chart: charts/backend
+27:   installed: false
+28:   needs:
+29:   - servicemesh
+30:   - logging
+31:   - database
+32:   - anotherbackend
+33: - name: backend-v2
+34:   chart: charts/backend
+35:   needs:
+36:   - servicemesh
+37:   - logging
+38:   - database
+39:   - anotherbackend
+40: - name: anotherbackend
+41:   chart: charts/anotherbackend
+42:   needs:
+43:   - servicemesh
+44:   - logging
+45:   - database
+46: - name: servicemesh
+47:   chart: charts/istio
+48:   needs:
+49:   - logging
+50: - name: logging
+51:   chart: charts/fluent-bit
+52: - name: front-proxy
+53:   chart: stable/envoy
+54: 
+
+merged environment: &{default map[] map[]}
+10 release(s) found in helmfile.yaml
+
+processing 5 groups of releases in this order:
+GROUP RELEASES
+1     frontend-v3, frontend-v2, frontend-v1
+2     backend-v2, backend-v1
+3     anotherbackend
+4     servicemesh, database
+5     front-proxy, logging
+
+processing releases in group 1/5: frontend-v3, frontend-v2, frontend-v1
+release "frontend-v3" processed
+release "frontend-v2" processed
+release "frontend-v1" processed
+processing releases in group 2/5: backend-v2, backend-v1
+release "backend-v2" processed
+release "backend-v1" processed
+processing releases in group 3/5: anotherbackend
+release "anotherbackend" processed
+processing releases in group 4/5: servicemesh, database
+release "servicemesh" processed
+release "database" processed
+processing releases in group 5/5: front-proxy, logging
+release "front-proxy" processed
+release "logging" processed
+
+DELETED RELEASES:
+NAME
+frontend-v3
+frontend-v2
+frontend-v1
+backend-v2
+backend-v1
+anotherbackend
+servicemesh
+database
+front-proxy
+logging
+`,
+		})
+	})
+
+	t.Run("destroy only one release with selector", func(t *testing.T) {
+		check(t, testcase{
+			files:     files,
+			selectors: []string{"name=logging"},
+			diffs:     map[exectest.DiffKey]error{},
+			lists: map[exectest.ListKey]string{
+				exectest.ListKey{Filter: "^frontend-v1$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+`,
+				exectest.ListKey{Filter: "^frontend-v2$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+frontend-v2 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	frontend-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^frontend-v3$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+frontend-v3 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	frontend-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^backend-v1$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+`,
+				exectest.ListKey{Filter: "^backend-v2$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+backend-v2 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	backend-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^logging$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+logging	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	fluent-bit-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^front-proxy$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+front-proxy 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	envoy-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^servicemesh$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+servicemesh 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	istio-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^database$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+database 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	mysql-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^anotherbackend$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+anotherbackend 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	anotherbackend-3.1.0	3.1.0      	default
+`,
+			},
+			// Disable concurrency to avoid in-deterministic result
+			concurrency: 1,
+			upgraded:    []exectest.Release{},
+			deleted: []exectest.Release{
+				{Name: "logging", Flags: []string{}},
+			},
+			log: `processing file "helmfile.yaml" in directory "."
+first-pass rendering starting for "helmfile.yaml.part.0": inherited=&{default map[] map[]}, overrode=<nil>
+first-pass uses: &{default map[] map[]}
+first-pass rendering output of "helmfile.yaml.part.0":
+ 0: 
+ 1: releases:
+ 2: - name: database
+ 3:   chart: charts/mysql
+ 4:   needs:
+ 5:   - logging
+ 6: - name: frontend-v1
+ 7:   chart: charts/frontend
+ 8:   installed: false
+ 9:   needs:
+10:   - servicemesh
+11:   - logging
+12:   - backend-v1
+13: - name: frontend-v2
+14:   chart: charts/frontend
+15:   needs:
+16:   - servicemesh
+17:   - logging
+18:   - backend-v2
+19: - name: frontend-v3
+20:   chart: charts/frontend
+21:   needs:
+22:   - servicemesh
+23:   - logging
+24:   - backend-v2
+25: - name: backend-v1
+26:   chart: charts/backend
+27:   installed: false
+28:   needs:
+29:   - servicemesh
+30:   - logging
+31:   - database
+32:   - anotherbackend
+33: - name: backend-v2
+34:   chart: charts/backend
+35:   needs:
+36:   - servicemesh
+37:   - logging
+38:   - database
+39:   - anotherbackend
+40: - name: anotherbackend
+41:   chart: charts/anotherbackend
+42:   needs:
+43:   - servicemesh
+44:   - logging
+45:   - database
+46: - name: servicemesh
+47:   chart: charts/istio
+48:   needs:
+49:   - logging
+50: - name: logging
+51:   chart: charts/fluent-bit
+52: - name: front-proxy
+53:   chart: stable/envoy
+54: 
+
+first-pass produced: &{default map[] map[]}
+first-pass rendering result of "helmfile.yaml.part.0": {default map[] map[]}
+vals:
+map[]
+defaultVals:[]
+second-pass rendering result of "helmfile.yaml.part.0":
+ 0: 
+ 1: releases:
+ 2: - name: database
+ 3:   chart: charts/mysql
+ 4:   needs:
+ 5:   - logging
+ 6: - name: frontend-v1
+ 7:   chart: charts/frontend
+ 8:   installed: false
+ 9:   needs:
+10:   - servicemesh
+11:   - logging
+12:   - backend-v1
+13: - name: frontend-v2
+14:   chart: charts/frontend
+15:   needs:
+16:   - servicemesh
+17:   - logging
+18:   - backend-v2
+19: - name: frontend-v3
+20:   chart: charts/frontend
+21:   needs:
+22:   - servicemesh
+23:   - logging
+24:   - backend-v2
+25: - name: backend-v1
+26:   chart: charts/backend
+27:   installed: false
+28:   needs:
+29:   - servicemesh
+30:   - logging
+31:   - database
+32:   - anotherbackend
+33: - name: backend-v2
+34:   chart: charts/backend
+35:   needs:
+36:   - servicemesh
+37:   - logging
+38:   - database
+39:   - anotherbackend
+40: - name: anotherbackend
+41:   chart: charts/anotherbackend
+42:   needs:
+43:   - servicemesh
+44:   - logging
+45:   - database
+46: - name: servicemesh
+47:   chart: charts/istio
+48:   needs:
+49:   - logging
+50: - name: logging
+51:   chart: charts/fluent-bit
+52: - name: front-proxy
+53:   chart: stable/envoy
+54: 
+
+merged environment: &{default map[] map[]}
+1 release(s) matching name=logging found in helmfile.yaml
+
+processing 1 groups of releases in this order:
+GROUP RELEASES
+1     logging
+
+processing releases in group 1/1: logging
+release "logging" processed
+
+DELETED RELEASES:
+NAME
+logging
+`,
+		})
+	})
+
+	t.Run("destroy installed but disabled release", func(t *testing.T) {
+		check(t, testcase{
+			files: filesForTwoReleases,
+			diffs: map[exectest.DiffKey]error{},
+			lists: map[exectest.ListKey]string{
+				exectest.ListKey{Filter: "^frontend-v1$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+`,
+				exectest.ListKey{Filter: "^backend-v1$", Flags: helmV2ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+`,
+			},
+			// Disable concurrency to avoid in-deterministic result
+			concurrency: 1,
+			upgraded:    []exectest.Release{},
+			deleted: []exectest.Release{
+				{Name: "frontend-v1", Flags: []string{}},
+			},
+			log: `processing file "helmfile.yaml" in directory "."
+first-pass rendering starting for "helmfile.yaml.part.0": inherited=&{default map[] map[]}, overrode=<nil>
+first-pass uses: &{default map[] map[]}
+first-pass rendering output of "helmfile.yaml.part.0":
+ 0: 
+ 1: releases:
+ 2: - name: backend-v1
+ 3:   chart: charts/backend
+ 4:   installed: false
+ 5: - name: frontend-v1
+ 6:   chart: charts/frontend
+ 7:   needs:
+ 8:   - backend-v1
+ 9: 
+
+first-pass produced: &{default map[] map[]}
+first-pass rendering result of "helmfile.yaml.part.0": {default map[] map[]}
+vals:
+map[]
+defaultVals:[]
+second-pass rendering result of "helmfile.yaml.part.0":
+ 0: 
+ 1: releases:
+ 2: - name: backend-v1
+ 3:   chart: charts/backend
+ 4:   installed: false
+ 5: - name: frontend-v1
+ 6:   chart: charts/frontend
+ 7:   needs:
+ 8:   - backend-v1
+ 9: 
+
+merged environment: &{default map[] map[]}
+2 release(s) found in helmfile.yaml
+
+processing 2 groups of releases in this order:
+GROUP RELEASES
+1     frontend-v1
+2     backend-v1
+
+processing releases in group 1/2: frontend-v1
+release "frontend-v1" processed
+processing releases in group 2/2: backend-v1
+release "backend-v1" processed
+
+DELETED RELEASES:
+NAME
+frontend-v1
+backend-v1
+`,
+		})
+	})
+
+	t.Run("helm3", func(t *testing.T) {
+		check(t, testcase{
+			helm3: true,
+			files: filesForTwoReleases,
+			diffs: map[exectest.DiffKey]error{},
+			lists: map[exectest.ListKey]string{
+				exectest.ListKey{Filter: "^frontend-v1$", Flags: helmV3ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+`,
+				exectest.ListKey{Filter: "^backend-v1$", Flags: helmV3ListFlagsWithoutKubeContext}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+`,
+			},
+			// Disable concurrency to avoid in-deterministic result
+			concurrency: 1,
+			upgraded:    []exectest.Release{},
+			deleted: []exectest.Release{
+				{Name: "frontend-v1", Flags: []string{}},
+			},
+			log: `processing file "helmfile.yaml" in directory "."
+first-pass rendering starting for "helmfile.yaml.part.0": inherited=&{default map[] map[]}, overrode=<nil>
+first-pass uses: &{default map[] map[]}
+first-pass rendering output of "helmfile.yaml.part.0":
+ 0: 
+ 1: releases:
+ 2: - name: backend-v1
+ 3:   chart: charts/backend
+ 4:   installed: false
+ 5: - name: frontend-v1
+ 6:   chart: charts/frontend
+ 7:   needs:
+ 8:   - backend-v1
+ 9: 
+
+first-pass produced: &{default map[] map[]}
+first-pass rendering result of "helmfile.yaml.part.0": {default map[] map[]}
+vals:
+map[]
+defaultVals:[]
+second-pass rendering result of "helmfile.yaml.part.0":
+ 0: 
+ 1: releases:
+ 2: - name: backend-v1
+ 3:   chart: charts/backend
+ 4:   installed: false
+ 5: - name: frontend-v1
+ 6:   chart: charts/frontend
+ 7:   needs:
+ 8:   - backend-v1
+ 9: 
+
+merged environment: &{default map[] map[]}
+2 release(s) found in helmfile.yaml
+
+processing 2 groups of releases in this order:
+GROUP RELEASES
+1     frontend-v1
+2     backend-v1
+
+processing releases in group 1/2: frontend-v1
+release "frontend-v1" processed
+processing releases in group 2/2: backend-v1
+release "backend-v1" processed
+
+DELETED RELEASES:
+NAME
+frontend-v1
+backend-v1
+`,
+		})
+	})
+}

pkg/app/destroy_test.go

@@ -0,0 +1,801 @@
+package app
+
+import (
+	"bufio"
+	"bytes"
+	"io"
+	"path/filepath"
+	"sync"
+	"testing"
+
+	"github.com/roboll/helmfile/pkg/exectest"
+	"github.com/roboll/helmfile/pkg/helmexec"
+	"github.com/roboll/helmfile/pkg/testhelper"
+	"github.com/variantdev/vals"
+	"go.uber.org/zap"
+)
+
+const (
+	helmV2ListFlags                   = "--kube-contextdefault--deleting--deployed--failed--pending"
+	helmV2ListFlagsWithoutKubeContext = "--deleting--deployed--failed--pending"
+	helmV3ListFlags                   = "--kube-contextdefault--uninstalling--deployed--failed--pending"
+	helmV3ListFlagsWithoutKubeContext = "--uninstalling--deployed--failed--pending"
+)
+
+type destroyConfig struct {
+	args        string
+	concurrency int
+	interactive bool
+	skipDeps    bool
+	logger      *zap.SugaredLogger
+}
+
+func (d destroyConfig) Args() string {
+	return d.args
+}
+
+func (d destroyConfig) Interactive() bool {
+	return d.interactive
+}
+
+func (d destroyConfig) Logger() *zap.SugaredLogger {
+	return d.logger
+}
+
+func (d destroyConfig) Concurrency() int {
+	return d.concurrency
+}
+
+func (d destroyConfig) SkipDeps() bool {
+	return d.skipDeps
+}
+
+func TestDestroy(t *testing.T) {
+	type testcase struct {
+		helm3       bool
+		ns          string
+		concurrency int
+		error       string
+		files       map[string]string
+		selectors   []string
+		lists       map[exectest.ListKey]string
+		diffs       map[exectest.DiffKey]error
+		upgraded    []exectest.Release
+		deleted     []exectest.Release
+		log         string
+	}
+
+	check := func(t *testing.T, tc testcase) {
+		t.Helper()
+
+		wantUpgrades := tc.upgraded
+		wantDeletes := tc.deleted
+
+		var helm = &exectest.Helm{
+			Helm3:                tc.helm3,
+			FailOnUnexpectedList: true,
+			FailOnUnexpectedDiff: true,
+			Lists:                tc.lists,
+			Diffs:                tc.diffs,
+			DiffMutex:            &sync.Mutex{},
+			ChartsMutex:          &sync.Mutex{},
+			ReleasesMutex:        &sync.Mutex{},
+		}
+
+		bs := &bytes.Buffer{}
+
+		func() {
+			t.Helper()
+
+			logReader, logWriter := io.Pipe()
+
+			logFlushed := &sync.WaitGroup{}
+			// Ensure all the log is consumed into `bs` by calling `logWriter.Close()` followed by `logFlushed.Wait()`
+			logFlushed.Add(1)
+			go func() {
+				scanner := bufio.NewScanner(logReader)
+				for scanner.Scan() {
+					bs.Write(scanner.Bytes())
+					bs.WriteString("\n")
+				}
+				logFlushed.Done()
+			}()
+
+			defer func() {
+				// This is here to avoid data-trace on bytes buffer `bs` to capture logs
+				if err := logWriter.Close(); err != nil {
+					panic(err)
+				}
+				logFlushed.Wait()
+			}()
+
+			logger := helmexec.NewLogger(logWriter, "debug")
+
+			valsRuntime, err := vals.New(vals.Options{CacheSize: 32})
+			if err != nil {
+				t.Errorf("unexpected error creating vals runtime: %v", err)
+			}
+
+			app := appWithFs(&App{
+				OverrideHelmBinary:  DefaultHelmBinary,
+				glob:                filepath.Glob,
+				abs:                 filepath.Abs,
+				OverrideKubeContext: "default",
+				Env:                 "default",
+				Logger:              logger,
+				helms: map[helmKey]helmexec.Interface{
+					createHelmKey("helm", "default"): helm,
+				},
+				valsRuntime: valsRuntime,
+			}, tc.files)
+
+			if tc.ns != "" {
+				app.Namespace = tc.ns
+			}
+
+			if tc.selectors != nil {
+				app.Selectors = tc.selectors
+			}
+
+			destroyErr := app.Destroy(destroyConfig{
+				// if we check log output, concurrency must be 1. otherwise the test becomes non-deterministic.
+				concurrency: tc.concurrency,
+				logger:      logger,
+			})
+
+			if tc.error == "" && destroyErr != nil {
+				t.Fatalf("unexpected error: %v", destroyErr)
+			} else if tc.error != "" && destroyErr == nil {
+				t.Fatal("expected error did not occur")
+			} else if tc.error != "" && destroyErr != nil && tc.error != destroyErr.Error() {
+				t.Fatalf("invalid error: expected %q, got %q", tc.error, destroyErr.Error())
+			}
+
+			if len(wantUpgrades) > len(helm.Releases) {
+				t.Fatalf("insufficient number of upgrades: got %d, want %d", len(helm.Releases), len(wantUpgrades))
+			}
+
+			for relIdx := range wantUpgrades {
+				if wantUpgrades[relIdx].Name != helm.Releases[relIdx].Name {
+					t.Errorf("releases[%d].name: got %q, want %q", relIdx, helm.Releases[relIdx].Name, wantUpgrades[relIdx].Name)
+				}
+				for flagIdx := range wantUpgrades[relIdx].Flags {
+					if wantUpgrades[relIdx].Flags[flagIdx] != helm.Releases[relIdx].Flags[flagIdx] {
+						t.Errorf("releaes[%d].flags[%d]: got %v, want %v", relIdx, flagIdx, helm.Releases[relIdx].Flags[flagIdx], wantUpgrades[relIdx].Flags[flagIdx])
+					}
+				}
+			}
+
+			if len(wantDeletes) > len(helm.Deleted) {
+				t.Fatalf("insufficient number of deletes: got %d, want %d", len(helm.Deleted), len(wantDeletes))
+			}
+
+			for relIdx := range wantDeletes {
+				if wantDeletes[relIdx].Name != helm.Deleted[relIdx].Name {
+					t.Errorf("releases[%d].name: got %q, want %q", relIdx, helm.Deleted[relIdx].Name, wantDeletes[relIdx].Name)
+				}
+				for flagIdx := range wantDeletes[relIdx].Flags {
+					if wantDeletes[relIdx].Flags[flagIdx] != helm.Deleted[relIdx].Flags[flagIdx] {
+						t.Errorf("releaes[%d].flags[%d]: got %v, want %v", relIdx, flagIdx, helm.Deleted[relIdx].Flags[flagIdx], wantDeletes[relIdx].Flags[flagIdx])
+					}
+				}
+			}
+		}()
+
+		if tc.log != "" {
+			actual := bs.String()
+
+			diff, exists := testhelper.Diff(tc.log, actual, 3)
+			if exists {
+				t.Errorf("unexpected log:\nDIFF\n%s\nEOD", diff)
+			}
+		}
+	}
+
+	files := map[string]string{
+		"/path/to/helmfile.yaml": `
+releases:
+- name: database
+  chart: charts/mysql
+  needs:
+  - logging
+- name: frontend-v1
+  chart: charts/frontend
+  installed: false
+  needs:
+  - servicemesh
+  - logging
+  - backend-v1
+- name: frontend-v2
+  chart: charts/frontend
+  needs:
+  - servicemesh
+  - logging
+  - backend-v2
+- name: frontend-v3
+  chart: charts/frontend
+  needs:
+  - servicemesh
+  - logging
+  - backend-v2
+- name: backend-v1
+  chart: charts/backend
+  installed: false
+  needs:
+  - servicemesh
+  - logging
+  - database
+  - anotherbackend
+- name: backend-v2
+  chart: charts/backend
+  needs:
+  - servicemesh
+  - logging
+  - database
+  - anotherbackend
+- name: anotherbackend
+  chart: charts/anotherbackend
+  needs:
+  - servicemesh
+  - logging
+  - database
+- name: servicemesh
+  chart: charts/istio
+  needs:
+  - logging
+- name: logging
+  chart: charts/fluent-bit
+- name: front-proxy
+  chart: stable/envoy
+`,
+	}
+
+	filesForTwoReleases := map[string]string{
+		"/path/to/helmfile.yaml": `
+releases:
+- name: backend-v1
+  chart: charts/backend
+  installed: false
+- name: frontend-v1
+  chart: charts/frontend
+  needs:
+  - backend-v1
+`,
+	}
+
+	t.Run("smoke", func(t *testing.T) {
+		//
+		// complex test cases for smoke testing
+		//
+		check(t, testcase{
+			files: files,
+			diffs: map[exectest.DiffKey]error{},
+			lists: map[exectest.ListKey]string{
+				exectest.ListKey{Filter: "^frontend-v1$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+`,
+				exectest.ListKey{Filter: "^frontend-v2$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+frontend-v2 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	frontend-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^frontend-v3$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+frontend-v3 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	frontend-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^backend-v1$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+`,
+				exectest.ListKey{Filter: "^backend-v2$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+backend-v2 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	backend-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^logging$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+logging	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	fluent-bit-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^front-proxy$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+front-proxy 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	envoy-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^servicemesh$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+servicemesh 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	istio-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^database$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+database 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	mysql-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^anotherbackend$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+anotherbackend 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	anotherbackend-3.1.0	3.1.0      	default
+`,
+			},
+			// Disable concurrency to avoid in-deterministic result
+			concurrency: 1,
+			upgraded:    []exectest.Release{},
+			deleted: []exectest.Release{
+				{Name: "frontend-v3", Flags: []string{}},
+				{Name: "frontend-v2", Flags: []string{}},
+				{Name: "frontend-v1", Flags: []string{}},
+				{Name: "backend-v2", Flags: []string{}},
+				{Name: "backend-v1", Flags: []string{}},
+				{Name: "anotherbackend", Flags: []string{}},
+				{Name: "servicemesh", Flags: []string{}},
+				{Name: "database", Flags: []string{}},
+				{Name: "front-proxy", Flags: []string{}},
+				{Name: "logging", Flags: []string{}},
+			},
+			log: `processing file "helmfile.yaml" in directory "."
+first-pass rendering starting for "helmfile.yaml.part.0": inherited=&{default map[] map[]}, overrode=<nil>
+first-pass uses: &{default map[] map[]}
+first-pass rendering output of "helmfile.yaml.part.0":
+ 0: 
+ 1: releases:
+ 2: - name: database
+ 3:   chart: charts/mysql
+ 4:   needs:
+ 5:   - logging
+ 6: - name: frontend-v1
+ 7:   chart: charts/frontend
+ 8:   installed: false
+ 9:   needs:
+10:   - servicemesh
+11:   - logging
+12:   - backend-v1
+13: - name: frontend-v2
+14:   chart: charts/frontend
+15:   needs:
+16:   - servicemesh
+17:   - logging
+18:   - backend-v2
+19: - name: frontend-v3
+20:   chart: charts/frontend
+21:   needs:
+22:   - servicemesh
+23:   - logging
+24:   - backend-v2
+25: - name: backend-v1
+26:   chart: charts/backend
+27:   installed: false
+28:   needs:
+29:   - servicemesh
+30:   - logging
+31:   - database
+32:   - anotherbackend
+33: - name: backend-v2
+34:   chart: charts/backend
+35:   needs:
+36:   - servicemesh
+37:   - logging
+38:   - database
+39:   - anotherbackend
+40: - name: anotherbackend
+41:   chart: charts/anotherbackend
+42:   needs:
+43:   - servicemesh
+44:   - logging
+45:   - database
+46: - name: servicemesh
+47:   chart: charts/istio
+48:   needs:
+49:   - logging
+50: - name: logging
+51:   chart: charts/fluent-bit
+52: - name: front-proxy
+53:   chart: stable/envoy
+54: 
+
+first-pass produced: &{default map[] map[]}
+first-pass rendering result of "helmfile.yaml.part.0": {default map[] map[]}
+vals:
+map[]
+defaultVals:[]
+second-pass rendering result of "helmfile.yaml.part.0":
+ 0: 
+ 1: releases:
+ 2: - name: database
+ 3:   chart: charts/mysql
+ 4:   needs:
+ 5:   - logging
+ 6: - name: frontend-v1
+ 7:   chart: charts/frontend
+ 8:   installed: false
+ 9:   needs:
+10:   - servicemesh
+11:   - logging
+12:   - backend-v1
+13: - name: frontend-v2
+14:   chart: charts/frontend
+15:   needs:
+16:   - servicemesh
+17:   - logging
+18:   - backend-v2
+19: - name: frontend-v3
+20:   chart: charts/frontend
+21:   needs:
+22:   - servicemesh
+23:   - logging
+24:   - backend-v2
+25: - name: backend-v1
+26:   chart: charts/backend
+27:   installed: false
+28:   needs:
+29:   - servicemesh
+30:   - logging
+31:   - database
+32:   - anotherbackend
+33: - name: backend-v2
+34:   chart: charts/backend
+35:   needs:
+36:   - servicemesh
+37:   - logging
+38:   - database
+39:   - anotherbackend
+40: - name: anotherbackend
+41:   chart: charts/anotherbackend
+42:   needs:
+43:   - servicemesh
+44:   - logging
+45:   - database
+46: - name: servicemesh
+47:   chart: charts/istio
+48:   needs:
+49:   - logging
+50: - name: logging
+51:   chart: charts/fluent-bit
+52: - name: front-proxy
+53:   chart: stable/envoy
+54: 
+
+merged environment: &{default map[] map[]}
+10 release(s) found in helmfile.yaml
+
+processing 5 groups of releases in this order:
+GROUP RELEASES
+1     default//frontend-v3, default//frontend-v2, default//frontend-v1
+2     default//backend-v2, default//backend-v1
+3     default//anotherbackend
+4     default//servicemesh, default//database
+5     default//front-proxy, default//logging
+
+processing releases in group 1/5: default//frontend-v3, default//frontend-v2, default//frontend-v1
+release "frontend-v3" processed
+release "frontend-v2" processed
+release "frontend-v1" processed
+processing releases in group 2/5: default//backend-v2, default//backend-v1
+release "backend-v2" processed
+release "backend-v1" processed
+processing releases in group 3/5: default//anotherbackend
+release "anotherbackend" processed
+processing releases in group 4/5: default//servicemesh, default//database
+release "servicemesh" processed
+release "database" processed
+processing releases in group 5/5: default//front-proxy, default//logging
+release "front-proxy" processed
+release "logging" processed
+
+DELETED RELEASES:
+NAME
+frontend-v3
+frontend-v2
+frontend-v1
+backend-v2
+backend-v1
+anotherbackend
+servicemesh
+database
+front-proxy
+logging
+`,
+		})
+	})
+
+	t.Run("destroy only one release with selector", func(t *testing.T) {
+		check(t, testcase{
+			files:     files,
+			selectors: []string{"name=logging"},
+			diffs:     map[exectest.DiffKey]error{},
+			lists: map[exectest.ListKey]string{
+				exectest.ListKey{Filter: "^frontend-v1$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+`,
+				exectest.ListKey{Filter: "^frontend-v2$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+frontend-v2 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	frontend-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^frontend-v3$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+frontend-v3 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	frontend-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^backend-v1$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+`,
+				exectest.ListKey{Filter: "^backend-v2$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+backend-v2 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	backend-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^logging$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+logging	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	fluent-bit-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^front-proxy$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+front-proxy 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	envoy-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^servicemesh$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+servicemesh 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	istio-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^database$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+database 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	mysql-3.1.0	3.1.0      	default
+`,
+				exectest.ListKey{Filter: "^anotherbackend$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+anotherbackend 	4       	Fri Nov  1 08:40:07 2019	DEPLOYED	anotherbackend-3.1.0	3.1.0      	default
+`,
+			},
+			// Disable concurrency to avoid in-deterministic result
+			concurrency: 1,
+			upgraded:    []exectest.Release{},
+			deleted: []exectest.Release{
+				{Name: "logging", Flags: []string{}},
+			},
+			log: `processing file "helmfile.yaml" in directory "."
+first-pass rendering starting for "helmfile.yaml.part.0": inherited=&{default map[] map[]}, overrode=<nil>
+first-pass uses: &{default map[] map[]}
+first-pass rendering output of "helmfile.yaml.part.0":
+ 0: 
+ 1: releases:
+ 2: - name: database
+ 3:   chart: charts/mysql
+ 4:   needs:
+ 5:   - logging
+ 6: - name: frontend-v1
+ 7:   chart: charts/frontend
+ 8:   installed: false
+ 9:   needs:
+10:   - servicemesh
+11:   - logging
+12:   - backend-v1
+13: - name: frontend-v2
+14:   chart: charts/frontend
+15:   needs:
+16:   - servicemesh
+17:   - logging
+18:   - backend-v2
+19: - name: frontend-v3
+20:   chart: charts/frontend
+21:   needs:
+22:   - servicemesh
+23:   - logging
+24:   - backend-v2
+25: - name: backend-v1
+26:   chart: charts/backend
+27:   installed: false
+28:   needs:
+29:   - servicemesh
+30:   - logging
+31:   - database
+32:   - anotherbackend
+33: - name: backend-v2
+34:   chart: charts/backend
+35:   needs:
+36:   - servicemesh
+37:   - logging
+38:   - database
+39:   - anotherbackend
+40: - name: anotherbackend
+41:   chart: charts/anotherbackend
+42:   needs:
+43:   - servicemesh
+44:   - logging
+45:   - database
+46: - name: servicemesh
+47:   chart: charts/istio
+48:   needs:
+49:   - logging
+50: - name: logging
+51:   chart: charts/fluent-bit
+52: - name: front-proxy
+53:   chart: stable/envoy
+54: 
+
+first-pass produced: &{default map[] map[]}
+first-pass rendering result of "helmfile.yaml.part.0": {default map[] map[]}
+vals:
+map[]
+defaultVals:[]
+second-pass rendering result of "helmfile.yaml.part.0":
+ 0: 
+ 1: releases:
+ 2: - name: database
+ 3:   chart: charts/mysql
+ 4:   needs:
+ 5:   - logging
+ 6: - name: frontend-v1
+ 7:   chart: charts/frontend
+ 8:   installed: false
+ 9:   needs:
+10:   - servicemesh
+11:   - logging
+12:   - backend-v1
+13: - name: frontend-v2
+14:   chart: charts/frontend
+15:   needs:
+16:   - servicemesh
+17:   - logging
+18:   - backend-v2
+19: - name: frontend-v3
+20:   chart: charts/frontend
+21:   needs:
+22:   - servicemesh
+23:   - logging
+24:   - backend-v2
+25: - name: backend-v1
+26:   chart: charts/backend
+27:   installed: false
+28:   needs:
+29:   - servicemesh
+30:   - logging
+31:   - database
+32:   - anotherbackend
+33: - name: backend-v2
+34:   chart: charts/backend
+35:   needs:
+36:   - servicemesh
+37:   - logging
+38:   - database
+39:   - anotherbackend
+40: - name: anotherbackend
+41:   chart: charts/anotherbackend
+42:   needs:
+43:   - servicemesh
+44:   - logging
+45:   - database
+46: - name: servicemesh
+47:   chart: charts/istio
+48:   needs:
+49:   - logging
+50: - name: logging
+51:   chart: charts/fluent-bit
+52: - name: front-proxy
+53:   chart: stable/envoy
+54: 
+
+merged environment: &{default map[] map[]}
+1 release(s) matching name=logging found in helmfile.yaml
+
+processing 1 groups of releases in this order:
+GROUP RELEASES
+1     default//logging
+
+processing releases in group 1/1: default//logging
+release "logging" processed
+
+DELETED RELEASES:
+NAME
+logging
+`,
+		})
+	})
+
+	t.Run("destroy installed but disabled release", func(t *testing.T) {
+		check(t, testcase{
+			files: filesForTwoReleases,
+			diffs: map[exectest.DiffKey]error{},
+			lists: map[exectest.ListKey]string{
+				exectest.ListKey{Filter: "^frontend-v1$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+`,
+				exectest.ListKey{Filter: "^backend-v1$", Flags: helmV2ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+`,
+			},
+			// Disable concurrency to avoid in-deterministic result
+			concurrency: 1,
+			upgraded:    []exectest.Release{},
+			deleted: []exectest.Release{
+				{Name: "frontend-v1", Flags: []string{}},
+			},
+			log: `processing file "helmfile.yaml" in directory "."
+first-pass rendering starting for "helmfile.yaml.part.0": inherited=&{default map[] map[]}, overrode=<nil>
+first-pass uses: &{default map[] map[]}
+first-pass rendering output of "helmfile.yaml.part.0":
+ 0: 
+ 1: releases:
+ 2: - name: backend-v1
+ 3:   chart: charts/backend
+ 4:   installed: false
+ 5: - name: frontend-v1
+ 6:   chart: charts/frontend
+ 7:   needs:
+ 8:   - backend-v1
+ 9: 
+
+first-pass produced: &{default map[] map[]}
+first-pass rendering result of "helmfile.yaml.part.0": {default map[] map[]}
+vals:
+map[]
+defaultVals:[]
+second-pass rendering result of "helmfile.yaml.part.0":
+ 0: 
+ 1: releases:
+ 2: - name: backend-v1
+ 3:   chart: charts/backend
+ 4:   installed: false
+ 5: - name: frontend-v1
+ 6:   chart: charts/frontend
+ 7:   needs:
+ 8:   - backend-v1
+ 9: 
+
+merged environment: &{default map[] map[]}
+2 release(s) found in helmfile.yaml
+
+processing 2 groups of releases in this order:
+GROUP RELEASES
+1     default//frontend-v1
+2     default//backend-v1
+
+processing releases in group 1/2: default//frontend-v1
+release "frontend-v1" processed
+processing releases in group 2/2: default//backend-v1
+release "backend-v1" processed
+
+DELETED RELEASES:
+NAME
+frontend-v1
+backend-v1
+`,
+		})
+	})
+
+	t.Run("helm3", func(t *testing.T) {
+		check(t, testcase{
+			helm3: true,
+			files: filesForTwoReleases,
+			diffs: map[exectest.DiffKey]error{},
+			lists: map[exectest.ListKey]string{
+				exectest.ListKey{Filter: "^frontend-v1$", Flags: helmV3ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+`,
+				exectest.ListKey{Filter: "^backend-v1$", Flags: helmV3ListFlags}: `NAME	REVISION	UPDATED                 	STATUS  	CHART        	APP VERSION	NAMESPACE
+`,
+			},
+			// Disable concurrency to avoid in-deterministic result
+			concurrency: 1,
+			upgraded:    []exectest.Release{},
+			deleted: []exectest.Release{
+				{Name: "frontend-v1", Flags: []string{}},
+			},
+			log: `processing file "helmfile.yaml" in directory "."
+first-pass rendering starting for "helmfile.yaml.part.0": inherited=&{default map[] map[]}, overrode=<nil>
+first-pass uses: &{default map[] map[]}
+first-pass rendering output of "helmfile.yaml.part.0":
+ 0: 
+ 1: releases:
+ 2: - name: backend-v1
+ 3:   chart: charts/backend
+ 4:   installed: false
+ 5: - name: frontend-v1
+ 6:   chart: charts/frontend
+ 7:   needs:
+ 8:   - backend-v1
+ 9: 
+
+first-pass produced: &{default map[] map[]}
+first-pass rendering result of "helmfile.yaml.part.0": {default map[] map[]}
+vals:
+map[]
+defaultVals:[]
+second-pass rendering result of "helmfile.yaml.part.0":
+ 0: 
+ 1: releases:
+ 2: - name: backend-v1
+ 3:   chart: charts/backend
+ 4:   installed: false
+ 5: - name: frontend-v1
+ 6:   chart: charts/frontend
+ 7:   needs:
+ 8:   - backend-v1
+ 9: 
+
+merged environment: &{default map[] map[]}
+2 release(s) found in helmfile.yaml
+
+processing 2 groups of releases in this order:
+GROUP RELEASES
+1     default//frontend-v1
+2     default//backend-v1
+
+processing releases in group 1/2: default//frontend-v1
+release "frontend-v1" processed
+processing releases in group 2/2: default//backend-v1
+release "backend-v1" processed
+
+DELETED RELEASES:
+NAME
+frontend-v1
+backend-v1
+`,
+		})
+	})
+}

pkg/app/formatters.go

@@ -0,0 +1,33 @@
+package app
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/gosuri/uitable"
+)
+
+func FormatAsTable(releases []*HelmRelease) error {
+	table := uitable.New()
+	table.AddRow("NAME", "NAMESPACE", "ENABLED", "LABELS", "CHART", "VERSION")
+
+	for _, r := range releases {
+		table.AddRow(r.Name, r.Namespace, fmt.Sprintf("%t", r.Enabled), r.Labels, r.Chart, r.Version)
+	}
+
+	fmt.Println(table.String())
+
+	return nil
+}
+
+func FormatAsJson(releases []*HelmRelease) error {
+	output, err := json.Marshal(releases)
+
+	if err != nil {
+		return fmt.Errorf("error generating json: %v", err)
+	}
+
+	fmt.Println(string(output))
+
+	return nil
+}

pkg/app/load_opts.go

@@ -0,0 +1,34 @@
+package app
+
+import (
+	"github.com/roboll/helmfile/pkg/state"
+	"gopkg.in/yaml.v2"
+)
+
+type LoadOpts struct {
+	Selectors   []string
+	Environment state.SubhelmfileEnvironmentSpec
+
+	RetainValuesFiles bool
+
+	// CalleePath is the absolute path to the file being loaded
+	CalleePath string
+
+	Reverse bool
+
+	Filter bool
+}
+
+func (o LoadOpts) DeepCopy() LoadOpts {
+	bytes, err := yaml.Marshal(o)
+	if err != nil {
+		panic(err)
+	}
+
+	new := LoadOpts{}
+	if err := yaml.Unmarshal(bytes, &new); err != nil {
+		panic(err)
+	}
+
+	return new
+}

pkg/app/mocks_test.go

@@ -0,0 +1,114 @@
+package app
+
+import "github.com/roboll/helmfile/pkg/helmexec"
+
+type noCallHelmExec struct {
+}
+
+type versionOnlyHelmExec struct {
+	*noCallHelmExec
+	isHelm3 bool
+}
+
+func (helm *versionOnlyHelmExec) IsHelm3() bool {
+	return helm.isHelm3
+}
+
+func (helm *noCallHelmExec) doPanic() {
+	panic("unexpected call to helm")
+}
+
+func (helm *noCallHelmExec) TemplateRelease(name, chart string, flags ...string) error {
+	helm.doPanic()
+	return nil
+}
+func (helm *noCallHelmExec) ChartPull(chart string, flags ...string) error {
+	helm.doPanic()
+	return nil
+}
+func (helm *noCallHelmExec) ChartExport(chart string, path string, flags ...string) error {
+	helm.doPanic()
+	return nil
+}
+func (helm *noCallHelmExec) UpdateDeps(chart string) error {
+	helm.doPanic()
+	return nil
+}
+
+func (helm *noCallHelmExec) BuildDeps(name, chart string) error {
+	helm.doPanic()
+	return nil
+}
+
+func (helm *noCallHelmExec) SetExtraArgs(args ...string) {
+	helm.doPanic()
+	return
+}
+func (helm *noCallHelmExec) SetHelmBinary(bin string) {
+	helm.doPanic()
+	return
+}
+func (helm *noCallHelmExec) AddRepo(name, repository, cafile, certfile, keyfile, username, password string, managed string) error {
+	helm.doPanic()
+	return nil
+}
+func (helm *noCallHelmExec) UpdateRepo() error {
+	helm.doPanic()
+	return nil
+}
+func (helm *noCallHelmExec) RegistryLogin(name string, username string, password string) error {
+	helm.doPanic()
+	return nil
+}
+func (helm *noCallHelmExec) SyncRelease(context helmexec.HelmContext, name, chart string, flags ...string) error {
+	helm.doPanic()
+	return nil
+}
+func (helm *noCallHelmExec) DiffRelease(context helmexec.HelmContext, name, chart string, suppressDiff bool, flags ...string) error {
+	helm.doPanic()
+	return nil
+}
+func (helm *noCallHelmExec) ReleaseStatus(context helmexec.HelmContext, release string, flags ...string) error {
+	helm.doPanic()
+	return nil
+}
+func (helm *noCallHelmExec) DeleteRelease(context helmexec.HelmContext, name string, flags ...string) error {
+	helm.doPanic()
+	return nil
+}
+
+func (helm *noCallHelmExec) List(context helmexec.HelmContext, filter string, flags ...string) (string, error) {
+	helm.doPanic()
+	return "", nil
+}
+
+func (helm *noCallHelmExec) DecryptSecret(context helmexec.HelmContext, name string, flags ...string) (string, error) {
+	helm.doPanic()
+	return "", nil
+}
+func (helm *noCallHelmExec) TestRelease(context helmexec.HelmContext, name string, flags ...string) error {
+	helm.doPanic()
+	return nil
+}
+func (helm *noCallHelmExec) Fetch(chart string, flags ...string) error {
+	helm.doPanic()
+	return nil
+}
+func (helm *noCallHelmExec) Lint(name, chart string, flags ...string) error {
+	helm.doPanic()
+	return nil
+}
+func (helm *noCallHelmExec) IsHelm3() bool {
+	helm.doPanic()
+	return false
+}
+
+func (helm *noCallHelmExec) GetVersion() helmexec.Version {
+	helm.doPanic()
+	return helmexec.Version{}
+}
+
+func (helm *noCallHelmExec) IsVersionAtLeast(versionStr string) bool {
+	helm.doPanic()
+	return false
+}

pkg/app/run.go

@@ -0,0 +1,198 @@
+package app
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"sort"
+	"strings"
+
+	"github.com/roboll/helmfile/pkg/argparser"
+	"github.com/roboll/helmfile/pkg/helmexec"
+	"github.com/roboll/helmfile/pkg/state"
+)
+
+type Run struct {
+	state *state.HelmState
+	helm  helmexec.Interface
+	ctx   Context
+
+	ReleaseToChart map[state.PrepareChartKey]string
+
+	Ask func(string) bool
+}
+
+func NewRun(st *state.HelmState, helm helmexec.Interface, ctx Context) *Run {
+	if helm == nil {
+		panic("Assertion failed: helmexec.Interface must not be nil")
+	}
+
+	return &Run{state: st, helm: helm, ctx: ctx}
+}
+
+func (r *Run) askForConfirmation(msg string) bool {
+	if r.Ask != nil {
+		return r.Ask(msg)
+	}
+	return AskForConfirmation(msg)
+}
+
+func (r *Run) withPreparedCharts(helmfileCommand string, opts state.ChartPrepareOptions, f func()) error {
+	if r.ReleaseToChart != nil {
+		panic("Run.PrepareCharts can be called only once")
+	}
+
+	if !opts.SkipRepos {
+		ctx := r.ctx
+		if err := ctx.SyncReposOnce(r.state, r.helm); err != nil {
+			return err
+		}
+	}
+
+	// Create tmp directory and bail immediately if it fails
+	var dir string
+	if len(opts.OutputDir) == 0 {
+		tempDir, err := ioutil.TempDir("", "helmfile*")
+		if err != nil {
+			return err
+		}
+		defer os.RemoveAll(tempDir)
+		dir = tempDir
+	} else {
+		dir = opts.OutputDir
+		fmt.Printf("Charts will be downloaded to: %s\n", dir)
+	}
+
+	if _, err := r.state.TriggerGlobalPrepareEvent(helmfileCommand); err != nil {
+		return err
+	}
+
+	releaseToChart, errs := r.state.PrepareCharts(r.helm, dir, 2, helmfileCommand, opts)
+
+	if len(errs) > 0 {
+		return fmt.Errorf("%v", errs)
+	}
+
+	for i := range r.state.Releases {
+		rel := &r.state.Releases[i]
+
+		key := state.PrepareChartKey{
+			Name:        rel.Name,
+			Namespace:   rel.Namespace,
+			KubeContext: rel.KubeContext,
+		}
+		if chart := releaseToChart[key]; chart != "" {
+			rel.Chart = chart
+		}
+	}
+
+	r.ReleaseToChart = releaseToChart
+
+	f()
+
+	_, err := r.state.TriggerGlobalCleanupEvent(helmfileCommand)
+
+	return err
+}
+
+func (r *Run) Deps(c DepsConfigProvider) []error {
+	r.helm.SetExtraArgs(argparser.GetArgs(c.Args(), r.state)...)
+
+	return r.state.UpdateDeps(r.helm)
+}
+
+func (r *Run) Repos(c ReposConfigProvider) error {
+	r.helm.SetExtraArgs(argparser.GetArgs(c.Args(), r.state)...)
+
+	return r.ctx.SyncReposOnce(r.state, r.helm)
+}
+
+func (r *Run) DeprecatedSyncCharts(c DeprecatedChartsConfigProvider) []error {
+	st := r.state
+	helm := r.helm
+
+	affectedReleases := state.AffectedReleases{}
+	errs := st.SyncReleases(&affectedReleases, helm, c.Values(), c.Concurrency())
+	affectedReleases.DisplayAffectedReleases(c.Logger())
+	return errs
+}
+
+func (r *Run) diff(triggerCleanupEvent bool, detailedExitCode bool, c DiffConfigProvider, diffOpts *state.DiffOpts) (*string, map[string]state.ReleaseSpec, map[string]state.ReleaseSpec, []error) {
+	st := r.state
+	helm := r.helm
+
+	var changedReleases []state.ReleaseSpec
+	var deletingReleases []state.ReleaseSpec
+	var planningErrs []error
+
+	// TODO Better way to detect diff on only filtered releases
+	{
+		changedReleases, planningErrs = st.DiffReleases(helm, c.Values(), c.Concurrency(), detailedExitCode, c.IncludeTests(), c.SuppressSecrets(), c.ShowSecrets(), c.SuppressDiff(), triggerCleanupEvent, diffOpts)
+
+		var err error
+		deletingReleases, err = st.DetectReleasesToBeDeletedForSync(helm, st.Releases)
+		if err != nil {
+			planningErrs = append(planningErrs, err)
+		}
+	}
+
+	fatalErrs := []error{}
+
+	for _, e := range planningErrs {
+		switch err := e.(type) {
+		case *state.ReleaseError:
+			if err.Code != 2 {
+				fatalErrs = append(fatalErrs, e)
+			}
+		default:
+			fatalErrs = append(fatalErrs, e)
+		}
+	}
+
+	if len(fatalErrs) > 0 {
+		return nil, nil, nil, fatalErrs
+	}
+
+	releasesToBeDeleted := map[string]state.ReleaseSpec{}
+	for _, r := range deletingReleases {
+		id := state.ReleaseToID(&r)
+		releasesToBeDeleted[id] = r
+	}
+
+	releasesToBeUpdated := map[string]state.ReleaseSpec{}
+	for _, r := range changedReleases {
+		id := state.ReleaseToID(&r)
+
+		// If `helm-diff` detected changes but it is not being `helm delete`ed, we should run `helm upgrade`
+		if _, ok := releasesToBeDeleted[id]; !ok {
+			releasesToBeUpdated[id] = r
+		}
+	}
+
+	// sync only when there are changes
+	if len(releasesToBeUpdated) == 0 && len(releasesToBeDeleted) == 0 {
+		var msg *string
+		if c.DetailedExitcode() {
+			// TODO better way to get the logger
+			m := "No affected releases"
+			msg = &m
+		}
+		return msg, nil, nil, nil
+	}
+
+	names := []string{}
+	for _, r := range releasesToBeUpdated {
+		names = append(names, fmt.Sprintf("  %s (%s) UPDATED", r.Name, r.Chart))
+	}
+	for _, r := range releasesToBeDeleted {
+		names = append(names, fmt.Sprintf("  %s (%s) DELETED", r.Name, r.Chart))
+	}
+	// Make the output deterministic for testing purpose
+	sort.Strings(names)
+
+	infoMsg := fmt.Sprintf(`Affected releases are:
+%s
+`, strings.Join(names, "\n"))
+
+	return &infoMsg, releasesToBeUpdated, releasesToBeDeleted, nil
+}

pkg/app/snapshot_test.go

@@ -0,0 +1,65 @@
+package app
+
+import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func assertEqualsToSnapshot(t *testing.T, name string, data string) {
+	type thisPkgLocator struct{}
+
+	t.Helper()
+
+	snapshotFileName := snapshotFileName(t, name)
+
+	if os.Getenv("HELMFILE_UPDATE_SNAPSHOT") != "" {
+		update(t, snapshotFileName, []byte(data))
+
+		return
+	}
+
+	wantData, err := ioutil.ReadFile(snapshotFileName)
+	if err != nil {
+		t.Fatalf(
+			"Snapshot file %q does not exist. Rerun this test with `HELMFILE_UPDATE_SNAPSHOT=1 go test -v -run %s %s` to create the snapshot",
+			snapshotFileName,
+			t.Name(),
+			reflect.TypeOf(thisPkgLocator{}).PkgPath(),
+		)
+	}
+
+	want := string(wantData)
+
+	if d := cmp.Diff(want, data); d != "" {
+		t.Errorf("unexpected %s: want (-), got (+): %s", name, d)
+		t.Errorf(
+			"If you think this is due to the snapshot file being outdated, rerun this test with `HELMFILE_UPDATE_SNAPSHOT=1 go test -v -run %s %s` to update the snapshot",
+			t.Name(),
+			reflect.TypeOf(thisPkgLocator{}).PkgPath(),
+		)
+	}
+}
+
+func update(t *testing.T, snapshotFileName string, data []byte) {
+	t.Helper()
+
+	if err := os.MkdirAll(filepath.Dir(snapshotFileName), 0755); err != nil {
+		t.Fatalf("%v", err)
+	}
+
+	if err := ioutil.WriteFile(snapshotFileName, data, 0644); err != nil {
+		t.Fatalf("%v", err)
+	}
+}
+
+func snapshotFileName(t *testing.T, name string) string {
+	dir := filepath.Join(strings.Split(strings.ToLower(t.Name()), "/")...)
+
+	return filepath.Join("testdata", dir, name)
+}

pkg/app/testdata/testapply_2/deduplicate_by_--selector/log

@@ -0,0 +1,65 @@
+processing file "helmfile.yaml" in directory "."
+first-pass rendering starting for "helmfile.yaml.part.0": inherited=&{default map[] map[]}, overrode=<nil>
+first-pass uses: &{default map[] map[]}
+first-pass rendering output of "helmfile.yaml.part.0":
+ 0: 
+ 1: releases:
+ 2: - name: foo
+ 3:   chart: incubator/raw
+ 4:   namespace: default
+ 5:   labels:
+ 6:     app: test
+ 7:     component: raw
+ 8:     index: '1'
+ 9: 
+10: - name: foo
+11:   chart: incubator/raw
+12:   namespace: default
+13:   labels:
+14:     app: test
+15:     component: raw
+16:     index: '2'
+17: 
+
+first-pass produced: &{default map[] map[]}
+first-pass rendering result of "helmfile.yaml.part.0": {default map[] map[]}
+vals:
+map[]
+defaultVals:[]
+second-pass rendering result of "helmfile.yaml.part.0":
+ 0: 
+ 1: releases:
+ 2: - name: foo
+ 3:   chart: incubator/raw
+ 4:   namespace: default
+ 5:   labels:
+ 6:     app: test
+ 7:     component: raw
+ 8:     index: '1'
+ 9: 
+10: - name: foo
+11:   chart: incubator/raw
+12:   namespace: default
+13:   labels:
+14:     app: test
+15:     component: raw
+16:     index: '2'
+17: 
+
+merged environment: &{default map[] map[]}
+1 release(s) matching index=1 found in helmfile.yaml
+
+Affected releases are:
+  foo (incubator/raw) UPDATED
+
+processing 1 groups of releases in this order:
+GROUP RELEASES
+1     default/default/foo
+
+processing releases in group 1/1: default/default/foo
+getting deployed release version failed:unexpected list key: {^foo$ --kube-contextdefault--deleting--deployed--failed--pending}
+
+UPDATED RELEASES:
+NAME   CHART           VERSION
+foo    incubator/raw          
+

pkg/app/two_pass_renderer.go

@@ -3,12 +3,12 @@ package app
 import (
 	"bytes"
 	"fmt"
-	"github.com/roboll/helmfile/environment"
-	"github.com/roboll/helmfile/state"
-	"github.com/roboll/helmfile/tmpl"
-	"go.uber.org/zap"
-	"path/filepath"
 	"strings"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/roboll/helmfile/pkg/environment"
+	"github.com/roboll/helmfile/pkg/state"
+	"github.com/roboll/helmfile/pkg/tmpl"
 )
 
 func prependLineNumbers(text string) string {
@@ -20,61 +20,128 @@ func prependLineNumbers(text string) string {
 	return buf.String()
 }
 
-type twoPassRenderer struct {
-	reader    func(string) ([]byte, error)
-	env       string
-	namespace string
-	filename  string
-	logger    *zap.SugaredLogger
-	abs       func(string) (string, error)
-}
-
-func (r *twoPassRenderer) renderEnvironment(content []byte) environment.Environment {
-	firstPassEnv := environment.Environment{Name: r.env, Values: map[string]interface{}(nil)}
-	tmplData := state.EnvironmentTemplateData{Environment: firstPassEnv, Namespace: r.namespace}
-	firstPassRenderer := tmpl.NewFirstPassRenderer(filepath.Dir(r.filename), tmplData)
+func (r *desiredStateLoader) renderPrestate(firstPassEnv *environment.Environment, baseDir, filename string, content []byte) (*environment.Environment, *state.HelmState) {
+	tmplData := state.EnvironmentTemplateData{
+		Environment: *firstPassEnv,
+		Namespace:   r.namespace,
+		Values:      map[string]interface{}{},
+	}
+	firstPassRenderer := tmpl.NewFirstPassRenderer(baseDir, tmplData)
 
 	// parse as much as we can, tolerate errors, this is a preparse
 	yamlBuf, err := firstPassRenderer.RenderTemplateContentToBuffer(content)
 	if err != nil && r.logger != nil {
-		r.logger.Debugf("first-pass rendering input of \"%s\":\n%s", r.filename, prependLineNumbers(string(content)))
+		r.logger.Debugf("first-pass rendering input of \"%s\":\n%s", filename, prependLineNumbers(string(content)))
+		r.logger.Debugf("template syntax error: %v", err)
 		if yamlBuf == nil { // we have a template syntax error, let the second parse report
-			r.logger.Debugf("template syntax error: %v", err)
-			return firstPassEnv
+			return firstPassEnv, nil
 		}
 	}
-	c := state.NewCreator(r.logger, r.reader, r.abs)
+	yamlData := yamlBuf.String()
+	if r.logger != nil {
+		r.logger.Debugf("first-pass rendering output of \"%s\":\n%s", filename, prependLineNumbers(yamlData))
+	}
+
+	// Work-around for https://github.com/golang/go/issues/24963
+	sanitized := strings.ReplaceAll(yamlData, "<no value>", "")
+
+	if len(yamlData) != len(sanitized) {
+		msg := "replaced <no value>s to workaround https://github.com/golang/go/issues/24963 to address https://github.com/roboll/helmfile/issues/553:\n%s"
+		r.logger.Debugf(msg, cmp.Diff(yamlData, sanitized))
+	}
+
+	c := r.underlying()
 	c.Strict = false
 	// create preliminary state, as we may have an environment. Tolerate errors.
-	prestate, err := c.CreateFromYaml(yamlBuf.Bytes(), r.filename, r.env)
+	prestate, err := c.ParseAndLoad([]byte(sanitized), baseDir, filename, r.env, false, firstPassEnv)
 	if err != nil && r.logger != nil {
 		switch err.(type) {
 		case *state.StateLoadError:
-			r.logger.Infof("could not deduce `environment:` block, configuring only .Environment.Name. error: %v", err)
+			r.logger.Debugf("could not deduce `environment:` block, configuring only .Environment.Name. error: %v", err)
 		}
-		r.logger.Debugf("error in first-pass rendering: result of \"%s\":\n%s", r.filename, prependLineNumbers(yamlBuf.String()))
+		r.logger.Debugf("error in first-pass rendering: result of \"%s\":\n%s", filename, prependLineNumbers(yamlBuf.String()))
 	}
+
 	if prestate != nil {
-		firstPassEnv = prestate.Env
+		firstPassEnv = &prestate.Env
 	}
-	return firstPassEnv
+
+	return firstPassEnv, prestate
 }
 
-func (r *twoPassRenderer) renderTemplate(content []byte) (*bytes.Buffer, error) {
-	// try a first pass render. This will always succeed, but can produce a limited env
-	firstPassEnv := r.renderEnvironment(content)
+type RenderOpts struct {
+}
 
-	tmplData := state.EnvironmentTemplateData{Environment: firstPassEnv, Namespace: r.namespace}
-	secondPassRenderer := tmpl.NewFileRenderer(r.reader, filepath.Dir(r.filename), tmplData)
+func (r *desiredStateLoader) renderTemplatesToYaml(baseDir, filename string, content []byte) (*bytes.Buffer, error) {
+	env := &environment.Environment{Name: r.env, Values: map[string]interface{}(nil)}
+
+	return r.renderTemplatesToYamlWithEnv(baseDir, filename, content, env, nil)
+}
+
+func (r *desiredStateLoader) renderTemplatesToYamlWithEnv(baseDir, filename string, content []byte, inherited, overrode *environment.Environment) (*bytes.Buffer, error) {
+	return r.twoPassRenderTemplateToYaml(inherited, overrode, baseDir, filename, content)
+}
+
+func (r *desiredStateLoader) twoPassRenderTemplateToYaml(inherited, overrode *environment.Environment, baseDir, filename string, content []byte) (*bytes.Buffer, error) {
+	// try a first pass render. This will always succeed, but can produce a limited env
+	if r.logger != nil {
+		r.logger.Debugf("first-pass rendering starting for \"%s\": inherited=%v, overrode=%v", filename, inherited, overrode)
+	}
+
+	initEnv, err := inherited.Merge(overrode)
+	if err != nil {
+		return nil, err
+	}
+
+	if r.logger != nil {
+		r.logger.Debugf("first-pass uses: %v", initEnv)
+	}
+
+	renderedEnv, prestate := r.renderPrestate(initEnv, baseDir, filename, content)
+
+	if r.logger != nil {
+		r.logger.Debugf("first-pass produced: %v", renderedEnv)
+	}
+
+	finalEnv, err := inherited.Merge(renderedEnv)
+	if err != nil {
+		return nil, err
+	}
+
+	finalEnv, err = finalEnv.Merge(overrode)
+	if err != nil {
+		return nil, err
+	}
+
+	if r.logger != nil {
+		r.logger.Debugf("first-pass rendering result of \"%s\": %v", filename, *finalEnv)
+	}
+
+	vals, err := finalEnv.GetMergedValues()
+	if err != nil {
+		return nil, err
+	}
+
+	if prestate != nil {
+		prestate.Env = *finalEnv
+		r.logger.Debugf("vals:\n%v\ndefaultVals:%v", vals, prestate.DefaultValues)
+	}
+
+	tmplData := state.EnvironmentTemplateData{
+		Environment: *finalEnv,
+		Namespace:   r.namespace,
+		Values:      vals,
+	}
+	secondPassRenderer := tmpl.NewFileRenderer(r.readFile, baseDir, tmplData)
 	yamlBuf, err := secondPassRenderer.RenderTemplateContentToBuffer(content)
 	if err != nil {
 		if r.logger != nil {
-			r.logger.Debugf("second-pass rendering failed, input of \"%s\":\n%s", r.filename, prependLineNumbers(string(content)))
+			r.logger.Debugf("second-pass rendering failed, input of \"%s\":\n%s", filename, prependLineNumbers(string(content)))
 		}
 		return nil, err
 	}
 	if r.logger != nil {
-		r.logger.Debugf("second-pass rendering result of \"%s\":\n%s", r.filename, prependLineNumbers(yamlBuf.String()))
+		r.logger.Debugf("second-pass rendering result of \"%s\":\n%s", filename, prependLineNumbers(yamlBuf.String()))
 	}
 	return yamlBuf, nil
 }

pkg/app/two_pass_renderer_test.go

@@ -1,26 +1,32 @@
 package app
 
 import (
-	"fmt"
+	"github.com/roboll/helmfile/pkg/remote"
 	"os"
-	"path/filepath"
 	"strings"
 	"testing"
 
-	"github.com/roboll/helmfile/helmexec"
-	"github.com/roboll/helmfile/state"
+	"github.com/roboll/helmfile/pkg/helmexec"
+	"github.com/roboll/helmfile/pkg/state"
+	"github.com/roboll/helmfile/pkg/testhelper"
+
 	"gopkg.in/yaml.v2"
 )
 
-func makeRenderer(readFile func(string) ([]byte, error), env string) *twoPassRenderer {
-	return &twoPassRenderer{
-		reader:    readFile,
-		env:       env,
-		namespace: "namespace",
-		filename:  "",
-		logger:    helmexec.NewLogger(os.Stdout, "debug"),
-		abs:       filepath.Abs,
-	}
+func makeLoader(files map[string]string, env string) (*desiredStateLoader, *testhelper.TestFs) {
+	testfs := testhelper.NewTestFs(files)
+	logger := helmexec.NewLogger(os.Stdout, "debug")
+	r := remote.NewRemote(logger, testfs.Cwd, testfs.ReadFile, testfs.DirectoryExistsAt, testfs.FileExistsAt)
+	return &desiredStateLoader{
+		env:        env,
+		namespace:  "namespace",
+		logger:     helmexec.NewLogger(os.Stdout, "debug"),
+		readFile:   testfs.ReadFile,
+		fileExists: testfs.FileExists,
+		abs:        testfs.Abs,
+		glob:       testfs.Glob,
+		remote:     r,
+	}, testfs
 }
 
 func TestReadFromYaml_MakeEnvironmentHasNoSideEffects(t *testing.T) {
@@ -37,30 +43,21 @@ releases:
   chart: mychart1
 `)
 
-	fileReaderCalls := 0
-	// make a reader that returns a simulated context
-	fileReader := func(filename string) ([]byte, error) {
-		expectedFilename := filepath.Clean("default/values.yaml")
-		if !strings.HasSuffix(filename, expectedFilename) {
-			return nil, fmt.Errorf("unexpected filename: expected=%s, actual=%s", expectedFilename, filename)
-		}
-		fileReaderCalls++
-		if fileReaderCalls == 2 {
-			return []byte("SecondPass"), nil
-		}
-		return []byte(""), nil
+	files := map[string]string{
+		"/path/to/default/values.yaml":       ``,
+		"/path/to/other/default/values.yaml": `SecondPass`,
 	}
 
-	r := makeRenderer(fileReader, "staging")
-	yamlBuf, err := r.renderTemplate(yamlContent)
+	r, testfs := makeLoader(files, "staging")
+	yamlBuf, err := r.renderTemplatesToYaml("", "", yamlContent)
 	if err != nil {
-		t.Errorf("unexpected error: %v", err)
+		t.Fatalf("unexpected error: %v", err)
 	}
 
 	var state state.HelmState
 	err = yaml.Unmarshal(yamlBuf.Bytes(), &state)
 
-	if fileReaderCalls > 2 {
+	if testfs.FileReaderCalls() > 2 {
 		t.Error("reader should be called only twice")
 	}
 
@@ -71,10 +68,10 @@ releases:
 
 func TestReadFromYaml_RenderTemplate(t *testing.T) {
 
-	defaultValuesYaml := []byte(`
+	defaultValuesYaml := `
 releaseName: "hello"
 conditionalReleaseTag: "yes"
-`)
+`
 
 	yamlContent := []byte(`
 environments:
@@ -93,18 +90,13 @@ releases:
 
 `)
 
-	// make a reader that returns a simulated context
-	fileReader := func(filename string) ([]byte, error) {
-		expectedFilename := filepath.Clean("default/values.yaml")
-		if !strings.HasSuffix(filename, expectedFilename) {
-			return nil, fmt.Errorf("unexpected filename: expected=%s, actual=%s", expectedFilename, filename)
-		}
-		return defaultValuesYaml, nil
+	files := map[string]string{
+		"/path/to/default/values.yaml": defaultValuesYaml,
 	}
 
-	r := makeRenderer(fileReader, "staging")
+	r, _ := makeLoader(files, "staging")
 	// test the double rendering
-	yamlBuf, err := r.renderTemplate(yamlContent)
+	yamlBuf, err := r.renderTemplatesToYaml("", "", yamlContent)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -130,7 +122,7 @@ releases:
 }
 
 func TestReadFromYaml_RenderTemplateWithValuesReferenceError(t *testing.T) {
-	defaultValuesYaml := []byte("")
+	defaultValuesYaml := ``
 
 	yamlContent := []byte(`
 environments:
@@ -146,14 +138,13 @@ releases:
 {{ end }}
 `)
 
-	// make a reader that returns a simulated context
-	fileReader := func(filename string) ([]byte, error) {
-		return defaultValuesYaml, nil
+	files := map[string]string{
+		"/path/to/default/values.yaml": defaultValuesYaml,
 	}
 
-	r := makeRenderer(fileReader, "staging")
+	r, _ := makeLoader(files, "staging")
 	// test the double rendering
-	_, err := r.renderTemplate(yamlContent)
+	_, err := r.renderTemplatesToYaml("", "", yamlContent)
 
 	if !strings.Contains(err.Error(), "stringTemplate:8") {
 		t.Fatalf("error should contain a stringTemplate error (reference to unknow key) %v", err)
@@ -165,9 +156,9 @@ releases:
 // This does not apply to .gotmpl files, which is a nice side-effect.
 func TestReadFromYaml_RenderTemplateWithGotmpl(t *testing.T) {
 
-	defaultValuesYamlGotmpl := []byte(`
+	defaultValuesYamlGotmpl := `
 releaseName: {{ readFile "nonIgnoredFile" }}
-`)
+`
 
 	yamlContent := []byte(`
 environments:
@@ -183,15 +174,13 @@ releases:
 {{ end }}
 `)
 
-	fileReader := func(filename string) ([]byte, error) {
-		if strings.HasSuffix(filename, "nonIgnoredFile") {
-			return []byte("release-a"), nil
-		}
-		return defaultValuesYamlGotmpl, nil
+	files := map[string]string{
+		"/path/to/nonIgnoredFile":     `release-a`,
+		"/path/to/values.yaml.gotmpl": defaultValuesYamlGotmpl,
 	}
 
-	r := makeRenderer(fileReader, "staging")
-	rendered, _ := r.renderTemplate(yamlContent)
+	r, _ := makeLoader(files, "staging")
+	rendered, _ := r.renderTemplatesToYaml("", "", yamlContent)
 
 	var state state.HelmState
 	yaml.Unmarshal(rendered.Bytes(), &state)
@@ -206,19 +195,15 @@ releases:
 }
 
 func TestReadFromYaml_RenderTemplateWithNamespace(t *testing.T) {
-	defaultValuesYaml := []byte(``)
 	yamlContent := []byte(`releases:
 - name: {{ .Namespace }}-myrelease
   chart: mychart
 `)
 
-	// make a reader that returns a simulated context
-	fileReader := func(filename string) ([]byte, error) {
-		return defaultValuesYaml, nil
-	}
+	files := map[string]string{}
 
-	r := makeRenderer(fileReader, "staging")
-	yamlBuf, err := r.renderTemplate(yamlContent)
+	r, _ := makeLoader(files, "staging")
+	yamlBuf, err := r.renderTemplatesToYaml("", "", yamlContent)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -231,7 +216,7 @@ func TestReadFromYaml_RenderTemplateWithNamespace(t *testing.T) {
 	}
 }
 
-func TestReadFromYaml_HelfileShouldBeResilentToTemplateErrors(t *testing.T) {
+func TestReadFromYaml_HelmfileShouldBeResilentToTemplateErrors(t *testing.T) {
 	yamlContent := []byte(`environments:
   staging:
 	production:
@@ -244,12 +229,9 @@ releases:
 {{ end }}
   chart: mychart
 `)
-	fileReader := func(filename string) ([]byte, error) {
-		return yamlContent, nil
-	}
 
-	r := makeRenderer(fileReader, "staging")
-	_, err := r.renderTemplate(yamlContent)
+	r, _ := makeLoader(map[string]string{}, "staging")
+	_, err := r.renderTemplatesToYaml("", "", yamlContent)
 	if err == nil {
 		t.Fatalf("wanted error, none returned")
 	}

pkg/app/version/version.go

@@ -0,0 +1,3 @@
+package version
+
+var Version string

pkg/argparser/args.go

@@ -1,10 +1,9 @@
-package args
+package argparser
 
 import (
 	"fmt"
+	"github.com/roboll/helmfile/pkg/state"
 	"strings"
-
-	"github.com/roboll/helmfile/state"
 )
 
 type keyVal struct {
@@ -83,10 +82,6 @@ func GetArgs(args string, state *state.HelmState) []string {
 		}
 	}
 
-	if state.HelmDefaults.KubeContext != "" {
-		argsMap.SetArg("--kube-context", state.HelmDefaults.KubeContext, false)
-	}
-
 	var argArr []string
 
 	for _, flag := range argsMap.flags {

pkg/argparser/args_test.go

@@ -1,20 +1,23 @@
-package args
+package argparser
 
 import (
+	"github.com/roboll/helmfile/pkg/state"
 	"strings"
 	"testing"
-
-	"github.com/roboll/helmfile/state"
 )
 
 func TestGetArgs(t *testing.T) {
 	args := "--timeout=3600 --set app1.bootstrap=true --set app2.bootstrap=false --tiller-namespace ns"
 	defaultArgs := []string{"--recreate-pods", "--force"}
 	Helmdefaults := state.HelmSpec{KubeContext: "test", TillerNamespace: "test-namespace", Args: defaultArgs}
-	testState := &state.HelmState{HelmDefaults: Helmdefaults}
+	testState := &state.HelmState{
+		ReleaseSetSpec: state.ReleaseSetSpec{
+			HelmDefaults: Helmdefaults,
+		},
+	}
 	receivedArgs := GetArgs(args, testState)
 
-	expectedOutput := "--timeout=3600 --set app1.bootstrap=true --set app2.bootstrap=false --tiller-namespace ns --recreate-pods --force --kube-context=test"
+	expectedOutput := "--timeout=3600 --set app1.bootstrap=true --set app2.bootstrap=false --tiller-namespace ns --recreate-pods --force"
 
 	if compareArgs(expectedOutput, receivedArgs) == false {
 		t.Errorf("expected %s, got %s", expectedOutput, strings.Join(receivedArgs, " "))
@@ -25,10 +28,14 @@ func Test2(t *testing.T) {
 	args := "--timeout=3600 --set app1.bootstrap=true --set app2.bootstrap=false,app3.bootstrap=true --tiller-namespace ns"
 	defaultArgs := []string{"--recreate-pods", "--force"}
 	Helmdefaults := state.HelmSpec{KubeContext: "test", TillerNamespace: "test-namespace", Args: defaultArgs}
-	testState := &state.HelmState{HelmDefaults: Helmdefaults}
+	testState := &state.HelmState{
+		ReleaseSetSpec: state.ReleaseSetSpec{
+			HelmDefaults: Helmdefaults,
+		},
+	}
 	receivedArgs := GetArgs(args, testState)
 
-	expectedOutput := "--timeout=3600 --set app1.bootstrap=true --set app2.bootstrap=false,app3.bootstrap=true --tiller-namespace ns --recreate-pods --force --kube-context=test"
+	expectedOutput := "--timeout=3600 --set app1.bootstrap=true --set app2.bootstrap=false,app3.bootstrap=true --tiller-namespace ns --recreate-pods --force"
 
 	if compareArgs(expectedOutput, receivedArgs) == false {
 		t.Errorf("expected %s, got %s", expectedOutput, strings.Join(receivedArgs, " "))

pkg/environment/environment.go

@@ -0,0 +1,85 @@
+package environment
+
+import (
+	"github.com/imdario/mergo"
+	"github.com/roboll/helmfile/pkg/maputil"
+	"gopkg.in/yaml.v2"
+)
+
+type Environment struct {
+	Name     string
+	Values   map[string]interface{}
+	Defaults map[string]interface{}
+}
+
+var EmptyEnvironment Environment
+
+func (e Environment) DeepCopy() Environment {
+	valuesBytes, err := yaml.Marshal(e.Values)
+	if err != nil {
+		panic(err)
+	}
+	var values map[string]interface{}
+	if err := yaml.Unmarshal(valuesBytes, &values); err != nil {
+		panic(err)
+	}
+	values, err = maputil.CastKeysToStrings(values)
+	if err != nil {
+		panic(err)
+	}
+
+	defaultsBytes, err := yaml.Marshal(e.Defaults)
+	if err != nil {
+		panic(err)
+	}
+	var defaults map[string]interface{}
+	if err := yaml.Unmarshal(defaultsBytes, &defaults); err != nil {
+		panic(err)
+	}
+	defaults, err = maputil.CastKeysToStrings(defaults)
+	if err != nil {
+		panic(err)
+	}
+
+	return Environment{
+		Name:     e.Name,
+		Values:   values,
+		Defaults: defaults,
+	}
+}
+
+func (e *Environment) Merge(other *Environment) (*Environment, error) {
+	if e == nil {
+		if other != nil {
+			copy := other.DeepCopy()
+			return &copy, nil
+		}
+		return nil, nil
+	}
+	copy := e.DeepCopy()
+	if other != nil {
+		if err := mergo.Merge(&copy, other, mergo.WithOverride, mergo.WithOverwriteWithEmptyValue); err != nil {
+			return nil, err
+		}
+	}
+	return &copy, nil
+}
+
+func (e *Environment) GetMergedValues() (map[string]interface{}, error) {
+	vals := map[string]interface{}{}
+
+	if err := mergo.Merge(&vals, e.Defaults, mergo.WithOverride, mergo.WithOverwriteWithEmptyValue); err != nil {
+		return nil, err
+	}
+
+	if err := mergo.Merge(&vals, e.Values, mergo.WithOverride, mergo.WithOverwriteWithEmptyValue); err != nil {
+		return nil, err
+	}
+
+	vals, err := maputil.CastKeysToStrings(vals)
+	if err != nil {
+		return nil, err
+	}
+
+	return vals, nil
+}

pkg/environment/environment_test.go

@@ -0,0 +1,98 @@
+package environment
+
+import (
+	"github.com/google/go-cmp/cmp"
+	"testing"
+)
+
+// See https://github.com/roboll/helmfile/issues/1150
+func TestMerge_OverwriteNilValue_Issue1150(t *testing.T) {
+	dst := &Environment{
+		Name: "dst",
+		Values: map[string]interface{}{
+			"components": map[string]interface{}{
+				"etcd-operator": nil,
+			},
+		},
+		Defaults: nil,
+	}
+
+	src := &Environment{
+		Name: "src",
+		Values: map[string]interface{}{
+			"components": map[string]interface{}{
+				"etcd-operator": map[string]interface{}{
+					"version": "0.10.3",
+				},
+			},
+		},
+		Defaults: nil,
+	}
+
+	merged, err := dst.Merge(src)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	actual := merged.Values
+
+	expected := map[string]interface{}{
+		"components": map[string]interface{}{
+			"etcd-operator": map[string]interface{}{
+				"version": "0.10.3",
+			},
+		},
+	}
+
+	if diff := cmp.Diff(expected, actual); diff != "" {
+		t.Errorf(diff)
+	}
+}
+
+// See https://github.com/roboll/helmfile/issues/1154
+func TestMerge_OverwriteWithNilValue_Issue1154(t *testing.T) {
+	dst := &Environment{
+		Name: "dst",
+		Values: map[string]interface{}{
+			"components": map[string]interface{}{
+				"etcd-operator": map[string]interface{}{
+					"version": "0.10.0",
+				},
+			},
+		},
+		Defaults: nil,
+	}
+
+	src := &Environment{
+		Name: "src",
+		Values: map[string]interface{}{
+			"components": map[string]interface{}{
+				"etcd-operator": map[string]interface{}{
+					"version": "0.10.3",
+				},
+				"prometheus": nil,
+			},
+		},
+		Defaults: nil,
+	}
+
+	merged, err := dst.Merge(src)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	actual := merged.Values
+
+	expected := map[string]interface{}{
+		"components": map[string]interface{}{
+			"etcd-operator": map[string]interface{}{
+				"version": "0.10.3",
+			},
+			"prometheus": nil,
+		},
+	}
+
+	if diff := cmp.Diff(expected, actual); diff != "" {
+		t.Errorf(diff)
+	}
+}

pkg/event/bus.go

@@ -0,0 +1,134 @@
+package event
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/roboll/helmfile/pkg/environment"
+	"github.com/roboll/helmfile/pkg/helmexec"
+	"github.com/roboll/helmfile/pkg/tmpl"
+	"go.uber.org/zap"
+)
+
+type Hook struct {
+	Name     string            `yaml:"name"`
+	Events   []string          `yaml:"events"`
+	Command  string            `yaml:"command"`
+	Kubectl  map[string]string `yaml:"kubectlApply,omitempty"`
+	Args     []string          `yaml:"args"`
+	ShowLogs bool              `yaml:"showlogs"`
+}
+
+type event struct {
+	Name  string
+	Error error
+}
+
+type Bus struct {
+	Runner helmexec.Runner
+	Hooks  []Hook
+
+	BasePath      string
+	StateFilePath string
+	Namespace     string
+	Chart         string
+
+	Env environment.Environment
+
+	ReadFile func(string) ([]byte, error)
+	Logger   *zap.SugaredLogger
+}
+
+func (bus *Bus) Trigger(evt string, evtErr error, context map[string]interface{}) (bool, error) {
+	if bus.Runner == nil {
+		bus.Runner = helmexec.ShellRunner{
+			Dir:    bus.BasePath,
+			Logger: bus.Logger,
+		}
+	}
+
+	executed := false
+
+	for _, hook := range bus.Hooks {
+		contained := false
+		for _, e := range hook.Events {
+			contained = contained || e == evt
+		}
+		if !contained {
+			continue
+		}
+
+		var err error
+
+		name := hook.Name
+		if name == "" {
+			if hook.Kubectl != nil {
+				name = "kubectlApply"
+			} else {
+				name = hook.Command
+			}
+		}
+
+		if hook.Kubectl != nil {
+			if hook.Command != "" {
+				bus.Logger.Warnf("warn: ignoring command '%s' given within a kubectlApply hook", hook.Command)
+			}
+			hook.Command = "kubectl"
+			if val, found := hook.Kubectl["filename"]; found {
+				if _, found := hook.Kubectl["kustomize"]; found {
+					return false, fmt.Errorf("hook[%s]: kustomize & filename cannot be used together", name)
+				}
+				hook.Args = append([]string{"apply", "-f"}, val)
+			} else if val, found := hook.Kubectl["kustomize"]; found {
+				hook.Args = append([]string{"apply", "-k"}, val)
+			} else {
+				return false, fmt.Errorf("hook[%s]: either kustomize or filename must be given", name)
+			}
+		}
+
+		bus.Logger.Debugf("hook[%s]: stateFilePath=%s, basePath=%s\n", name, bus.StateFilePath, bus.BasePath)
+
+		data := map[string]interface{}{
+			"Environment": bus.Env,
+			"Namespace":   bus.Namespace,
+			"Event": event{
+				Name:  evt,
+				Error: evtErr,
+			},
+		}
+		for k, v := range context {
+			data[k] = v
+		}
+		render := tmpl.NewTextRenderer(bus.ReadFile, bus.BasePath, data)
+
+		bus.Logger.Debugf("hook[%s]: triggered by event \"%s\"\n", name, evt)
+
+		command, err := render.RenderTemplateText(hook.Command)
+		if err != nil {
+			return false, fmt.Errorf("hook[%s]: %v", name, err)
+		}
+
+		args := make([]string, len(hook.Args))
+		for i, raw := range hook.Args {
+			args[i], err = render.RenderTemplateText(raw)
+			if err != nil {
+				return false, fmt.Errorf("hook[%s]: %v", name, err)
+			}
+		}
+
+		bytes, err := bus.Runner.Execute(command, args, map[string]string{})
+		bus.Logger.Debugf("hook[%s]: %s\n", name, string(bytes))
+		if hook.ShowLogs {
+			prefix := fmt.Sprintf("\nhook[%s] logs | ", evt)
+			bus.Logger.Infow(prefix + strings.ReplaceAll(string(bytes), "\n", prefix))
+		}
+
+		if err != nil {
+			return false, fmt.Errorf("hook[%s]: command `%s` failed: %v", name, command, err)
+		}
+
+		executed = true
+	}
+
+	return executed, nil
+}

pkg/event/bus_test.go

@@ -0,0 +1,189 @@
+package event
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"testing"
+
+	"github.com/roboll/helmfile/pkg/environment"
+	"github.com/roboll/helmfile/pkg/helmexec"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zaptest/observer"
+)
+
+var logger = helmexec.NewLogger(os.Stdout, "warn")
+
+type runner struct {
+}
+
+func (r *runner) ExecuteStdIn(cmd string, args []string, env map[string]string, stdin io.Reader) ([]byte, error) {
+	return []byte(""), nil
+}
+
+func (r *runner) Execute(cmd string, args []string, env map[string]string) ([]byte, error) {
+	if cmd == "ng" {
+		return nil, fmt.Errorf("cmd failed due to invalid cmd: %s", cmd)
+	}
+	for _, a := range args {
+		if a == "ng" {
+			return nil, fmt.Errorf("cmd failed due to invalid arg: %s", a)
+		}
+	}
+	return []byte(""), nil
+}
+
+func TestTrigger(t *testing.T) {
+	cases := []struct {
+		name           string
+		hook           *Hook
+		triggeredEvt   string
+		expectedResult bool
+		expectedErr    string
+	}{
+		{
+			"okhook1",
+			&Hook{"okhook1", []string{"foo"}, "ok", nil, []string{}, true},
+			"foo",
+			true,
+			"",
+		},
+		{
+			"okhooké",
+			&Hook{"okhook2", []string{"foo"}, "ok", nil, []string{}, false},
+			"foo",
+			true,
+			"",
+		},
+		{
+			"missinghook1",
+			&Hook{"okhook1", []string{"foo"}, "ok", nil, []string{}, false},
+			"bar",
+			false,
+			"",
+		},
+		{
+			"nohook1",
+			nil,
+			"bar",
+			false,
+			"",
+		},
+		{
+			"nghook1",
+			&Hook{"nghook1", []string{"foo"}, "ng", nil, []string{}, false},
+			"foo",
+			false,
+			"hook[nghook1]: command `ng` failed: cmd failed due to invalid cmd: ng",
+		},
+		{
+			"nghook2",
+			&Hook{"nghook2", []string{"foo"}, "ok", nil, []string{"ng"}, false},
+			"foo",
+			false,
+			"hook[nghook2]: command `ok` failed: cmd failed due to invalid arg: ng",
+		},
+		{
+			"okkubeapply1",
+			&Hook{"okkubeapply1", []string{"foo"}, "", map[string]string{"kustomize": "kustodir"}, []string{}, false},
+			"foo",
+			true,
+			"",
+		},
+		{
+			"okkubeapply2",
+			&Hook{"okkubeapply2", []string{"foo"}, "", map[string]string{"filename": "resource.yaml"}, []string{}, false},
+			"foo",
+			true,
+			"",
+		},
+		{
+			"kokubeapply",
+			&Hook{"kokubeapply", []string{"foo"}, "", map[string]string{"kustomize": "kustodir", "filename": "resource.yaml"}, []string{}, true},
+			"foo",
+			false,
+			"hook[kokubeapply]: kustomize & filename cannot be used together",
+		},
+		{
+			"kokubeapply2",
+			&Hook{"kokubeapply2", []string{"foo"}, "", map[string]string{}, []string{}, true},
+			"foo",
+			false,
+			"hook[kokubeapply2]: either kustomize or filename must be given",
+		},
+		{
+			"kokubeapply3",
+			&Hook{"", []string{"foo"}, "", map[string]string{}, []string{}, true},
+			"foo",
+			false,
+			"hook[kubectlApply]: either kustomize or filename must be given",
+		},
+		{
+			"warnkubeapply1",
+			&Hook{"warnkubeapply1", []string{"foo"}, "ok", map[string]string{"filename": "resource.yaml"}, []string{}, true},
+			"foo",
+			true,
+			"",
+		},
+		{
+			"warnkubeapply2",
+			&Hook{"warnkubeapply2", []string{"foo"}, "", map[string]string{"filename": "resource.yaml"}, []string{"ng"}, true},
+			"foo",
+			true,
+			"",
+		},
+		{
+			"warnkubeapply3",
+			&Hook{"warnkubeapply3", []string{"foo"}, "ok", map[string]string{"filename": "resource.yaml"}, []string{"ng"}, true},
+			"foo",
+			true,
+			"",
+		},
+	}
+	readFile := func(filename string) ([]byte, error) {
+		return nil, fmt.Errorf("unexpected call to readFile: %s", filename)
+	}
+	for _, c := range cases {
+		hooks := []Hook{}
+		if c.hook != nil {
+			hooks = append(hooks, *c.hook)
+		}
+		observer, observedLogs := observer.New(zap.InfoLevel)
+		zeLogger := zap.New(observer).Sugar()
+		bus := &Bus{
+			Hooks:         hooks,
+			StateFilePath: "path/to/helmfile.yaml",
+			BasePath:      "path/to",
+			Namespace:     "myns",
+			Env:           environment.Environment{Name: "prod"},
+			Logger:        zeLogger,
+			ReadFile:      readFile,
+		}
+
+		bus.Runner = &runner{}
+		data := map[string]interface{}{
+			"Release":         "myrel",
+			"HelmfileCommand": "mycmd",
+		}
+		ok, err := bus.Trigger(c.triggeredEvt, nil, data)
+
+		if ok != c.expectedResult {
+			t.Errorf("unexpected result for case \"%s\": expected=%v, actual=%v", c.name, c.expectedResult, ok)
+		}
+
+		if c.expectedErr != "" {
+			if err == nil {
+				t.Errorf("error expected for case \"%s\", but not occurred", c.name)
+			} else if err.Error() != c.expectedErr {
+				t.Errorf("unexpected error for case \"%s\": expected=%s, actual=%v", c.name, c.expectedErr, err)
+			}
+		} else {
+			if err != nil {
+				t.Errorf("unexpected error for case \"%s\": %v", c.name, err)
+			}
+		}
+		if observedLogs.Len() != 0 && !hooks[0].ShowLogs {
+			t.Errorf("unexpected error for case \"%s\": Logs should not be created : %v", c.name, observedLogs.All())
+		}
+	}
+}

pkg/exectest/helm.go

@@ -0,0 +1,200 @@
+package exectest
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+	"sync"
+
+	"github.com/Masterminds/semver/v3"
+	"github.com/roboll/helmfile/pkg/helmexec"
+)
+
+type ListKey struct {
+	Filter string
+	Flags  string
+}
+
+type DiffKey struct {
+	Name  string
+	Chart string
+	Flags string
+}
+
+type Helm struct {
+	Charts               []string
+	Repo                 []string
+	Releases             []Release
+	Deleted              []Release
+	Lists                map[ListKey]string
+	Diffs                map[DiffKey]error
+	Diffed               []Release
+	FailOnUnexpectedDiff bool
+	FailOnUnexpectedList bool
+	Version              *semver.Version
+
+	UpdateDepsCallbacks map[string]func(string) error
+
+	DiffMutex     *sync.Mutex
+	ChartsMutex   *sync.Mutex
+	ReleasesMutex *sync.Mutex
+
+	Helm3 bool
+}
+
+type Release struct {
+	Name  string
+	Flags []string
+}
+
+type Affected struct {
+	Upgraded []*Release
+	Deleted  []*Release
+	Failed   []*Release
+}
+
+func (helm *Helm) UpdateDeps(chart string) error {
+	if strings.Contains(chart, "error") {
+		return fmt.Errorf("simulated UpdateDeps failure for chart: %s", chart)
+	}
+	helm.Charts = append(helm.Charts, chart)
+
+	if helm.UpdateDepsCallbacks != nil {
+		callback, exists := helm.UpdateDepsCallbacks[chart]
+		if exists {
+			if err := callback(chart); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func (helm *Helm) BuildDeps(name, chart string) error {
+	if strings.Contains(chart, "error") {
+		return errors.New("error")
+	}
+	helm.Charts = append(helm.Charts, chart)
+	return nil
+}
+
+func (helm *Helm) SetExtraArgs(args ...string) {
+	return
+}
+func (helm *Helm) SetHelmBinary(bin string) {
+	return
+}
+func (helm *Helm) AddRepo(name, repository, cafile, certfile, keyfile, username, password string, managed string) error {
+	helm.Repo = []string{name, repository, cafile, certfile, keyfile, username, password, managed}
+	return nil
+}
+func (helm *Helm) UpdateRepo() error {
+	return nil
+}
+func (helm *Helm) RegistryLogin(name string, username string, password string) error {
+	return nil
+}
+func (helm *Helm) SyncRelease(context helmexec.HelmContext, name, chart string, flags ...string) error {
+	if strings.Contains(name, "error") {
+		return errors.New("error")
+	}
+	helm.sync(helm.ReleasesMutex, func() {
+		helm.Releases = append(helm.Releases, Release{Name: name, Flags: flags})
+	})
+	helm.sync(helm.ChartsMutex, func() {
+		helm.Charts = append(helm.Charts, chart)
+	})
+
+	return nil
+}
+func (helm *Helm) DiffRelease(context helmexec.HelmContext, name, chart string, suppressDiff bool, flags ...string) error {
+	if helm.DiffMutex != nil {
+		helm.DiffMutex.Lock()
+	}
+	helm.Diffed = append(helm.Diffed, Release{Name: name, Flags: flags})
+	if helm.DiffMutex != nil {
+		helm.DiffMutex.Unlock()
+	}
+	key := DiffKey{Name: name, Chart: chart, Flags: strings.Join(flags, "")}
+	err, ok := helm.Diffs[key]
+	if !ok && helm.FailOnUnexpectedDiff {
+		return fmt.Errorf("unexpected diff with key: %v", key)
+	}
+	return err
+}
+func (helm *Helm) ReleaseStatus(context helmexec.HelmContext, release string, flags ...string) error {
+	if strings.Contains(release, "error") {
+		return errors.New("error")
+	}
+	helm.Releases = append(helm.Releases, Release{Name: release, Flags: flags})
+	return nil
+}
+func (helm *Helm) DeleteRelease(context helmexec.HelmContext, name string, flags ...string) error {
+	if strings.Contains(name, "error") {
+		return errors.New("error")
+	}
+	helm.Deleted = append(helm.Deleted, Release{Name: name, Flags: flags})
+	return nil
+}
+func (helm *Helm) List(context helmexec.HelmContext, filter string, flags ...string) (string, error) {
+	key := ListKey{Filter: filter, Flags: strings.Join(flags, "")}
+	res, ok := helm.Lists[key]
+	if !ok && helm.FailOnUnexpectedList {
+		return "", fmt.Errorf("unexpected list key: %v", key)
+	}
+	return res, nil
+}
+func (helm *Helm) DecryptSecret(context helmexec.HelmContext, name string, flags ...string) (string, error) {
+	return "", nil
+}
+func (helm *Helm) TestRelease(context helmexec.HelmContext, name string, flags ...string) error {
+	if strings.Contains(name, "error") {
+		return errors.New("error")
+	}
+	helm.Releases = append(helm.Releases, Release{Name: name, Flags: flags})
+	return nil
+}
+func (helm *Helm) Fetch(chart string, flags ...string) error {
+	return nil
+}
+func (helm *Helm) Lint(name, chart string, flags ...string) error {
+	return nil
+}
+func (helm *Helm) TemplateRelease(name, chart string, flags ...string) error {
+	return nil
+}
+func (helm *Helm) ChartPull(chart string, flags ...string) error {
+	return nil
+}
+func (helm *Helm) ChartExport(chart string, path string, flags ...string) error {
+	return nil
+}
+func (helm *Helm) IsHelm3() bool {
+	return helm.Helm3
+}
+
+func (helm *Helm) GetVersion() helmexec.Version {
+	return helmexec.Version{
+		Major: int(helm.Version.Major()),
+		Minor: int(helm.Version.Minor()),
+		Patch: int(helm.Version.Patch()),
+	}
+}
+
+func (helm *Helm) IsVersionAtLeast(versionStr string) bool {
+	if helm.Version == nil {
+		return false
+	}
+
+	ver := semver.MustParse(versionStr)
+	return helm.Version.Equal(ver) || helm.Version.GreaterThan(ver)
+}
+
+func (helm *Helm) sync(m *sync.Mutex, f func()) {
+	if m != nil {
+		m.Lock()
+		defer m.Unlock()
+	}
+
+	f()
+}

pkg/helmexec/context.go

@@ -0,0 +1,47 @@
+package helmexec
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+)
+
+type HelmContext struct {
+	Tillerless      bool
+	TillerNamespace string
+	HistoryMax      int
+	WorkerIndex     int
+	Writer          io.Writer
+}
+
+func (context *HelmContext) GetTillerlessArgs(helm *execer) []string {
+	if context.Tillerless && !helm.IsHelm3() {
+		if context.TillerNamespace != "" {
+			return []string{"tiller", "run", context.TillerNamespace, "--", helm.helmBinary}
+		} else {
+			return []string{"tiller", "run", "--", helm.helmBinary}
+		}
+	} else {
+		return []string{}
+	}
+}
+
+func (context *HelmContext) getTillerlessEnv() map[string]string {
+	if context.Tillerless {
+		result := map[string]string{
+			"HELM_TILLER_SILENT": "true",
+			// Changing the TILLER port doesn't really work: https://github.com/helm/helm/issues/3159
+			// So this is not used for the moment.
+			// "HELM_TILLER_PORT":   strconv.Itoa(44134 + context.WorkerIndex),
+		}
+		if config := os.Getenv("KUBECONFIG"); config != "" {
+			absConfig, err := filepath.Abs(config)
+			if err == nil {
+				result["KUBECONFIG"] = absConfig
+			}
+		}
+		return result
+	} else {
+		return map[string]string{}
+	}
+}

pkg/helmexec/exec.go

@@ -0,0 +1,530 @@
+package helmexec
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+
+	"github.com/Masterminds/semver/v3"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zapcore"
+)
+
+type decryptedSecret struct {
+	mutex sync.RWMutex
+	bytes []byte
+	err   error
+}
+
+type execer struct {
+	helmBinary           string
+	version              semver.Version
+	runner               Runner
+	logger               *zap.SugaredLogger
+	kubeContext          string
+	extra                []string
+	decryptedSecretMutex sync.Mutex
+	decryptedSecrets     map[string]*decryptedSecret
+	writeTempFile        func([]byte) (string, error)
+}
+
+func NewLogger(writer io.Writer, logLevel string) *zap.SugaredLogger {
+	var cfg zapcore.EncoderConfig
+	cfg.MessageKey = "message"
+	out := zapcore.AddSync(writer)
+	var level zapcore.Level
+	err := level.Set(logLevel)
+	if err != nil {
+		panic(err)
+	}
+	core := zapcore.NewCore(
+		zapcore.NewConsoleEncoder(cfg),
+		out,
+		level,
+	)
+	return zap.New(core).Sugar()
+}
+
+func parseHelmVersion(versionStr string) (semver.Version, error) {
+	if len(versionStr) == 0 {
+		return semver.Version{}, nil
+	}
+
+	versionStr = strings.TrimLeft(versionStr, "Client: ")
+	versionStr = strings.TrimRight(versionStr, "\n")
+
+	ver, err := semver.NewVersion(versionStr)
+	if err != nil {
+		return semver.Version{}, fmt.Errorf("error parsing helm version '%s'", versionStr)
+	}
+
+	// Support explicit helm3 opt-in via environment variable
+	if os.Getenv("HELMFILE_HELM3") != "" && ver.Major() < 3 {
+		return *semver.MustParse("v3.0.0"), nil
+	}
+
+	return *ver, nil
+}
+
+func getHelmVersion(helmBinary string, runner Runner) (semver.Version, error) {
+
+	// Autodetect from `helm version`
+	outBytes, err := runner.Execute(helmBinary, []string{"version", "--client", "--short"}, nil)
+	if err != nil {
+		return semver.Version{}, fmt.Errorf("error determining helm version: %w", err)
+	}
+
+	return parseHelmVersion(string(outBytes))
+}
+
+// New for running helm commands
+func New(helmBinary string, logger *zap.SugaredLogger, kubeContext string, runner Runner) *execer {
+	// TODO: proper error handling
+	version, err := getHelmVersion(helmBinary, runner)
+	if err != nil {
+		panic(err)
+	}
+	return &execer{
+		helmBinary:       helmBinary,
+		version:          version,
+		logger:           logger,
+		kubeContext:      kubeContext,
+		runner:           runner,
+		decryptedSecrets: make(map[string]*decryptedSecret),
+	}
+}
+
+func (helm *execer) SetExtraArgs(args ...string) {
+	helm.extra = args
+}
+
+func (helm *execer) SetHelmBinary(bin string) {
+	helm.helmBinary = bin
+}
+
+func (helm *execer) AddRepo(name, repository, cafile, certfile, keyfile, username, password string, managed string) error {
+	var args []string
+	var out []byte
+	var err error
+	if name == "" && repository != "" {
+		helm.logger.Infof("empty field name\n")
+		return fmt.Errorf("empty field name")
+	}
+	switch managed {
+	case "acr":
+		helm.logger.Infof("Adding repo %v (acr)", name)
+		out, err = helm.azcli(name)
+	case "":
+		args = append(args, "repo", "add", name, repository)
+
+		// See https://github.com/helm/helm/pull/8777
+		if cons, err := semver.NewConstraint(">= 3.3.2"); err == nil {
+			if cons.Check(&helm.version) {
+				args = append(args, "--force-update")
+			}
+		} else {
+			panic(err)
+		}
+
+		if certfile != "" && keyfile != "" {
+			args = append(args, "--cert-file", certfile, "--key-file", keyfile)
+		}
+		if cafile != "" {
+			args = append(args, "--ca-file", cafile)
+		}
+		if username != "" && password != "" {
+			args = append(args, "--username", username, "--password", password)
+		}
+		helm.logger.Infof("Adding repo %v %v", name, repository)
+		out, err = helm.exec(args, map[string]string{})
+	default:
+		helm.logger.Errorf("ERROR: unknown type '%v' for repository %v", managed, name)
+		out = nil
+		err = nil
+	}
+	helm.info(out)
+	return err
+}
+
+func (helm *execer) UpdateRepo() error {
+	helm.logger.Info("Updating repo")
+	out, err := helm.exec([]string{"repo", "update"}, map[string]string{})
+	helm.info(out)
+	return err
+}
+
+func (helm *execer) RegistryLogin(repository string, username string, password string) error {
+	helm.logger.Info("Logging in to registry")
+	args := []string{
+		"registry",
+		"login",
+		repository,
+		"--username",
+		username,
+		"--password-stdin",
+	}
+	buffer := bytes.Buffer{}
+	buffer.Write([]byte(fmt.Sprintf("%s\n", password)))
+	out, err := helm.execStdIn(args, map[string]string{"HELM_EXPERIMENTAL_OCI": "1"}, &buffer)
+	helm.info(out)
+	return err
+}
+
+func (helm *execer) BuildDeps(name, chart string) error {
+	helm.logger.Infof("Building dependency release=%v, chart=%v", name, chart)
+	out, err := helm.exec([]string{"dependency", "build", chart}, map[string]string{})
+	helm.info(out)
+	return err
+}
+
+func (helm *execer) UpdateDeps(chart string) error {
+	helm.logger.Infof("Updating dependency %v", chart)
+	out, err := helm.exec([]string{"dependency", "update", chart}, map[string]string{})
+	helm.info(out)
+	return err
+}
+
+func (helm *execer) SyncRelease(context HelmContext, name, chart string, flags ...string) error {
+	helm.logger.Infof("Upgrading release=%v, chart=%v", name, chart)
+	preArgs := context.GetTillerlessArgs(helm)
+	env := context.getTillerlessEnv()
+
+	if helm.IsHelm3() {
+		flags = append(flags, "--history-max", strconv.Itoa(context.HistoryMax))
+	} else {
+		env["HELM_TILLER_HISTORY_MAX"] = strconv.Itoa(context.HistoryMax)
+	}
+
+	out, err := helm.exec(append(append(preArgs, "upgrade", "--install", "--reset-values", name, chart), flags...), env)
+	helm.write(nil, out)
+	return err
+}
+
+func (helm *execer) ReleaseStatus(context HelmContext, name string, flags ...string) error {
+	helm.logger.Infof("Getting status %v", name)
+	preArgs := context.GetTillerlessArgs(helm)
+	env := context.getTillerlessEnv()
+	out, err := helm.exec(append(append(preArgs, "status", name), flags...), env)
+	helm.write(nil, out)
+	return err
+}
+
+func (helm *execer) List(context HelmContext, filter string, flags ...string) (string, error) {
+	helm.logger.Infof("Listing releases matching %v", filter)
+	preArgs := context.GetTillerlessArgs(helm)
+	env := context.getTillerlessEnv()
+	var args []string
+	if helm.IsHelm3() {
+		args = []string{"list", "--filter", filter}
+	} else {
+		args = []string{"list", filter}
+	}
+
+	out, err := helm.exec(append(append(preArgs, args...), flags...), env)
+	// In v2 we have been expecting `helm list FILTER` prints nothing.
+	// In v3 helm still prints the header like `NAME	NAMESPACE	REVISION	UPDATED	STATUS	CHART	APP VERSION`,
+	// which confuses helmfile's existing logic that treats any non-empty output from `helm list` is considered as the indication
+	// of the release to exist.
+	//
+	// This fixes it by removing the header from the v3 output, so that the output is formatted the same as that of v2.
+	if helm.IsHelm3() {
+		lines := strings.Split(string(out), "\n")
+		lines = lines[1:]
+		out = []byte(strings.Join(lines, "\n"))
+	}
+	helm.write(nil, out)
+	return string(out), err
+}
+
+func (helm *execer) DecryptSecret(context HelmContext, name string, flags ...string) (string, error) {
+	absPath, err := filepath.Abs(name)
+	if err != nil {
+		return "", err
+	}
+
+	helm.logger.Debugf("Preparing to decrypt secret %v", absPath)
+	helm.decryptedSecretMutex.Lock()
+
+	secret, ok := helm.decryptedSecrets[absPath]
+
+	// Cache miss
+	if !ok {
+
+		secret = &decryptedSecret{}
+		helm.decryptedSecrets[absPath] = secret
+
+		secret.mutex.Lock()
+		defer secret.mutex.Unlock()
+		helm.decryptedSecretMutex.Unlock()
+
+		helm.logger.Infof("Decrypting secret %v", absPath)
+		preArgs := context.GetTillerlessArgs(helm)
+		env := context.getTillerlessEnv()
+		out, err := helm.exec(append(append(preArgs, "secrets", "dec", absPath), flags...), env)
+		helm.info(out)
+		if err != nil {
+			secret.err = err
+			return "", err
+		}
+
+		// HELM_SECRETS_DEC_SUFFIX is used by the helm-secrets plugin to define the output file
+		decSuffix := os.Getenv("HELM_SECRETS_DEC_SUFFIX")
+		if len(decSuffix) == 0 {
+			decSuffix = ".yaml.dec"
+		}
+
+		// helm secrets replaces the extension with its suffix ONLY when the extension is ".yaml"
+		var decFilename string
+		if strings.HasSuffix(absPath, ".yaml") {
+			decFilename = strings.Replace(absPath, ".yaml", decSuffix, 1)
+		} else {
+			decFilename = absPath + decSuffix
+		}
+
+		secretBytes, err := ioutil.ReadFile(decFilename)
+		if err != nil {
+			secret.err = err
+			return "", err
+		}
+		secret.bytes = secretBytes
+
+		if err := os.Remove(decFilename); err != nil {
+			return "", err
+		}
+
+	} else {
+		// Cache hit
+		helm.logger.Debugf("Found secret in cache %v", absPath)
+
+		secret.mutex.RLock()
+		helm.decryptedSecretMutex.Unlock()
+		defer secret.mutex.RUnlock()
+
+		if secret.err != nil {
+			return "", secret.err
+		}
+	}
+
+	tempFile := helm.writeTempFile
+
+	if tempFile == nil {
+		tempFile = func(content []byte) (string, error) {
+			dir := filepath.Dir(name)
+			extension := filepath.Ext(name)
+			tmpFile, err := ioutil.TempFile(dir, "secret*"+extension)
+			if err != nil {
+				return "", err
+			}
+
+			_, err = tmpFile.Write(content)
+			if err != nil {
+				return "", err
+			}
+
+			return tmpFile.Name(), nil
+		}
+	}
+
+	tmpFileName, err := tempFile(secret.bytes)
+	if err != nil {
+		return "", err
+	}
+
+	helm.logger.Debugf("Decrypted %s into %s", absPath, tmpFileName)
+
+	return tmpFileName, err
+}
+
+func (helm *execer) TemplateRelease(name string, chart string, flags ...string) error {
+	helm.logger.Infof("Templating release=%v, chart=%v", name, chart)
+	var args []string
+	if helm.IsHelm3() {
+		args = []string{"template", name, chart}
+	} else {
+		args = []string{"template", chart, "--name", name}
+	}
+
+	out, err := helm.exec(append(args, flags...), map[string]string{})
+
+	var outputToFile bool
+
+	for _, f := range flags {
+		if strings.HasPrefix("--output-dir", f) {
+			outputToFile = true
+			break
+		}
+	}
+
+	if outputToFile {
+		// With --output-dir is passed to helm-template,
+		// we can safely direct all the logs from it to our logger.
+		//
+		// It's safe because anything written to stdout by helm-template with output-dir is logs,
+		// like excessive `wrote path/to/output/dir/chart/template/file.yaml` messages,
+		// but manifets.
+		//
+		// See https://github.com/roboll/helmfile/pull/1691#issuecomment-805636021 for more information.
+		helm.info(out)
+	} else {
+		// Always write to stdout for use with e.g. `helmfile template | kubectl apply -f -`
+		helm.write(nil, out)
+	}
+
+	return err
+}
+
+func (helm *execer) DiffRelease(context HelmContext, name, chart string, suppressDiff bool, flags ...string) error {
+	if context.Writer != nil {
+		fmt.Fprintf(context.Writer, "Comparing release=%v, chart=%v\n", name, chart)
+	} else {
+		helm.logger.Infof("Comparing release=%v, chart=%v", name, chart)
+	}
+	preArgs := context.GetTillerlessArgs(helm)
+	env := context.getTillerlessEnv()
+	out, err := helm.exec(append(append(preArgs, "diff", "upgrade", "--reset-values", "--allow-unreleased", name, chart), flags...), env)
+	// Do our best to write STDOUT only when diff existed
+	// Unfortunately, this works only when you run helmfile with `--detailed-exitcode`
+	detailedExitcodeEnabled := false
+	for _, f := range flags {
+		if strings.Contains(f, "detailed-exitcode") {
+			detailedExitcodeEnabled = true
+			break
+		}
+	}
+	if detailedExitcodeEnabled {
+		switch e := err.(type) {
+		case ExitError:
+			if e.ExitStatus() == 2 {
+				if !(suppressDiff) {
+					helm.write(context.Writer, out)
+				}
+				return err
+			}
+		}
+	} else if !(suppressDiff) {
+		helm.write(context.Writer, out)
+	}
+	return err
+}
+
+func (helm *execer) Lint(name, chart string, flags ...string) error {
+	helm.logger.Infof("Linting release=%v, chart=%v", name, chart)
+	out, err := helm.exec(append([]string{"lint", chart}, flags...), map[string]string{})
+	helm.write(nil, out)
+	return err
+}
+
+func (helm *execer) Fetch(chart string, flags ...string) error {
+	helm.logger.Infof("Fetching %v", chart)
+	out, err := helm.exec(append([]string{"fetch", chart}, flags...), map[string]string{})
+	helm.info(out)
+	return err
+}
+
+func (helm *execer) ChartPull(chart string, flags ...string) error {
+	helm.logger.Infof("Pulling %v", chart)
+	out, err := helm.exec(append([]string{"chart", "pull", chart}, flags...), map[string]string{"HELM_EXPERIMENTAL_OCI": "1"})
+	helm.info(out)
+	return err
+}
+
+func (helm *execer) ChartExport(chart string, path string, flags ...string) error {
+	helm.logger.Infof("Exporting %v", chart)
+	out, err := helm.exec(append([]string{"chart", "export", chart, "--destination", path}, flags...), map[string]string{"HELM_EXPERIMENTAL_OCI": "1"})
+	helm.info(out)
+	return err
+}
+
+func (helm *execer) DeleteRelease(context HelmContext, name string, flags ...string) error {
+	helm.logger.Infof("Deleting %v", name)
+	preArgs := context.GetTillerlessArgs(helm)
+	env := context.getTillerlessEnv()
+	out, err := helm.exec(append(append(preArgs, "delete", name), flags...), env)
+	helm.write(nil, out)
+	return err
+}
+
+func (helm *execer) TestRelease(context HelmContext, name string, flags ...string) error {
+	helm.logger.Infof("Testing %v", name)
+	preArgs := context.GetTillerlessArgs(helm)
+	env := context.getTillerlessEnv()
+	args := []string{"test", name}
+	out, err := helm.exec(append(append(preArgs, args...), flags...), env)
+	helm.write(nil, out)
+	return err
+}
+
+func (helm *execer) exec(args []string, env map[string]string) ([]byte, error) {
+	cmdargs := args
+	if len(helm.extra) > 0 {
+		cmdargs = append(cmdargs, helm.extra...)
+	}
+	if helm.kubeContext != "" {
+		cmdargs = append([]string{"--kube-context", helm.kubeContext}, cmdargs...)
+	}
+	cmd := fmt.Sprintf("exec: %s %s", helm.helmBinary, strings.Join(cmdargs, " "))
+	helm.logger.Debug(cmd)
+	outBytes, err := helm.runner.Execute(helm.helmBinary, cmdargs, env)
+	return outBytes, err
+}
+
+func (helm *execer) execStdIn(args []string, env map[string]string, stdin io.Reader) ([]byte, error) {
+	cmdargs := args
+	if len(helm.extra) > 0 {
+		cmdargs = append(cmdargs, helm.extra...)
+	}
+	if helm.kubeContext != "" {
+		cmdargs = append([]string{"--kube-context", helm.kubeContext}, cmdargs...)
+	}
+	cmd := fmt.Sprintf("exec: %s %s", helm.helmBinary, strings.Join(cmdargs, " "))
+	helm.logger.Debug(cmd)
+	outBytes, err := helm.runner.ExecuteStdIn(helm.helmBinary, cmdargs, env, stdin)
+	return outBytes, err
+}
+
+func (helm *execer) azcli(name string) ([]byte, error) {
+	cmdargs := append(strings.Split("acr helm repo add --name", " "), name)
+	cmd := fmt.Sprintf("exec: az %s", strings.Join(cmdargs, " "))
+	helm.logger.Debug(cmd)
+	outBytes, err := helm.runner.Execute("az", cmdargs, map[string]string{})
+	helm.logger.Debugf("%s: %s", cmd, outBytes)
+	return outBytes, err
+}
+
+func (helm *execer) info(out []byte) {
+	if len(out) > 0 {
+		helm.logger.Infof("%s", out)
+	}
+}
+
+func (helm *execer) write(w io.Writer, out []byte) {
+	if len(out) > 0 {
+		if w == nil {
+			w = os.Stdout
+		}
+		fmt.Fprintf(w, "%s\n", out)
+	}
+}
+
+func (helm *execer) IsHelm3() bool {
+	return helm.version.Major() == 3
+}
+
+func (helm *execer) GetVersion() Version {
+	return Version{
+		Major: int(helm.version.Major()),
+		Minor: int(helm.version.Minor()),
+		Patch: int(helm.version.Patch()),
+	}
+}
+
+func (helm *execer) IsVersionAtLeast(versionStr string) bool {
+	ver := semver.MustParse(versionStr)
+	return helm.version.Equal(ver) || helm.version.GreaterThan(ver)
+}

pkg/helmexec/exec_test.go

@@ -0,0 +1,615 @@
+package helmexec
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"os"
+	"path"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	"github.com/Masterminds/semver/v3"
+	"go.uber.org/zap"
+)
+
+// Mocking the command-line runner
+
+type mockRunner struct {
+	output []byte
+	err    error
+}
+
+func (mock *mockRunner) ExecuteStdIn(cmd string, args []string, env map[string]string, stdin io.Reader) ([]byte, error) {
+	return mock.output, mock.err
+}
+
+func (mock *mockRunner) Execute(cmd string, args []string, env map[string]string) ([]byte, error) {
+	return mock.output, mock.err
+}
+
+func MockExecer(logger *zap.SugaredLogger, kubeContext string) *execer {
+	execer := New("helm", logger, kubeContext, &mockRunner{})
+	return execer
+}
+
+// Test methods
+
+func TestNewHelmExec(t *testing.T) {
+	buffer := bytes.NewBufferString("something")
+	helm := MockExecer(NewLogger(buffer, "debug"), "dev")
+	if helm.kubeContext != "dev" {
+		t.Error("helmexec.New() - kubeContext")
+	}
+	if buffer.String() != "something" {
+		t.Error("helmexec.New() - changed buffer")
+	}
+	if len(helm.extra) != 0 {
+		t.Error("helmexec.New() - extra args not empty")
+	}
+}
+
+func Test_SetExtraArgs(t *testing.T) {
+	helm := MockExecer(NewLogger(os.Stdout, "info"), "dev")
+	helm.SetExtraArgs()
+	if len(helm.extra) != 0 {
+		t.Error("helmexec.SetExtraArgs() - passing no arguments should not change extra field")
+	}
+	helm.SetExtraArgs("foo")
+	if !reflect.DeepEqual(helm.extra, []string{"foo"}) {
+		t.Error("helmexec.SetExtraArgs() - one extra argument missing")
+	}
+	helm.SetExtraArgs("alpha", "beta")
+	if !reflect.DeepEqual(helm.extra, []string{"alpha", "beta"}) {
+		t.Error("helmexec.SetExtraArgs() - two extra arguments missing (overwriting the previous value)")
+	}
+}
+
+func Test_SetHelmBinary(t *testing.T) {
+	helm := MockExecer(NewLogger(os.Stdout, "info"), "dev")
+	if helm.helmBinary != "helm" {
+		t.Error("helmexec.command - default command is not helm")
+	}
+	helm.SetHelmBinary("foo")
+	if helm.helmBinary != "foo" {
+		t.Errorf("helmexec.SetHelmBinary() - actual = %s expect = foo", helm.helmBinary)
+	}
+}
+
+func Test_AddRepo_Helm_3_3_2(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := &execer{
+		helmBinary:  "helm",
+		version:     *semver.MustParse("3.3.2"),
+		logger:      logger,
+		kubeContext: "dev",
+		runner:      &mockRunner{},
+	}
+	helm.AddRepo("myRepo", "https://repo.example.com/", "", "cert.pem", "key.pem", "", "", "")
+	expected := `Adding repo myRepo https://repo.example.com/
+exec: helm --kube-context dev repo add myRepo https://repo.example.com/ --force-update --cert-file cert.pem --key-file key.pem
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_AddRepo(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.AddRepo("myRepo", "https://repo.example.com/", "", "cert.pem", "key.pem", "", "", "")
+	expected := `Adding repo myRepo https://repo.example.com/
+exec: helm --kube-context dev repo add myRepo https://repo.example.com/ --cert-file cert.pem --key-file key.pem
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm.AddRepo("myRepo", "https://repo.example.com/", "ca.crt", "", "", "", "", "")
+	expected = `Adding repo myRepo https://repo.example.com/
+exec: helm --kube-context dev repo add myRepo https://repo.example.com/ --ca-file ca.crt
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm.AddRepo("myRepo", "https://repo.example.com/", "", "", "", "", "", "")
+	expected = `Adding repo myRepo https://repo.example.com/
+exec: helm --kube-context dev repo add myRepo https://repo.example.com/
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm.AddRepo("acrRepo", "", "", "", "", "", "", "acr")
+	expected = `Adding repo acrRepo (acr)
+exec: az acr helm repo add --name acrRepo
+exec: az acr helm repo add --name acrRepo: 
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm.AddRepo("otherRepo", "", "", "", "", "", "", "unknown")
+	expected = `ERROR: unknown type 'unknown' for repository otherRepo
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm.AddRepo("myRepo", "https://repo.example.com/", "", "", "", "example_user", "example_password", "")
+	expected = `Adding repo myRepo https://repo.example.com/
+exec: helm --kube-context dev repo add myRepo https://repo.example.com/ --username example_user --password example_password
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm.AddRepo("", "https://repo.example.com/", "", "", "", "", "", "")
+	expected = `empty field name
+
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_UpdateRepo(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.UpdateRepo()
+	expected := `Updating repo
+exec: helm --kube-context dev repo update
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.UpdateRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_SyncRelease(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.SyncRelease(HelmContext{}, "release", "chart", "--timeout 10", "--wait", "--wait-for-jobs")
+	expected := `Upgrading release=release, chart=chart
+exec: helm --kube-context dev upgrade --install --reset-values release chart --timeout 10 --wait --wait-for-jobs
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.SyncRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm.SyncRelease(HelmContext{}, "release", "chart")
+	expected = `Upgrading release=release, chart=chart
+exec: helm --kube-context dev upgrade --install --reset-values release chart
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.SyncRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_SyncReleaseTillerless(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.SyncRelease(HelmContext{Tillerless: true, TillerNamespace: "foo"}, "release", "chart",
+		"--timeout 10", "--wait", "--wait-for-jobs")
+	expected := `Upgrading release=release, chart=chart
+exec: helm --kube-context dev tiller run foo -- helm upgrade --install --reset-values release chart --timeout 10 --wait --wait-for-jobs
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.SyncRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_UpdateDeps(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.UpdateDeps("./chart/foo")
+	expected := `Updating dependency ./chart/foo
+exec: helm --kube-context dev dependency update ./chart/foo
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.UpdateDeps()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm.SetExtraArgs("--verify")
+	helm.UpdateDeps("./chart/foo")
+	expected = `Updating dependency ./chart/foo
+exec: helm --kube-context dev dependency update ./chart/foo --verify
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_BuildDeps(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.BuildDeps("foo", "./chart/foo")
+	expected := `Building dependency release=foo, chart=./chart/foo
+exec: helm --kube-context dev dependency build ./chart/foo
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.BuildDeps()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm.SetExtraArgs("--verify")
+	helm.BuildDeps("foo", "./chart/foo")
+	expected = `Building dependency release=foo, chart=./chart/foo
+exec: helm --kube-context dev dependency build ./chart/foo --verify
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.BuildDeps()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_DecryptSecret(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+
+	tmpFilePath := "path/to/temp/file"
+	helm.writeTempFile = func(content []byte) (string, error) {
+		return tmpFilePath, nil
+	}
+
+	helm.DecryptSecret(HelmContext{}, "secretName")
+	cwd, err := filepath.Abs(".")
+	if err != nil {
+		t.Errorf("Error: %v", err)
+	}
+	// Run again for caching
+	helm.DecryptSecret(HelmContext{}, "secretName")
+
+	expected := fmt.Sprintf(`Preparing to decrypt secret %v/secretName
+Decrypting secret %s/secretName
+exec: helm --kube-context dev secrets dec %s/secretName
+Preparing to decrypt secret %s/secretName
+Found secret in cache %s/secretName
+`, cwd, cwd, cwd, cwd, cwd)
+	if d := cmp.Diff(expected, buffer.String()); d != "" {
+		t.Errorf("helmexec.DecryptSecret(): want (-), got (+):\n%s", d)
+	}
+}
+
+func Test_DecryptSecretWithGotmpl(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+
+	tmpFilePath := "path/to/temp/file"
+	helm.writeTempFile = func(content []byte) (string, error) {
+		return tmpFilePath, nil
+	}
+
+	secretName := "secretName.yaml.gotmpl"
+	_, decryptErr := helm.DecryptSecret(HelmContext{}, secretName)
+	cwd, err := filepath.Abs(".")
+	if err != nil {
+		t.Errorf("Error: %v", err)
+	}
+
+	expected := fmt.Sprintf(`%s/%s.yaml.dec`, cwd, secretName)
+	if d := cmp.Diff(expected, decryptErr.(*os.PathError).Path); d != "" {
+		t.Errorf("helmexec.DecryptSecret(): want (-), got (+):\n%s", d)
+	}
+}
+
+func Test_DiffRelease(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.DiffRelease(HelmContext{}, "release", "chart", false, "--timeout 10", "--wait", "--wait-for-jobs")
+	expected := `Comparing release=release, chart=chart
+exec: helm --kube-context dev diff upgrade --reset-values --allow-unreleased release chart --timeout 10 --wait --wait-for-jobs
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.DiffRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm.DiffRelease(HelmContext{}, "release", "chart", false)
+	expected = `Comparing release=release, chart=chart
+exec: helm --kube-context dev diff upgrade --reset-values --allow-unreleased release chart
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.DiffRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_DiffReleaseTillerless(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.DiffRelease(HelmContext{Tillerless: true}, "release", "chart", false, "--timeout 10", "--wait", "--wait-for-jobs")
+	expected := `Comparing release=release, chart=chart
+exec: helm --kube-context dev tiller run -- helm diff upgrade --reset-values --allow-unreleased release chart --timeout 10 --wait --wait-for-jobs
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.DiffRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_DeleteRelease(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.DeleteRelease(HelmContext{}, "release")
+	expected := `Deleting release
+exec: helm --kube-context dev delete release
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.DeleteRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+func Test_DeleteRelease_Flags(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.DeleteRelease(HelmContext{}, "release", "--purge")
+	expected := `Deleting release
+exec: helm --kube-context dev delete release --purge
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.DeleteRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_TestRelease(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.TestRelease(HelmContext{}, "release")
+	expected := `Testing release
+exec: helm --kube-context dev test release
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.TestRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+func Test_TestRelease_Flags(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.TestRelease(HelmContext{}, "release", "--cleanup", "--timeout", "60")
+	expected := `Testing release
+exec: helm --kube-context dev test release --cleanup --timeout 60
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.TestRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_ReleaseStatus(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.ReleaseStatus(HelmContext{}, "myRelease")
+	expected := `Getting status myRelease
+exec: helm --kube-context dev status myRelease
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.ReleaseStatus()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_exec(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "")
+	env := map[string]string{}
+	helm.exec([]string{"version"}, env)
+	expected := `exec: helm version
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.exec()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	helm = MockExecer(logger, "dev")
+	ret, _ := helm.exec([]string{"diff"}, env)
+	if len(ret) != 0 {
+		t.Error("helmexec.exec() - expected empty return value")
+	}
+
+	buffer.Reset()
+	helm = MockExecer(logger, "dev")
+	helm.exec([]string{"diff", "release", "chart", "--timeout 10", "--wait", "--wait-for-jobs"}, env)
+	expected = `exec: helm --kube-context dev diff release chart --timeout 10 --wait --wait-for-jobs
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.exec()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm.exec([]string{"version"}, env)
+	expected = `exec: helm --kube-context dev version
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.exec()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm.SetExtraArgs("foo")
+	helm.exec([]string{"version"}, env)
+	expected = `exec: helm --kube-context dev version foo
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.exec()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm = MockExecer(logger, "")
+	helm.SetHelmBinary("overwritten")
+	helm.exec([]string{"version"}, env)
+	expected = `exec: overwritten version
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.exec()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_Lint(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.Lint("release", "path/to/chart", "--values", "file.yml")
+	expected := `Linting release=release, chart=path/to/chart
+exec: helm --kube-context dev lint path/to/chart --values file.yml
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.Lint()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_Fetch(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.Fetch("chart", "--version", "1.2.3", "--untar", "--untardir", "/tmp/dir")
+	expected := `Fetching chart
+exec: helm --kube-context dev fetch chart --version 1.2.3 --untar --untardir /tmp/dir
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.Lint()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+var logLevelTests = map[string]string{
+	"debug": `Adding repo myRepo https://repo.example.com/
+exec: helm repo add myRepo https://repo.example.com/ --username example_user --password example_password
+`,
+	"info": `Adding repo myRepo https://repo.example.com/
+`,
+	"warn": ``,
+}
+
+func Test_LogLevels(t *testing.T) {
+	var buffer bytes.Buffer
+	for logLevel, expected := range logLevelTests {
+		buffer.Reset()
+		logger := NewLogger(&buffer, logLevel)
+		helm := MockExecer(logger, "")
+		helm.AddRepo("myRepo", "https://repo.example.com/", "", "", "", "example_user", "example_password", "")
+		if buffer.String() != expected {
+			t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
+		}
+	}
+}
+
+func Test_getTillerlessEnv(t *testing.T) {
+	context := HelmContext{Tillerless: true, TillerNamespace: "foo", WorkerIndex: 1}
+
+	os.Unsetenv("KUBECONFIG")
+	actual := context.getTillerlessEnv()
+	if val, found := actual["HELM_TILLER_SILENT"]; !found || val != "true" {
+		t.Errorf("getTillerlessEnv() HELM_TILLER_SILENT\nactual = %s\nexpect = true", val)
+	}
+	// This feature is disabled until it is fixed in helm
+	/*if val, found := actual["HELM_TILLER_PORT"]; !found || val != "44135" {
+		t.Errorf("getTillerlessEnv() HELM_TILLER_PORT\nactual = %s\nexpect = 44135", val)
+	}*/
+	if val, found := actual["KUBECONFIG"]; found {
+		t.Errorf("getTillerlessEnv() KUBECONFIG\nactual = %s\nexpect = nil", val)
+	}
+
+	os.Setenv("KUBECONFIG", "toto")
+	actual = context.getTillerlessEnv()
+	cwd, _ := os.Getwd()
+	expected := path.Join(cwd, "toto")
+	if val, found := actual["KUBECONFIG"]; !found || val != expected {
+		t.Errorf("getTillerlessEnv() KUBECONFIG\nactual = %s\nexpect = %s", val, expected)
+	}
+	os.Unsetenv("KUBECONFIG")
+}
+
+func Test_mergeEnv(t *testing.T) {
+	actual := env2map(mergeEnv([]string{"A=1", "B=c=d", "E=2"}, map[string]string{"B": "3", "F": "4"}))
+	expected := map[string]string{"A": "1", "B": "3", "E": "2", "F": "4"}
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("mergeEnv()\nactual = %v\nexpect = %v", actual, expected)
+	}
+}
+
+func Test_Template(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.TemplateRelease("release", "path/to/chart", "--values", "file.yml")
+	expected := `Templating release=release, chart=path/to/chart
+exec: helm --kube-context dev template path/to/chart --name release --values file.yml
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.Template()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_IsHelm3(t *testing.T) {
+	helm2Runner := mockRunner{output: []byte("Client: v2.16.0+ge13bc94\n")}
+	helm := New("helm", NewLogger(os.Stdout, "info"), "dev", &helm2Runner)
+	if helm.IsHelm3() {
+		t.Error("helmexec.IsHelm3() - Detected Helm 3 with Helm 2 version")
+	}
+
+	helm3Runner := mockRunner{output: []byte("v3.0.0+ge29ce2a\n")}
+	helm = New("helm", NewLogger(os.Stdout, "info"), "dev", &helm3Runner)
+	if !helm.IsHelm3() {
+		t.Error("helmexec.IsHelm3() - Failed to detect Helm 3")
+	}
+
+	os.Setenv("HELMFILE_HELM3", "1")
+	helm2Runner = mockRunner{output: []byte("Client: v2.16.0+ge13bc94\n")}
+	helm = New("helm", NewLogger(os.Stdout, "info"), "dev", &helm2Runner)
+	if !helm.IsHelm3() {
+		t.Error("helmexec.IsHelm3() - Helm3 not detected when HELMFILE_HELM3 is set")
+	}
+	os.Setenv("HELMFILE_HELM3", "")
+}
+
+func Test_GetVersion(t *testing.T) {
+	helm2Runner := mockRunner{output: []byte("Client: v2.16.1+ge13bc94\n")}
+	helm := New("helm", NewLogger(os.Stdout, "info"), "dev", &helm2Runner)
+	ver := helm.GetVersion()
+	if ver.Major != 2 || ver.Minor != 16 || ver.Patch != 1 {
+		t.Error(fmt.Sprintf("helmexec.GetVersion - did not detect correct Helm2 version; it was: %+v", ver))
+	}
+
+	helm3Runner := mockRunner{output: []byte("v3.2.4+ge29ce2a\n")}
+	helm = New("helm", NewLogger(os.Stdout, "info"), "dev", &helm3Runner)
+	ver = helm.GetVersion()
+	if ver.Major != 3 || ver.Minor != 2 || ver.Patch != 4 {
+		t.Error(fmt.Sprintf("helmexec.GetVersion - did not detect correct Helm3 version; it was: %+v", ver))
+	}
+}
+
+func Test_IsVersionAtLeast(t *testing.T) {
+	helm2Runner := mockRunner{output: []byte("Client: v2.16.1+ge13bc94\n")}
+	helm := New("helm", NewLogger(os.Stdout, "info"), "dev", &helm2Runner)
+	if !helm.IsVersionAtLeast("2.1.0") {
+		t.Error("helmexec.IsVersionAtLeast - 2.16.1 not atleast 2.1")
+	}
+
+	if helm.IsVersionAtLeast("2.19.0") {
+		t.Error("helmexec.IsVersionAtLeast - 2.16.1 is atleast 2.19")
+	}
+
+	if helm.IsVersionAtLeast("3.2.0") {
+		t.Error("helmexec.IsVersionAtLeast - 2.16.1 is atleast 3.2")
+	}
+}

pkg/helmexec/exit_error.go

@@ -0,0 +1,71 @@
+package helmexec
+
+import (
+	"fmt"
+	"strings"
+)
+
+func newExitError(path string, args []string, exitStatus int, err error, stderr, combined string) ExitError {
+	var out string
+
+	out += fmt.Sprintf("PATH:\n%s", Indent(path, "  "))
+
+	out += "\n\nARGS:"
+	for i, a := range args {
+		out += fmt.Sprintf("\n%s", Indent(fmt.Sprintf("%d: %s (%d bytes)", i, a, len(a)), "  "))
+	}
+
+	out += fmt.Sprintf("\n\nERROR:\n%s", Indent(err.Error(), "  "))
+
+	out += fmt.Sprintf("\n\nEXIT STATUS\n%s", Indent(fmt.Sprintf("%d", exitStatus), "  "))
+
+	if len(stderr) > 0 {
+		out += fmt.Sprintf("\n\nSTDERR:\n%s", Indent(stderr, "  "))
+	}
+
+	if len(combined) > 0 {
+		out += fmt.Sprintf("\n\nCOMBINED OUTPUT:\n%s", Indent(combined, "  "))
+	}
+
+	return ExitError{
+		Message: fmt.Sprintf("command %q exited with non-zero status:\n\n%s", path, out),
+		Code:    exitStatus,
+	}
+}
+
+// indents a block of text with an indent string
+func Indent(text, indent string) string {
+	var b strings.Builder
+
+	b.Grow(len(text) * 2)
+
+	lines := strings.Split(text, "\n")
+
+	last := len(lines) - 1
+
+	for i, j := range lines {
+		if i > 0 && i < last && j != "" {
+			b.WriteString("\n")
+		}
+
+		if j != "" {
+			b.WriteString(indent + j)
+		}
+	}
+
+	return b.String()
+}
+
+// ExitError is created whenever your shell command exits with a non-zero exit status
+type ExitError struct {
+	Message string
+	Code    int
+}
+
+func (e ExitError) Error() string {
+	return e.Message
+}
+
+func (e ExitError) ExitStatus() int {
+	return e.Code
+}

pkg/helmexec/helmexec.go

@@ -0,0 +1,40 @@
+package helmexec
+
+// Version represents the version of helm
+type Version struct {
+	Major int
+	Minor int
+	Patch int
+}
+
+// Interface for executing helm commands
+type Interface interface {
+	SetExtraArgs(args ...string)
+	SetHelmBinary(bin string)
+
+	AddRepo(name, repository, cafile, certfile, keyfile, username, password string, managed string) error
+	UpdateRepo() error
+	RegistryLogin(name string, username string, password string) error
+	BuildDeps(name, chart string) error
+	UpdateDeps(chart string) error
+	SyncRelease(context HelmContext, name, chart string, flags ...string) error
+	DiffRelease(context HelmContext, name, chart string, suppressDiff bool, flags ...string) error
+	TemplateRelease(name, chart string, flags ...string) error
+	Fetch(chart string, flags ...string) error
+	ChartPull(chart string, flags ...string) error
+	ChartExport(chart string, path string, flags ...string) error
+	Lint(name, chart string, flags ...string) error
+	ReleaseStatus(context HelmContext, name string, flags ...string) error
+	DeleteRelease(context HelmContext, name string, flags ...string) error
+	TestRelease(context HelmContext, name string, flags ...string) error
+	List(context HelmContext, filter string, flags ...string) (string, error)
+	DecryptSecret(context HelmContext, name string, flags ...string) (string, error)
+	IsHelm3() bool
+	GetVersion() Version
+	IsVersionAtLeast(versionStr string) bool
+}
+
+type DependencyUpdater interface {
+	UpdateDeps(chart string) error
+	IsHelm3() bool
+}

pkg/helmexec/id.go

@@ -0,0 +1,13 @@
+package helmexec
+
+import "math/rand"
+
+var executionIDComponents = []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")
+
+func newExecutionID() string {
+	b := make([]rune, 5)
+	for i := range b {
+		b[i] = executionIDComponents[rand.Intn(len(executionIDComponents))]
+	}
+	return string(b)
+}

pkg/helmexec/log.go

@@ -0,0 +1,27 @@
+package helmexec
+
+import (
+	"go.uber.org/zap"
+	"strings"
+)
+
+type logWriterGenerator struct {
+	log *zap.SugaredLogger
+}
+
+func (g logWriterGenerator) Writer(prefix string) *logWriter {
+	return &logWriter{
+		log:    g.log,
+		prefix: prefix,
+	}
+}
+
+type logWriter struct {
+	log    *zap.SugaredLogger
+	prefix string
+}
+
+func (w *logWriter) Write(p []byte) (int, error) {
+	w.log.Debugf("%s%s", w.prefix, strings.TrimSpace(string(p)))
+	return len(p), nil
+}

pkg/helmexec/runner.go

@@ -0,0 +1,134 @@
+package helmexec
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"syscall"
+
+	"go.uber.org/zap"
+)
+
+const (
+	tmpPrefix = "helmfile-"
+	tmpSuffix = "-exec"
+)
+
+// Runner interface for shell commands
+type Runner interface {
+	Execute(cmd string, args []string, env map[string]string) ([]byte, error)
+	ExecuteStdIn(cmd string, args []string, env map[string]string, stdin io.Reader) ([]byte, error)
+}
+
+// ShellRunner implemention for shell commands
+type ShellRunner struct {
+	Dir string
+
+	Logger *zap.SugaredLogger
+}
+
+// Execute a shell command
+func (shell ShellRunner) Execute(cmd string, args []string, env map[string]string) ([]byte, error) {
+	preparedCmd := exec.Command(cmd, args...)
+	preparedCmd.Dir = shell.Dir
+	preparedCmd.Env = mergeEnv(os.Environ(), env)
+	return Output(preparedCmd, &logWriterGenerator{
+		log: shell.Logger,
+	})
+}
+
+// Execute a shell command
+func (shell ShellRunner) ExecuteStdIn(cmd string, args []string, env map[string]string, stdin io.Reader) ([]byte, error) {
+	preparedCmd := exec.Command(cmd, args...)
+	preparedCmd.Dir = shell.Dir
+	preparedCmd.Env = mergeEnv(os.Environ(), env)
+	preparedCmd.Stdin = stdin
+	return Output(preparedCmd, &logWriterGenerator{
+		log: shell.Logger,
+	})
+}
+
+func Output(c *exec.Cmd, logWriterGenerators ...*logWriterGenerator) ([]byte, error) {
+	if c.Stdout != nil {
+		return nil, errors.New("exec: Stdout already set")
+	}
+	if c.Stderr != nil {
+		return nil, errors.New("exec: Stderr already set")
+	}
+
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	var combined bytes.Buffer
+
+	var logWriters []io.Writer
+
+	id := newExecutionID()
+	for _, g := range logWriterGenerators {
+		logPrefix := fmt.Sprintf("%s:%s> ", filepath.Base(c.Path), id)
+		logWriters = append(logWriters, g.Writer(logPrefix))
+	}
+
+	c.Stdout = io.MultiWriter(append([]io.Writer{&stdout, &combined}, logWriters...)...)
+	c.Stderr = io.MultiWriter(append([]io.Writer{&stderr, &combined}, logWriters...)...)
+
+	err := c.Run()
+
+	if err != nil {
+		// TrimSpace is necessary, because otherwise helmfile prints the redundant new-lines after each error like:
+		//
+		//   err: release "envoy2" in "helmfile.yaml" failed: exit status 1: Error: could not find a ready tiller pod
+		//   <redundant new line!>
+		//   err: release "envoy" in "helmfile.yaml" failed: exit status 1: Error: could not find a ready tiller pod
+		switch ee := err.(type) {
+		case *exec.ExitError:
+			// Propagate any non-zero exit status from the external command, rather than throwing it away,
+			// so that helmfile could return its own exit code accordingly
+			waitStatus := ee.Sys().(syscall.WaitStatus)
+			exitStatus := waitStatus.ExitStatus()
+			err = newExitError(c.Path, c.Args, exitStatus, ee, stderr.String(), combined.String())
+		default:
+			panic(fmt.Sprintf("unexpected error: %v", err))
+		}
+	}
+
+	return stdout.Bytes(), err
+}
+
+func mergeEnv(orig []string, new map[string]string) []string {
+	wanted := env2map(orig)
+	for k, v := range new {
+		wanted[k] = v
+	}
+	return map2env(wanted)
+}
+
+func map2env(wanted map[string]string) []string {
+	result := []string{}
+	for k, v := range wanted {
+		result = append(result, k+"="+v)
+	}
+	return result
+}
+
+func env2map(env []string) map[string]string {
+	wanted := map[string]string{}
+	for _, cur := range env {
+		pair := strings.SplitN(cur, "=", 2)
+
+		var v string
+
+		// An environment can completely miss `=` and the right side.
+		// If we didn't deal with that, this may fail due to an index-out-of-range error
+		if len(pair) > 1 {
+			v = pair[1]
+		}
+
+		wanted[pair[0]] = v
+	}
+	return wanted
+}

pkg/maputil/maputil.go

@@ -0,0 +1,191 @@
+package maputil
+
+import (
+	"fmt"
+	"strings"
+)
+
+func CastKeysToStrings(s interface{}) (map[string]interface{}, error) {
+	new := map[string]interface{}{}
+	switch src := s.(type) {
+	case map[interface{}]interface{}:
+		for k, v := range src {
+			var str_k string
+			switch typed_k := k.(type) {
+			case string:
+				str_k = typed_k
+			default:
+				return nil, fmt.Errorf("unexpected type of key in map: expected string, got %T: value=%v, map=%v", typed_k, typed_k, src)
+			}
+
+			casted_v, err := recursivelyStringifyMapKey(v)
+			if err != nil {
+				return nil, err
+			}
+
+			new[str_k] = casted_v
+		}
+	case map[string]interface{}:
+		for k, v := range src {
+			casted_v, err := recursivelyStringifyMapKey(v)
+			if err != nil {
+				return nil, err
+			}
+
+			new[k] = casted_v
+		}
+	}
+	return new, nil
+}
+
+func recursivelyStringifyMapKey(v interface{}) (interface{}, error) {
+	var casted_v interface{}
+	switch typed_v := v.(type) {
+	case map[interface{}]interface{}, map[string]interface{}:
+		tmp, err := CastKeysToStrings(typed_v)
+		if err != nil {
+			return nil, err
+		}
+		casted_v = tmp
+	case []interface{}:
+		a := []interface{}{}
+		for i := range typed_v {
+			res, err := recursivelyStringifyMapKey(typed_v[i])
+			if err != nil {
+				return nil, err
+			}
+			a = append(a, res)
+		}
+		casted_v = a
+	default:
+		casted_v = typed_v
+	}
+	return casted_v, nil
+}
+
+type arg interface {
+	getMap(map[string]interface{}) map[string]interface{}
+	set(map[string]interface{}, string)
+}
+
+type keyArg struct {
+	key string
+}
+
+func (a keyArg) getMap(m map[string]interface{}) map[string]interface{} {
+	_, ok := m[a.key]
+	if !ok {
+		m[a.key] = map[string]interface{}{}
+	}
+	switch t := m[a.key].(type) {
+	case map[string]interface{}:
+		return t
+	default:
+		panic(fmt.Errorf("unexpected type: %v(%T)", t, t))
+	}
+}
+
+func (a keyArg) set(m map[string]interface{}, value string) {
+	m[a.key] = value
+}
+
+type indexedKeyArg struct {
+	key   string
+	index int
+}
+
+func (a indexedKeyArg) getArray(m map[string]interface{}) []interface{} {
+	_, ok := m[a.key]
+	if !ok {
+		m[a.key] = make([]interface{}, a.index+1)
+	}
+	switch t := m[a.key].(type) {
+	case []interface{}:
+		if len(t) <= a.index {
+			t2 := make([]interface{}, a.index+1)
+			copy(t, t2)
+			t = t2
+		}
+		return t
+	default:
+		panic(fmt.Errorf("unexpected type: %v(%T)", t, t))
+	}
+}
+
+func (a indexedKeyArg) getMap(m map[string]interface{}) map[string]interface{} {
+	t := a.getArray(m)
+	if t[a.index] == nil {
+		t[a.index] = map[string]interface{}{}
+	}
+	switch t := t[a.index].(type) {
+	case map[string]interface{}:
+		return t
+	default:
+		panic(fmt.Errorf("unexpected type: %v(%T)", t, t))
+	}
+}
+
+func (a indexedKeyArg) set(m map[string]interface{}, value string) {
+	t := a.getArray(m)
+	t[a.index] = value
+	m[a.key] = t
+}
+
+func getCursor(key string) arg {
+	key = strings.ReplaceAll(key, "[", " ")
+	key = strings.ReplaceAll(key, "]", " ")
+	k := key
+	idx := 0
+
+	n, err := fmt.Sscanf(key, "%s %d", &k, &idx)
+
+	if n == 2 && err == nil {
+		return indexedKeyArg{
+			key:   k,
+			index: idx,
+		}
+	}
+
+	return keyArg{
+		key: key,
+	}
+}
+
+func ParseKey(key string) []string {
+	r := []string{}
+	part := ""
+	escaped := false
+	for _, rune := range key {
+		split := false
+		switch {
+		case escaped == false && rune == '\\':
+			escaped = true
+			continue
+		case rune == '.':
+			split = escaped == false
+		}
+		escaped = false
+		if split {
+			r = append(r, part)
+			part = ""
+		} else {
+			part = part + string(rune)
+		}
+	}
+	if len(part) > 0 {
+		r = append(r, part)
+	}
+	return r
+}
+
+func Set(m map[string]interface{}, key []string, value string) {
+	if len(key) == 0 {
+		panic(fmt.Errorf("bug: unexpected length of key: %d", len(key)))
+	}
+
+	for len(key) > 1 {
+		m, key = getCursor(key[0]).getMap(m), key[1:]
+	}
+
+	getCursor(key[0]).set(m, value)
+}

pkg/maputil/maputil_test.go

@@ -0,0 +1,130 @@
+package maputil
+
+import "testing"
+
+func TestMapUtil_StrKeys(t *testing.T) {
+	m := map[string]interface{}{
+		"a": []interface{}{
+			map[string]interface{}{
+				"b": []interface{}{
+					map[string]interface{}{
+						"c": "C",
+					},
+				},
+			},
+		},
+	}
+
+	r, err := CastKeysToStrings(m)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	a := r["a"].([]interface{})
+	a0 := a[0].(map[string]interface{})
+	b := a0["b"].([]interface{})
+	b0 := b[0].(map[string]interface{})
+	c := b0["c"]
+
+	if c != "C" {
+		t.Errorf("unexpected c: expected=C, got=%s", c)
+	}
+}
+
+func TestMapUtil_IFKeys(t *testing.T) {
+	m := map[interface{}]interface{}{
+		"a": []interface{}{
+			map[interface{}]interface{}{
+				"b": []interface{}{
+					map[interface{}]interface{}{
+						"c": "C",
+					},
+				},
+			},
+		},
+	}
+
+	r, err := CastKeysToStrings(m)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	a := r["a"].([]interface{})
+	a0 := a[0].(map[string]interface{})
+	b := a0["b"].([]interface{})
+	b0 := b[0].(map[string]interface{})
+	c := b0["c"]
+
+	if c != "C" {
+		t.Errorf("unexpected c: expected=C, got=%s", c)
+	}
+}
+
+func TestMapUtil_KeyArg(t *testing.T) {
+	m := map[string]interface{}{}
+
+	key := []string{"a", "b", "c"}
+
+	Set(m, key, "C")
+
+	c := (((m["a"].(map[string]interface{}))["b"]).(map[string]interface{}))["c"]
+
+	if c != "C" {
+		t.Errorf("unexpected c: expected=C, got=%s", c)
+	}
+}
+
+func TestMapUtil_IndexedKeyArg(t *testing.T) {
+	m := map[string]interface{}{}
+
+	key := []string{"a", "b[0]", "c"}
+
+	Set(m, key, "C")
+
+	c := (((m["a"].(map[string]interface{}))["b"].([]interface{}))[0].(map[string]interface{}))["c"]
+
+	if c != "C" {
+		t.Errorf("unexpected c: expected=C, got=%s", c)
+	}
+}
+
+type parseKeyTc struct {
+	key    string
+	result map[int]string
+}
+
+func TestMapUtil_ParseKey(t *testing.T) {
+	tcs := []parseKeyTc{
+		{
+			key: `a.b.c`,
+			result: map[int]string{
+				0: "a",
+				1: "b",
+				2: "c",
+			},
+		},
+		{
+			key: `a\.b.c`,
+			result: map[int]string{
+				0: "a.b",
+				1: "c",
+			},
+		},
+		{
+			key: `a\.b\.c`,
+			result: map[int]string{
+				0: "a.b.c",
+			},
+		},
+	}
+
+	for _, tc := range tcs {
+		parts := ParseKey(tc.key)
+
+		for index, value := range tc.result {
+			if parts[index] != value {
+				t.Errorf("unexpected key part[%d]: expected=%s, got=%s", index, value, parts[index])
+			}
+		}
+	}
+}

pkg/plugins/vals.go

@@ -0,0 +1,23 @@
+package plugins
+
+import (
+	"github.com/variantdev/vals"
+	"sync"
+)
+
+const (
+	// cache size for improving performance of ref+.* secrets rendering
+	valsCacheSize = 512
+)
+
+var instance *vals.Runtime
+var once sync.Once
+
+func ValsInstance() (*vals.Runtime, error) {
+	var err error
+	once.Do(func() {
+		instance, err = vals.New(vals.Options{CacheSize: valsCacheSize})
+	})
+
+	return instance, err
+}

pkg/plugins/vals_test.go

@@ -0,0 +1,17 @@
+package plugins
+
+import "testing"
+
+func TestValsInstance(t *testing.T) {
+	i, err := ValsInstance()
+
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	i2, _ := ValsInstance()
+
+	if i != i2 {
+		t.Error("Instances should be equal")
+	}
+}

pkg/remote/remote.go

@@ -0,0 +1,279 @@
+package remote
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"github.com/hashicorp/go-getter"
+	"github.com/hashicorp/go-getter/helper/url"
+	"go.uber.org/multierr"
+	"go.uber.org/zap"
+	"gopkg.in/yaml.v2"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+const DefaultCacheDir = ".helmfile/cache"
+
+type Remote struct {
+	Logger *zap.SugaredLogger
+
+	// Home is the home directory for helmfile. Usually this points to $HOME of the user running helmfile.
+	// Helmfile saves fetched remote files into .helmfile/cache under home
+	Home string
+
+	// Getter is the underlying implementation of getter used for fetching remote files
+	Getter Getter
+
+	// ReadFile is the implementation of the file reader that reads a local file from the specified path.
+	// Inject any implementation of your choice, like an im-memory impl for testing, ioutil.ReadFile for the real-world use.
+	ReadFile   func(string) ([]byte, error)
+	DirExists  func(string) bool
+	FileExists func(string) bool
+}
+
+func (r *Remote) Unmarshal(src string, dst interface{}) error {
+	bytes, err := r.GetBytes(src)
+	if err != nil {
+		return err
+	}
+
+	strs := strings.Split(src, "/")
+	file := strs[len(strs)-1]
+	ext := filepath.Ext(file)
+
+	{
+		r.Logger.Debugf("unmarshalling %s", string(bytes))
+
+		var err error
+		switch ext {
+		case "json":
+			err = json.Unmarshal(bytes, dst)
+		default:
+			err = yaml.Unmarshal(bytes, dst)
+		}
+
+		r.Logger.Debugf("unmarshalled to %v", dst)
+
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (r *Remote) GetBytes(goGetterSrc string) ([]byte, error) {
+	f, err := r.Fetch(goGetterSrc)
+	if err != nil {
+		return nil, err
+	}
+
+	bytes, err := r.ReadFile(f)
+	if err != nil {
+		return nil, fmt.Errorf("read file: %v", err)
+	}
+
+	return bytes, nil
+}
+
+// Locate takes an URL to a remote file or a path to a local file.
+// If the argument was an URL, it fetches the remote directory contained within the URL,
+// and returns the path to the file in the fetched directory
+func (r *Remote) Locate(urlOrPath string) (string, error) {
+	if r.FileExists(urlOrPath) || r.DirExists(urlOrPath) {
+		return urlOrPath, nil
+	}
+	fetched, err := r.Fetch(urlOrPath)
+	if err != nil {
+		switch err.(type) {
+		case InvalidURLError:
+			return urlOrPath, nil
+		}
+		return "", err
+	}
+	return fetched, nil
+}
+
+type InvalidURLError struct {
+	err string
+}
+
+func (e InvalidURLError) Error() string {
+	return e.err
+}
+
+type Source struct {
+	Getter, Scheme, User, Host, Dir, File, RawQuery string
+}
+
+func IsRemote(goGetterSrc string) bool {
+	if _, err := Parse(goGetterSrc); err != nil {
+		return false
+	}
+	return true
+}
+
+func Parse(goGetterSrc string) (*Source, error) {
+	items := strings.Split(goGetterSrc, "::")
+	var getter string
+	switch len(items) {
+	case 2:
+		getter = items[0]
+		goGetterSrc = items[1]
+	}
+
+	u, err := url.Parse(goGetterSrc)
+	if err != nil {
+		return nil, InvalidURLError{err: fmt.Sprintf("parse url: %v", err)}
+	}
+
+	if u.Scheme == "" {
+		return nil, InvalidURLError{err: fmt.Sprintf("parse url: missing scheme - probably this is a local file path? %s", goGetterSrc)}
+	}
+
+	pathComponents := strings.Split(u.Path, "@")
+	if len(pathComponents) != 2 {
+		return nil, fmt.Errorf("invalid src format: it must be `[<getter>::]<scheme>://<host>/<path/to/dir>@<path/to/file>?key1=val1&key2=val2: got %s", goGetterSrc)
+	}
+
+	return &Source{
+		Getter:   getter,
+		User:     u.User.String(),
+		Scheme:   u.Scheme,
+		Host:     u.Host,
+		Dir:      pathComponents[0],
+		File:     pathComponents[1],
+		RawQuery: u.RawQuery,
+	}, nil
+}
+
+func (r *Remote) Fetch(goGetterSrc string, cacheDirOpt ...string) (string, error) {
+	u, err := Parse(goGetterSrc)
+	if err != nil {
+		return "", err
+	}
+
+	srcDir := fmt.Sprintf("%s://%s%s", u.Scheme, u.Host, u.Dir)
+	file := u.File
+
+	r.Logger.Debugf("getter: %s", u.Getter)
+	r.Logger.Debugf("scheme: %s", u.Scheme)
+	r.Logger.Debugf("user: %s", u.User)
+	r.Logger.Debugf("host: %s", u.Host)
+	r.Logger.Debugf("dir: %s", u.Dir)
+	r.Logger.Debugf("file: %s", u.File)
+
+	// This should be shared across variant commands, so that they can share cache for the shared imports
+	cacheBaseDir := DefaultCacheDir
+	if len(cacheDirOpt) == 1 {
+		cacheBaseDir = cacheDirOpt[0]
+	} else if len(cacheDirOpt) > 0 {
+		return "", fmt.Errorf("[bug] cacheDirOpt's length: want 0 or 1, got %d", len(cacheDirOpt))
+	}
+
+	query := u.RawQuery
+
+	var cacheKey string
+	replacer := strings.NewReplacer(":", "", "//", "_", "/", "_", ".", "_")
+	dirKey := replacer.Replace(srcDir)
+	if len(query) > 0 {
+		paramsKey := strings.Replace(query, "&", "_", -1)
+		cacheKey = fmt.Sprintf("%s.%s", dirKey, paramsKey)
+	} else {
+		cacheKey = dirKey
+	}
+
+	cached := false
+
+	// e.g. .helmfile/cache/https_github_com_cloudposse_helmfiles_git.ref=0.xx.0
+	getterDst := filepath.Join(cacheBaseDir, cacheKey)
+
+	// e.g. $PWD/.helmfile/cache/https_github_com_cloudposse_helmfiles_git.ref=0.xx.0
+	cacheDirPath := filepath.Join(r.Home, getterDst)
+
+	r.Logger.Debugf("home: %s", r.Home)
+	r.Logger.Debugf("getter dest: %s", getterDst)
+	r.Logger.Debugf("cached dir: %s", cacheDirPath)
+
+	{
+		if r.FileExists(cacheDirPath) {
+			return "", fmt.Errorf("%s is not directory. please remove it so that variant could use it for dependency caching", getterDst)
+		}
+
+		if r.DirExists(cacheDirPath) {
+			cached = true
+		}
+	}
+
+	if !cached {
+		var getterSrc string
+		if u.User != "" {
+			getterSrc = fmt.Sprintf("%s://%s@%s%s", u.Scheme, u.User, u.Host, u.Dir)
+		} else {
+			getterSrc = fmt.Sprintf("%s://%s%s", u.Scheme, u.Host, u.Dir)
+		}
+
+		if len(query) > 0 {
+			getterSrc = strings.Join([]string{getterSrc, query}, "?")
+		}
+
+		if u.Getter != "" {
+			getterSrc = u.Getter + "::" + getterSrc
+		}
+
+		r.Logger.Debugf("downloading %s to %s", getterSrc, getterDst)
+
+		if err := r.Getter.Get(r.Home, getterSrc, cacheDirPath); err != nil {
+			rmerr := os.RemoveAll(cacheDirPath)
+			if rmerr != nil {
+				return "", multierr.Append(err, rmerr)
+			}
+			return "", err
+		}
+	}
+
+	return filepath.Join(cacheDirPath, file), nil
+}
+
+type Getter interface {
+	Get(wd, src, dst string) error
+}
+
+type GoGetter struct {
+	Logger *zap.SugaredLogger
+}
+
+func (g *GoGetter) Get(wd, src, dst string) error {
+	ctx := context.Background()
+
+	get := &getter.Client{
+		Ctx:     ctx,
+		Src:     src,
+		Dst:     dst,
+		Pwd:     wd,
+		Mode:    getter.ClientModeDir,
+		Options: []getter.ClientOption{},
+	}
+
+	g.Logger.Debugf("client: %+v", *get)
+
+	if err := get.Get(); err != nil {
+		return fmt.Errorf("get: %v", err)
+	}
+
+	return nil
+}
+
+func NewRemote(logger *zap.SugaredLogger, homeDir string, readFile func(string) ([]byte, error), dirExists func(string) bool, fileExists func(string) bool) *Remote {
+	remote := &Remote{
+		Logger:     logger,
+		Home:       homeDir,
+		Getter:     &GoGetter{Logger: logger},
+		ReadFile:   readFile,
+		DirExists:  dirExists,
+		FileExists: fileExists,
+	}
+	return remote
+}

pkg/remote/remote_test.go

@@ -0,0 +1,236 @@
+package remote
+
+import (
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/roboll/helmfile/pkg/helmexec"
+	"github.com/roboll/helmfile/pkg/testhelper"
+)
+
+func TestRemote_HttpsGitHub(t *testing.T) {
+	cleanfs := map[string]string{
+		"/path/to/home": "",
+	}
+	cachefs := map[string]string{
+		"/path/to/home/.helmfile/cache/https_github_com_cloudposse_helmfiles_git.ref=0.40.0/releases/kiam.yaml": "foo: bar",
+	}
+
+	type testcase struct {
+		files          map[string]string
+		expectCacheHit bool
+	}
+
+	testcases := []testcase{
+		{files: cleanfs, expectCacheHit: false},
+		{files: cachefs, expectCacheHit: true},
+	}
+
+	for i := range testcases {
+		testcase := testcases[i]
+
+		t.Run(fmt.Sprintf("case %d", i), func(t *testing.T) {
+			testfs := testhelper.NewTestFs(testcase.files)
+
+			hit := true
+
+			get := func(wd, src, dst string) error {
+				if wd != "/path/to/home" {
+					return fmt.Errorf("unexpected wd: %s", wd)
+				}
+				if src != "git::https://github.com/cloudposse/helmfiles.git?ref=0.40.0" {
+					return fmt.Errorf("unexpected src: %s", src)
+				}
+
+				hit = false
+
+				return nil
+			}
+
+			getter := &testGetter{
+				get: get,
+			}
+			remote := &Remote{
+				Logger:     helmexec.NewLogger(os.Stderr, "debug"),
+				Home:       "/path/to/home",
+				Getter:     getter,
+				ReadFile:   testfs.ReadFile,
+				FileExists: testfs.FileExistsAt,
+				DirExists:  testfs.DirectoryExistsAt,
+			}
+
+			// FYI, go-getter in the `dir` mode accepts URL like the below. So helmfile expects URLs similar to it:
+			//   go-getter -mode dir git::https://github.com/cloudposse/helmfiles.git?ref=0.40.0 gettertest1/b
+
+			// We use `@` to separate dir and the file path. This is a good idea borrowed from helm-git:
+			//   https://github.com/aslafy-z/helm-git
+
+			url := "git::https://github.com/cloudposse/helmfiles.git@releases/kiam.yaml?ref=0.40.0"
+			file, err := remote.Locate(url)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+
+			if file != "/path/to/home/.helmfile/cache/https_github_com_cloudposse_helmfiles_git.ref=0.40.0/releases/kiam.yaml" {
+				t.Errorf("unexpected file located: %s", file)
+			}
+
+			if testcase.expectCacheHit && !hit {
+				t.Errorf("unexpected result: unexpected cache miss")
+			}
+			if !testcase.expectCacheHit && hit {
+				t.Errorf("unexpected result: unexpected cache hit")
+			}
+		})
+	}
+}
+
+func TestRemote_SShGitHub(t *testing.T) {
+	cleanfs := map[string]string{
+		"/path/to/home": "",
+	}
+	cachefs := map[string]string{
+		"/path/to/home/.helmfile/cache/ssh_github_com_cloudposse_helmfiles_git.ref=0.40.0/releases/kiam.yaml": "foo: bar",
+	}
+
+	type testcase struct {
+		files          map[string]string
+		expectCacheHit bool
+	}
+
+	testcases := []testcase{
+		{files: cleanfs, expectCacheHit: false},
+		{files: cachefs, expectCacheHit: true},
+	}
+
+	for i := range testcases {
+		testcase := testcases[i]
+
+		t.Run(fmt.Sprintf("case %d", i), func(t *testing.T) {
+			testfs := testhelper.NewTestFs(testcase.files)
+
+			hit := true
+
+			get := func(wd, src, dst string) error {
+				if wd != "/path/to/home" {
+					return fmt.Errorf("unexpected wd: %s", wd)
+				}
+				if src != "git::ssh://git@github.com/cloudposse/helmfiles.git?ref=0.40.0" {
+					return fmt.Errorf("unexpected src: %s", src)
+				}
+
+				hit = false
+
+				return nil
+			}
+
+			getter := &testGetter{
+				get: get,
+			}
+			remote := &Remote{
+				Logger:     helmexec.NewLogger(os.Stderr, "debug"),
+				Home:       "/path/to/home",
+				Getter:     getter,
+				ReadFile:   testfs.ReadFile,
+				FileExists: testfs.FileExistsAt,
+				DirExists:  testfs.DirectoryExistsAt,
+			}
+
+			url := "git::ssh://git@github.com/cloudposse/helmfiles.git@releases/kiam.yaml?ref=0.40.0"
+			file, err := remote.Locate(url)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+
+			if file != "/path/to/home/.helmfile/cache/ssh_github_com_cloudposse_helmfiles_git.ref=0.40.0/releases/kiam.yaml" {
+				t.Errorf("unexpected file located: %s", file)
+			}
+
+			if testcase.expectCacheHit && !hit {
+				t.Errorf("unexpected result: unexpected cache miss")
+			}
+			if !testcase.expectCacheHit && hit {
+				t.Errorf("unexpected result: unexpected cache hit")
+			}
+		})
+	}
+}
+
+func TestParse(t *testing.T) {
+	type testcase struct {
+		input                            string
+		getter, scheme, dir, file, query string
+		err                              string
+	}
+
+	testcases := []testcase{
+		{
+			input: "raw/incubator",
+			err:   "parse url: missing scheme - probably this is a local file path? raw/incubator",
+		},
+		{
+			input:  "git::https://github.com/stakater/Forecastle.git@deployments/kubernetes/chart/forecastle?ref=v1.0.54",
+			getter: "git",
+			scheme: "https",
+			dir:    "/stakater/Forecastle.git",
+			file:   "deployments/kubernetes/chart/forecastle",
+			query:  "ref=v1.0.54",
+		},
+	}
+
+	for i := range testcases {
+		tc := testcases[i]
+
+		t.Run(fmt.Sprintf("case %d", i), func(t *testing.T) {
+			src, err := Parse(tc.input)
+
+			var errMsg string
+			if err != nil {
+				errMsg = err.Error()
+			}
+
+			if diff := cmp.Diff(tc.err, errMsg); diff != "" {
+				t.Fatalf("Unexpected error:\n%s", diff)
+			}
+
+			var getter, scheme, dir, file, query string
+			if src != nil {
+				getter = src.Getter
+				scheme = src.Scheme
+				dir = src.Dir
+				file = src.File
+				query = src.RawQuery
+			}
+
+			if diff := cmp.Diff(tc.getter, getter); diff != "" {
+				t.Fatalf("Unexpected getter:\n%s", diff)
+			}
+
+			if diff := cmp.Diff(tc.scheme, scheme); diff != "" {
+				t.Fatalf("Unexpected scheme:\n%s", diff)
+			}
+
+			if diff := cmp.Diff(tc.file, file); diff != "" {
+				t.Fatalf("Unexpected file:\n%s", diff)
+			}
+
+			if diff := cmp.Diff(tc.dir, dir); diff != "" {
+				t.Fatalf("Unexpected dir:\n%s", diff)
+			}
+
+			if diff := cmp.Diff(tc.query, query); diff != "" {
+				t.Fatalf("Unexpected query:\n%s", diff)
+			}
+		})
+	}
+}
+
+type testGetter struct {
+	get func(wd, src, dst string) error
+}
+
+func (t *testGetter) Get(wd, src, dst string) error {
+	return t.get(wd, src, dst)
+}

pkg/state/chart_dependency.go

@@ -0,0 +1,458 @@
+package state
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"github.com/Masterminds/semver/v3"
+	goversion "github.com/hashicorp/go-version"
+	"github.com/r3labs/diff"
+	"github.com/roboll/helmfile/pkg/app/version"
+	"github.com/roboll/helmfile/pkg/helmexec"
+	"go.uber.org/zap"
+	"gopkg.in/yaml.v2"
+)
+
+type ChartMeta struct {
+	Name string `yaml:"name"`
+}
+
+type unresolvedChartDependency struct {
+	// ChartName identifies the dependant chart. In Helmfile, ChartName for `chart: stable/envoy` would be just `envoy`.
+	// It can't be collided with other charts referenced in the same helmfile spec.
+	// That is, collocating `chart: incubator/foo` and `chart: stable/foo` isn't allowed. Name them differently for a work-around.
+	ChartName string `yaml:"name"`
+	// Repository contains the URL for the helm chart repository that hosts the chart identified by ChartName
+	Repository string `yaml:"repository"`
+	// VersionConstraint is the version constraint of the dependent chart. "*" means the latest version.
+	VersionConstraint string `yaml:"version"`
+}
+
+type ResolvedChartDependency struct {
+	// ChartName identifies the dependant chart. In Helmfile, ChartName for `chart: stable/envoy` would be just `envoy`.
+	// It can't be collided with other charts referenced in the same helmfile spec.
+	// That is, collocating `chart: incubator/foo` and `chart: stable/foo` isn't allowed. Name them differently for a work-around.
+	ChartName string `yaml:"name"`
+	// Repository contains the URL for the helm chart repository that hosts the chart identified by ChartName
+	Repository string `yaml:"repository"`
+	// Version is the version number of the dependent chart.
+	// In the context of helmfile this can be omitted. When omitted, it is considered `*` which results helm/helmfile fetching the latest version.
+	Version string `yaml:"version"`
+}
+
+type UnresolvedDependencies struct {
+	deps map[string][]unresolvedChartDependency
+}
+
+type ChartRequirements struct {
+	UnresolvedDependencies []unresolvedChartDependency `yaml:"dependencies"`
+}
+
+type ChartLockedRequirements struct {
+	Version              string                    `yaml:"version"`
+	ResolvedDependencies []ResolvedChartDependency `yaml:"dependencies"`
+	Digest               string                    `yaml:"digest"`
+	Generated            string                    `yaml:"generated"`
+}
+
+func (d *UnresolvedDependencies) Add(chart, url, versionConstraint string) error {
+	dep := unresolvedChartDependency{
+		ChartName:         chart,
+		Repository:        url,
+		VersionConstraint: versionConstraint,
+	}
+	return d.add(dep)
+}
+
+func (d *UnresolvedDependencies) add(dep unresolvedChartDependency) error {
+	deps := d.deps[dep.ChartName]
+	if deps == nil {
+		deps = []unresolvedChartDependency{dep}
+	} else {
+		deps = append(deps, dep)
+	}
+	d.deps[dep.ChartName] = deps
+	return nil
+}
+
+func (d *UnresolvedDependencies) ToChartRequirements() *ChartRequirements {
+	deps := []unresolvedChartDependency{}
+
+	for _, ds := range d.deps {
+		for _, d := range ds {
+			if d.VersionConstraint == "" {
+				d.VersionConstraint = "*"
+			}
+			deps = append(deps, d)
+		}
+	}
+
+	return &ChartRequirements{UnresolvedDependencies: deps}
+}
+
+type ResolvedDependencies struct {
+	deps map[string][]ResolvedChartDependency
+}
+
+func (d *ResolvedDependencies) add(dep ResolvedChartDependency) error {
+	deps := d.deps[dep.ChartName]
+	if deps == nil {
+		deps = []ResolvedChartDependency{dep}
+	} else {
+		deps = append(deps, dep)
+	}
+	d.deps[dep.ChartName] = deps
+	return nil
+}
+
+func (d *ResolvedDependencies) Get(chart, versionConstraint string) (string, error) {
+	if versionConstraint == "" {
+		versionConstraint = "*"
+	}
+
+	deps, exists := d.deps[chart]
+	if exists {
+		for _, dep := range deps {
+			constraint, err := semver.NewConstraint(versionConstraint)
+			if err != nil {
+				return "", err
+			}
+			version, err := semver.NewVersion(dep.Version)
+			if err != nil {
+				return "", err
+			}
+			if constraint.Check(version) {
+				return dep.Version, nil
+			}
+		}
+	}
+	return "", fmt.Errorf("no resolved dependency found for \"%s\", running \"helmfile deps\" may resolve the issue", chart)
+}
+
+func (st *HelmState) mergeLockedDependencies() (*HelmState, error) {
+	filename, unresolved, err := getUnresolvedDependenciess(st)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(unresolved.deps) == 0 {
+		return st, nil
+	}
+
+	depMan := NewChartDependencyManager(filename, st.logger)
+
+	if st.readFile != nil {
+		depMan.readFile = st.readFile
+	}
+
+	return resolveDependencies(st, depMan, unresolved)
+}
+
+func resolveDependencies(st *HelmState, depMan *chartDependencyManager, unresolved *UnresolvedDependencies) (*HelmState, error) {
+	resolved, lockfileExists, err := depMan.Resolve(unresolved)
+	if err != nil {
+		return nil, fmt.Errorf("unable to resolve %d deps: %v", len(unresolved.deps), err)
+	}
+	if !lockfileExists {
+		return st, nil
+	}
+
+	repoToURL := map[string]string{}
+
+	for _, r := range st.Repositories {
+		repoToURL[r.Name] = r.URL
+	}
+
+	updated := *st
+	for i, r := range updated.Releases {
+		repo, chart, ok := resolveRemoteChart(r.Chart)
+		if !ok {
+			continue
+		}
+
+		_, ok = repoToURL[repo]
+		// Skip this chart from dependency management, as there's no matching `repository` in the helmfile state,
+		// which may imply that this is a local chart within a directory, like `charts/myapp`
+		if !ok {
+			continue
+		}
+
+		ver, err := resolved.Get(chart, r.Version)
+		if err != nil {
+			return nil, err
+		}
+
+		updated.Releases[i].Version = ver
+	}
+
+	return &updated, nil
+}
+
+func (st *HelmState) updateDependenciesInTempDir(shell helmexec.DependencyUpdater, tempDir func(string, string) (string, error)) (*HelmState, error) {
+	filename, unresolved, err := getUnresolvedDependenciess(st)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(unresolved.deps) == 0 {
+		st.logger.Warnf("There are no repositories defined in your helmfile.yaml.\nThis means helmfile cannot update your dependencies or create a lock file.\nSee https://github.com/roboll/helmfile/issues/878 for more information.")
+		return st, nil
+	}
+
+	d, err := tempDir("", "")
+	if err != nil {
+		return nil, fmt.Errorf("unable to create dir: %v", err)
+	}
+	defer os.RemoveAll(d)
+
+	return updateDependencies(st, shell, unresolved, filename, d)
+}
+
+func getUnresolvedDependenciess(st *HelmState) (string, *UnresolvedDependencies, error) {
+	repoToURL := map[string]string{}
+
+	for _, r := range st.Repositories {
+		repoToURL[r.Name] = r.URL
+	}
+
+	unresolved := &UnresolvedDependencies{deps: map[string][]unresolvedChartDependency{}}
+	//if err := unresolved.Add("stable/envoy", "https://kubernetes-charts.storage.googleapis.com", ""); err != nil {
+	//	panic(err)
+	//}
+
+	for _, r := range st.Releases {
+		repo, chart, ok := resolveRemoteChart(r.Chart)
+		if !ok {
+			continue
+		}
+
+		url, ok := repoToURL[repo]
+		// Skip this chart from dependency management, as there's no matching `repository` in the helmfile state,
+		// which may imply that this is a local chart within a directory, like `charts/myapp`
+		if !ok {
+			continue
+		}
+
+		if err := unresolved.Add(chart, url, r.Version); err != nil {
+			return "", nil, err
+		}
+	}
+
+	filename := filepath.Base(st.FilePath)
+	filename = strings.TrimSuffix(filename, ".gotmpl")
+	filename = strings.TrimSuffix(filename, ".yaml")
+	filename = strings.TrimSuffix(filename, ".yml")
+
+	return filename, unresolved, nil
+}
+
+func updateDependencies(st *HelmState, shell helmexec.DependencyUpdater, unresolved *UnresolvedDependencies, filename, wd string) (*HelmState, error) {
+	depMan := NewChartDependencyManager(filename, st.logger)
+
+	_, err := depMan.Update(shell, wd, unresolved)
+	if err != nil {
+		return nil, fmt.Errorf("unable to update %d deps: %v", len(unresolved.deps), err)
+	}
+
+	return resolveDependencies(st, depMan, unresolved)
+}
+
+type chartDependencyManager struct {
+	Name string
+
+	logger *zap.SugaredLogger
+
+	readFile  func(string) ([]byte, error)
+	writeFile func(string, []byte, os.FileMode) error
+}
+
+func NewChartDependencyManager(name string, logger *zap.SugaredLogger) *chartDependencyManager {
+	return &chartDependencyManager{
+		Name:      name,
+		readFile:  ioutil.ReadFile,
+		writeFile: ioutil.WriteFile,
+		logger:    logger,
+	}
+}
+
+func (m *chartDependencyManager) lockFileName() string {
+	return fmt.Sprintf("%s.lock", m.Name)
+}
+
+func (m *chartDependencyManager) Update(shell helmexec.DependencyUpdater, wd string, unresolved *UnresolvedDependencies) (*ResolvedDependencies, error) {
+	if shell.IsHelm3() {
+		return m.updateHelm3(shell, wd, unresolved)
+	}
+	return m.updateHelm2(shell, wd, unresolved)
+}
+
+func (m *chartDependencyManager) updateHelm3(shell helmexec.DependencyUpdater, wd string, unresolved *UnresolvedDependencies) (*ResolvedDependencies, error) {
+	// Generate `Chart.yaml` of the temporary local chart
+	chartMetaContent := fmt.Sprintf("name: %s\nversion: 1.0.0\napiVersion: v2\n", m.Name)
+
+	// Generate `requirements.yaml` of the temporary local chart from the helmfile state
+	reqsContent, err := yaml.Marshal(unresolved.ToChartRequirements())
+	if err != nil {
+		return nil, err
+	}
+	if err := m.writeBytes(filepath.Join(wd, "Chart.yaml"), []byte(chartMetaContent+string(reqsContent))); err != nil {
+		return nil, err
+	}
+
+	return m.doUpdate("Chart.lock", unresolved, shell, wd)
+}
+
+func (m *chartDependencyManager) updateHelm2(shell helmexec.DependencyUpdater, wd string, unresolved *UnresolvedDependencies) (*ResolvedDependencies, error) {
+	// Generate `Chart.yaml` of the temporary local chart
+	if err := m.writeBytes(filepath.Join(wd, "Chart.yaml"), []byte(fmt.Sprintf("name: %s\nversion: 1.0.0\n", m.Name))); err != nil {
+		return nil, err
+	}
+
+	// Generate `requirements.yaml` of the temporary local chart from the helmfile state
+	reqsContent, err := yaml.Marshal(unresolved.ToChartRequirements())
+	if err != nil {
+		return nil, err
+	}
+	if err := m.writeBytes(filepath.Join(wd, "requirements.yaml"), reqsContent); err != nil {
+		return nil, err
+	}
+
+	return m.doUpdate("requirements.lock", unresolved, shell, wd)
+}
+
+func (m *chartDependencyManager) doUpdate(chartLockFile string, unresolved *UnresolvedDependencies, shell helmexec.DependencyUpdater, wd string) (*ResolvedDependencies, error) {
+
+	// Generate `requirements.lock` of the temporary local chart by coping `<basename>.lock`
+	lockFile := m.lockFileName()
+
+	originalLockFileContent, err := m.readBytes(lockFile)
+	if err != nil && !os.IsNotExist(err) {
+		return nil, err
+	}
+
+	if shell.IsHelm3() && originalLockFileContent != nil {
+		if err := m.writeBytes(filepath.Join(wd, chartLockFile), originalLockFileContent); err != nil {
+			return nil, err
+		}
+	}
+
+	// Update the lock file by running `helm dependency update`
+	if err := shell.UpdateDeps(wd); err != nil {
+		return nil, err
+	}
+
+	updatedLockFileContent, err := m.readBytes(filepath.Join(wd, chartLockFile))
+	if err != nil {
+		return nil, err
+	}
+
+	// Sort requirements alphabetically by name.
+	lockedReqs := &ChartLockedRequirements{}
+	if err := yaml.Unmarshal(updatedLockFileContent, lockedReqs); err != nil {
+		return nil, err
+	}
+
+	sort.Slice(lockedReqs.ResolvedDependencies, func(i, j int) bool {
+		return lockedReqs.ResolvedDependencies[i].ChartName < lockedReqs.ResolvedDependencies[j].ChartName
+	})
+
+	// Don't update lock file if no dependency updated.
+	if !shell.IsHelm3() && originalLockFileContent != nil {
+		originalLockedReqs := &ChartLockedRequirements{}
+		if err := yaml.Unmarshal(originalLockFileContent, originalLockedReqs); err != nil {
+			return nil, err
+		}
+
+		changes, err := diff.Diff(originalLockedReqs.ResolvedDependencies, lockedReqs.ResolvedDependencies)
+
+		if err != nil {
+			return nil, err
+		}
+
+		if len(changes) == 0 {
+			lockedReqs.Generated = originalLockedReqs.Generated
+		}
+	}
+
+	lockedReqs.Version = version.Version
+
+	updatedLockFileContent, err = yaml.Marshal(lockedReqs)
+
+	if err != nil {
+		return nil, err
+	}
+
+	// Commit the lock file if and only if everything looks ok
+	if err := m.writeBytes(lockFile, updatedLockFileContent); err != nil {
+		return nil, err
+	}
+
+	resolved, _, err := m.Resolve(unresolved)
+	return resolved, err
+}
+
+func (m *chartDependencyManager) Resolve(unresolved *UnresolvedDependencies) (*ResolvedDependencies, bool, error) {
+	updatedLockFileContent, err := m.readBytes(m.lockFileName())
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, false, nil
+		}
+		return nil, false, err
+	}
+
+	// Load resolved dependencies into memory
+	lockedReqs := &ChartLockedRequirements{}
+	if err := yaml.Unmarshal(updatedLockFileContent, lockedReqs); err != nil {
+		return nil, false, err
+	}
+
+	// Make sure go run main.go works and compatible with old lock files.
+	if version.Version != "" && lockedReqs.Version != "" {
+		lockedVersion, err := goversion.NewVersion(lockedReqs.Version)
+
+		if err != nil {
+			return nil, false, err
+		}
+
+		currentVersion, err := goversion.NewVersion(version.Version)
+
+		if err != nil {
+			return nil, false, err
+		}
+
+		if currentVersion.LessThan(lockedVersion) {
+			return nil, false, fmt.Errorf("the lockfile was created by Helmfile %s, which is newer than current %s; Please upgrade to Helmfile %s or greater", lockedVersion.Original(), currentVersion.Original(), lockedVersion.Original())
+		}
+	}
+
+	resolved := &ResolvedDependencies{deps: map[string][]ResolvedChartDependency{}}
+	for _, d := range lockedReqs.ResolvedDependencies {
+		if err := resolved.add(d); err != nil {
+			return nil, false, err
+		}
+	}
+
+	return resolved, true, nil
+}
+
+func (m *chartDependencyManager) readBytes(filename string) ([]byte, error) {
+	bytes, err := m.readFile(filename)
+	if err != nil {
+		return nil, err
+	}
+	m.logger.Debugf("readBytes: read from %s:\n%s", filename, bytes)
+	return bytes, nil
+}
+
+func (m *chartDependencyManager) writeBytes(filename string, data []byte) error {
+	err := m.writeFile(filename, data, 0644)
+	if err != nil {
+		return err
+	}
+	m.logger.Debugf("writeBytes: wrote to %s:\n%s", filename, data)
+	return nil
+}

pkg/state/create.go

@@ -0,0 +1,378 @@
+package state
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+
+	"github.com/roboll/helmfile/pkg/helmexec"
+	"github.com/roboll/helmfile/pkg/remote"
+
+	"github.com/imdario/mergo"
+	"github.com/roboll/helmfile/pkg/environment"
+	"github.com/roboll/helmfile/pkg/maputil"
+	"github.com/variantdev/vals"
+	"go.uber.org/zap"
+	"gopkg.in/yaml.v2"
+)
+
+const (
+	DefaultHelmBinary = "helm"
+)
+
+type StateLoadError struct {
+	msg   string
+	Cause error
+}
+
+func (e *StateLoadError) Error() string {
+	return fmt.Sprintf("%s: %v", e.msg, e.Cause)
+}
+
+type UndefinedEnvError struct {
+	msg string
+}
+
+func (e *UndefinedEnvError) Error() string {
+	return e.msg
+}
+
+type StateCreator struct {
+	logger *zap.SugaredLogger
+
+	readFile          func(string) ([]byte, error)
+	fileExists        func(string) (bool, error)
+	abs               func(string) (string, error)
+	glob              func(string) ([]string, error)
+	DeleteFile        func(string) error
+	directoryExistsAt func(string) bool
+
+	valsRuntime vals.Evaluator
+
+	Strict bool
+
+	LoadFile func(inheritedEnv *environment.Environment, baseDir, file string, evaluateBases bool) (*HelmState, error)
+
+	getHelm func(*HelmState) helmexec.Interface
+
+	overrideHelmBinary string
+
+	remote *remote.Remote
+}
+
+func NewCreator(logger *zap.SugaredLogger, readFile func(string) ([]byte, error), fileExists func(string) (bool, error), abs func(string) (string, error), glob func(string) ([]string, error), directoryExistsAt func(string) bool, valsRuntime vals.Evaluator, getHelm func(*HelmState) helmexec.Interface, overrideHelmBinary string, remote *remote.Remote) *StateCreator {
+	return &StateCreator{
+		logger: logger,
+
+		readFile:          readFile,
+		fileExists:        fileExists,
+		abs:               abs,
+		glob:              glob,
+		directoryExistsAt: directoryExistsAt,
+
+		Strict:      true,
+		valsRuntime: valsRuntime,
+		getHelm:     getHelm,
+
+		overrideHelmBinary: overrideHelmBinary,
+
+		remote: remote,
+	}
+}
+
+// Parse parses YAML into HelmState
+func (c *StateCreator) Parse(content []byte, baseDir, file string) (*HelmState, error) {
+	var state HelmState
+
+	state.FilePath = file
+	state.basePath = baseDir
+
+	decoder := yaml.NewDecoder(bytes.NewReader(content))
+	if !c.Strict {
+		decoder.SetStrict(false)
+	} else {
+		decoder.SetStrict(true)
+	}
+	i := 0
+	for {
+		i++
+
+		var intermediate HelmState
+
+		err := decoder.Decode(&intermediate)
+		if err == io.EOF {
+			break
+		} else if err != nil {
+			return nil, &StateLoadError{fmt.Sprintf("failed to read %s: reading document at index %d", file, i), err}
+		}
+
+		if err := mergo.Merge(&state, &intermediate, mergo.WithAppendSlice); err != nil {
+			return nil, &StateLoadError{fmt.Sprintf("failed to read %s: merging document at index %d", file, i), err}
+		}
+	}
+
+	if len(state.DeprecatedReleases) > 0 {
+		if len(state.Releases) > 0 {
+			return nil, fmt.Errorf("failed to parse %s: you can't specify both `charts` and `releases` sections", file)
+		}
+		state.Releases = state.DeprecatedReleases
+		state.DeprecatedReleases = []ReleaseSpec{}
+	}
+
+	if state.DeprecatedContext != "" && state.HelmDefaults.KubeContext == "" {
+		state.HelmDefaults.KubeContext = state.DeprecatedContext
+	}
+
+	if c.overrideHelmBinary != "" && c.overrideHelmBinary != DefaultHelmBinary {
+		state.DefaultHelmBinary = c.overrideHelmBinary
+	} else if state.DefaultHelmBinary == "" {
+		// Let `helmfile --helm-binary ""` not break this helmfile run
+		state.DefaultHelmBinary = DefaultHelmBinary
+	}
+
+	state.logger = c.logger
+
+	state.readFile = c.readFile
+	state.removeFile = os.Remove
+	state.fileExists = c.fileExists
+	state.glob = c.glob
+	state.directoryExistsAt = c.directoryExistsAt
+	state.valsRuntime = c.valsRuntime
+
+	return &state, nil
+}
+
+// LoadEnvValues loads environment values files relative to the `baseDir`
+func (c *StateCreator) LoadEnvValues(target *HelmState, env string, ctxEnv *environment.Environment, failOnMissingEnv bool) (*HelmState, error) {
+	state := *target
+
+	e, err := c.loadEnvValues(&state, env, failOnMissingEnv, ctxEnv, c.readFile, c.glob)
+	if err != nil {
+		return nil, &StateLoadError{fmt.Sprintf("failed to read %s", state.FilePath), err}
+	}
+
+	newDefaults, err := state.loadValuesEntries(nil, state.DefaultValues, c.remote)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := mergo.Merge(&e.Defaults, newDefaults, mergo.WithOverride, mergo.WithOverwriteWithEmptyValue); err != nil {
+		return nil, err
+	}
+
+	state.Env = *e
+
+	return &state, nil
+}
+
+// Parses YAML into HelmState, while loading environment values files relative to the `baseDir`
+// evaluateBases=true means that this is NOT a base helmfile
+func (c *StateCreator) ParseAndLoad(content []byte, baseDir, file string, envName string, evaluateBases bool, envValues *environment.Environment) (*HelmState, error) {
+	state, err := c.Parse(content, baseDir, file)
+	if err != nil {
+		return nil, err
+	}
+
+	if !evaluateBases {
+		if len(state.Bases) > 0 {
+			return nil, errors.New("nested `base` helmfile is unsupported. please submit a feature request if you need this!")
+		}
+	} else {
+		state, err = c.loadBases(envValues, state, baseDir)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	state, err = c.LoadEnvValues(state, envName, envValues, evaluateBases)
+	if err != nil {
+		return nil, err
+	}
+
+	state.FilePath = file
+
+	vals, err := state.Env.GetMergedValues()
+	if err != nil {
+		return nil, fmt.Errorf("rendering values: %w", err)
+	}
+	state.RenderedValues = vals
+
+	return state, nil
+}
+
+func (c *StateCreator) loadBases(envValues *environment.Environment, st *HelmState, baseDir string) (*HelmState, error) {
+	layers := []*HelmState{}
+	for _, b := range st.Bases {
+		base, err := c.LoadFile(envValues, baseDir, b, false)
+		if err != nil {
+			return nil, err
+		}
+		layers = append(layers, base)
+	}
+	layers = append(layers, st)
+
+	for i := 1; i < len(layers); i++ {
+		if err := mergo.Merge(layers[0], layers[i], mergo.WithAppendSlice); err != nil {
+			return nil, err
+		}
+	}
+
+	return layers[0], nil
+}
+
+func (c *StateCreator) loadEnvValues(st *HelmState, name string, failOnMissingEnv bool, ctxEnv *environment.Environment, readFile func(string) ([]byte, error), glob func(string) ([]string, error)) (*environment.Environment, error) {
+	envVals := map[string]interface{}{}
+	envSpec, ok := st.Environments[name]
+	if ok {
+		var err error
+		envVals, err = st.loadValuesEntries(envSpec.MissingFileHandler, envSpec.Values, c.remote)
+		if err != nil {
+			return nil, err
+		}
+
+		if len(envSpec.Secrets) > 0 {
+
+			var envSecretFiles []string
+			for _, urlOrPath := range envSpec.Secrets {
+				resolved, skipped, err := st.storage().resolveFile(envSpec.MissingFileHandler, "environment values", urlOrPath)
+				if err != nil {
+					return nil, err
+				}
+				if skipped {
+					continue
+				}
+
+				envSecretFiles = append(envSecretFiles, resolved...)
+			}
+			if err = c.scatterGatherEnvSecretFiles(st, envSecretFiles, envVals, readFile); err != nil {
+				return nil, err
+			}
+		}
+	} else if ctxEnv == nil && name != DefaultEnv && failOnMissingEnv {
+		return nil, &UndefinedEnvError{msg: fmt.Sprintf("environment \"%s\" is not defined", name)}
+	}
+
+	newEnv := &environment.Environment{Name: name, Values: envVals}
+
+	if ctxEnv != nil {
+		intEnv := *ctxEnv
+
+		if err := mergo.Merge(&intEnv, newEnv, mergo.WithOverride, mergo.WithOverwriteWithEmptyValue); err != nil {
+			return nil, fmt.Errorf("error while merging environment values for \"%s\": %v", name, err)
+		}
+
+		newEnv = &intEnv
+	}
+
+	return newEnv, nil
+}
+
+func (c *StateCreator) scatterGatherEnvSecretFiles(st *HelmState, envSecretFiles []string, envVals map[string]interface{}, readFile func(string) ([]byte, error)) error {
+	var errs []error
+
+	helm := c.getHelm(st)
+	inputs := envSecretFiles
+	inputsSize := len(inputs)
+
+	type secretResult struct {
+		id     int
+		result map[string]interface{}
+		err    error
+		path   string
+	}
+
+	type secretInput struct {
+		id   int
+		path string
+	}
+
+	secrets := make(chan secretInput, inputsSize)
+	results := make(chan secretResult, inputsSize)
+
+	st.scatterGather(0, inputsSize,
+		func() {
+			for i, secretFile := range envSecretFiles {
+				secrets <- secretInput{i, secretFile}
+			}
+			close(secrets)
+		},
+		func(id int) {
+			for secret := range secrets {
+				release := &ReleaseSpec{}
+				flags := st.appendConnectionFlags([]string{}, helm, release)
+				decFile, err := helm.DecryptSecret(st.createHelmContext(release, 0), secret.path, flags...)
+				if err != nil {
+					results <- secretResult{secret.id, nil, err, secret.path}
+					continue
+				}
+				defer func() {
+					if err := c.DeleteFile(decFile); err != nil {
+						c.logger.Warnf("removing decrypted file %s: %w", decFile, err)
+					}
+				}()
+				bytes, err := readFile(decFile)
+				if err != nil {
+					results <- secretResult{secret.id, nil, fmt.Errorf("failed to load environment secrets file \"%s\": %v", secret.path, err), secret.path}
+					continue
+				}
+				m := map[string]interface{}{}
+				if err := yaml.Unmarshal(bytes, &m); err != nil {
+					results <- secretResult{secret.id, nil, fmt.Errorf("failed to load environment secrets file \"%s\": %v", secret.path, err), secret.path}
+					continue
+				}
+				// All the nested map key should be string. Otherwise we get strange errors due to that
+				// mergo or reflect is unable to merge map[interface{}]interface{} with map[string]interface{} or vice versa.
+				// See https://github.com/roboll/helmfile/issues/677
+				vals, err := maputil.CastKeysToStrings(m)
+				if err != nil {
+					results <- secretResult{secret.id, nil, fmt.Errorf("failed to load environment secrets file \"%s\": %v", secret.path, err), secret.path}
+					continue
+				}
+				results <- secretResult{secret.id, vals, nil, secret.path}
+			}
+		},
+		func() {
+			sortedSecrets := make([]secretResult, inputsSize)
+
+			for i := 0; i < inputsSize; i++ {
+				result := <-results
+				sortedSecrets[result.id] = result
+			}
+			close(results)
+
+			for _, result := range sortedSecrets {
+				if result.err != nil {
+					errs = append(errs, result.err)
+				} else {
+					if err := mergo.Merge(&envVals, &result.result, mergo.WithOverride, mergo.WithOverwriteWithEmptyValue); err != nil {
+						errs = append(errs, fmt.Errorf("failed to load environment secrets file \"%s\": %v", result.path, err))
+					}
+				}
+			}
+		},
+	)
+
+	if len(errs) > 0 {
+		for _, err := range errs {
+			st.logger.Error(err)
+		}
+		return fmt.Errorf("Failed loading environment secrets with %d errors", len(errs))
+	}
+	return nil
+}
+
+func (st *HelmState) loadValuesEntries(missingFileHandler *string, entries []interface{}, remote *remote.Remote) (map[string]interface{}, error) {
+	envVals := map[string]interface{}{}
+
+	valuesEntries := append([]interface{}{}, entries...)
+	ld := NewEnvironmentValuesLoader(st.storage(), st.readFile, st.logger, remote)
+	var err error
+	envVals, err = ld.LoadEnvironmentValues(missingFileHandler, valuesEntries)
+	if err != nil {
+		return nil, err
+	}
+
+	return envVals, nil
+}

pkg/state/create_test.go

@@ -0,0 +1,486 @@
+package state
+
+import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	"github.com/roboll/helmfile/pkg/remote"
+
+	"github.com/roboll/helmfile/pkg/testhelper"
+	"go.uber.org/zap"
+
+	. "gotest.tools/v3/assert"
+	"gotest.tools/v3/assert/cmp"
+)
+
+func createFromYaml(content []byte, file string, env string, logger *zap.SugaredLogger) (*HelmState, error) {
+	c := &StateCreator{
+		logger:   logger,
+		readFile: ioutil.ReadFile,
+		abs:      filepath.Abs,
+
+		DeleteFile: os.Remove,
+		Strict:     true,
+	}
+	return c.ParseAndLoad(content, filepath.Dir(file), file, env, true, nil)
+}
+
+func TestReadFromYaml(t *testing.T) {
+	yamlFile := "example/path/to/yaml/file"
+	yamlContent := []byte(`releases:
+- name: myrelease
+  namespace: mynamespace
+  chart: mychart
+`)
+	state, err := createFromYaml(yamlContent, yamlFile, DefaultEnv, logger)
+	if err != nil {
+		t.Errorf("unxpected error: %v", err)
+	}
+
+	if state.Releases[0].Name != "myrelease" {
+		t.Errorf("unexpected release name: expected=myrelease actual=%s", state.Releases[0].Name)
+	}
+	if state.Releases[0].Namespace != "mynamespace" {
+		t.Errorf("unexpected chart namespace: expected=mynamespace actual=%s", state.Releases[0].Chart)
+	}
+	if state.Releases[0].Chart != "mychart" {
+		t.Errorf("unexpected chart name: expected=mychart actual=%s", state.Releases[0].Chart)
+	}
+}
+
+func TestReadFromYaml_NonexistentEnv(t *testing.T) {
+	yamlFile := "example/path/to/yaml/file"
+	yamlContent := []byte(`releases:
+- name: myrelease
+  namespace: mynamespace
+  chart: mychart
+`)
+	_, err := createFromYaml(yamlContent, yamlFile, "production", logger)
+	if err == nil {
+		t.Error("expected error")
+	}
+}
+
+type stateTestEnv struct {
+	Files   map[string]string
+	WorkDir string
+}
+
+func (testEnv stateTestEnv) MustLoadState(t *testing.T, file, envName string) *HelmState {
+	t.Helper()
+
+	testFs := testhelper.NewTestFs(testEnv.Files)
+
+	if testFs.Cwd == "" {
+		testFs.Cwd = "/"
+	}
+
+	yamlContent, ok := testEnv.Files[file]
+	if !ok {
+		t.Fatalf("no file named %q registered", file)
+	}
+
+	r := remote.NewRemote(logger, testFs.Cwd, testFs.ReadFile, testFs.DirectoryExistsAt, testFs.FileExistsAt)
+	state, err := NewCreator(logger, testFs.ReadFile, testFs.FileExists, testFs.Abs, testFs.Glob, testFs.DirectoryExistsAt, nil, nil, "", r).
+		ParseAndLoad([]byte(yamlContent), filepath.Dir(file), file, envName, true, nil)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	return state
+}
+
+func TestReadFromYaml_NonDefaultEnv(t *testing.T) {
+	yamlFile := "/example/path/to/helmfile.yaml"
+	yamlContent := []byte(`environments:
+  production:
+    values:
+    - foo.yaml
+    - bar.yaml.gotmpl
+
+releases:
+- name: myrelease
+  namespace: mynamespace
+  chart: mychart
+  values:
+  - values.yaml.gotmpl
+`)
+
+	fooYamlFile := "/example/path/to/foo.yaml"
+	fooYamlContent := []byte(`foo: foo
+# As this file doesn't have an file extension ".gotmpl", this template expression should not be evaluated
+baz: "{{ readFile \"baz.txt\" }}"`)
+
+	barYamlFile := "/example/path/to/bar.yaml.gotmpl"
+	barYamlContent := []byte(`foo: FOO
+bar: {{ readFile "bar.txt" }}
+`)
+
+	barTextFile := "/example/path/to/bar.txt"
+	barTextContent := []byte("BAR")
+
+	expected := map[string]interface{}{
+		"foo": "FOO",
+		"bar": "BAR",
+		// As the file doesn't have an file extension ".gotmpl", this template expression should not be evaluated
+		"baz": "{{ readFile \"baz.txt\" }}",
+	}
+
+	valuesFile := "/example/path/to/values.yaml.gotmpl"
+	valuesContent := []byte(`env: {{ .Environment.Name }}
+releaseName: {{ .Release.Name }}
+releaseNamespace: {{ .Release.Namespace }}
+`)
+
+	expectedValues := `env: production
+releaseName: myrelease
+releaseNamespace: mynamespace
+`
+
+	testFs := testhelper.NewTestFs(map[string]string{
+		fooYamlFile: string(fooYamlContent),
+		barYamlFile: string(barYamlContent),
+		barTextFile: string(barTextContent),
+		valuesFile:  string(valuesContent),
+	})
+	testFs.Cwd = "/example/path/to"
+
+	r := remote.NewRemote(logger, testFs.Cwd, testFs.ReadFile, testFs.DirectoryExistsAt, testFs.FileExistsAt)
+	state, err := NewCreator(logger, testFs.ReadFile, testFs.FileExists, testFs.Abs, testFs.Glob, testFs.DirectoryExistsAt, nil, nil, "", r).
+		ParseAndLoad(yamlContent, filepath.Dir(yamlFile), yamlFile, "production", true, nil)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	actual := state.Env.Values
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("unexpected environment values: expected=%v, actual=%v", expected, actual)
+	}
+
+	release := state.Releases[0]
+
+	state.ApplyOverrides(&release)
+
+	actualValuesData, err := state.RenderReleaseValuesFileToBytes(&release, valuesFile)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	actualValues := string(actualValuesData)
+
+	if !reflect.DeepEqual(expectedValues, actualValues) {
+		t.Errorf("unexpected values: expected=%v, actual=%v", expectedValues, actualValues)
+	}
+}
+
+func TestReadFromYaml_OverrideNamespace(t *testing.T) {
+	yamlFile := "/example/path/to/helmfile.yaml"
+	yamlContent := []byte(`environments:
+  production:
+    values:
+    - foo.yaml
+    - bar.yaml.gotmpl
+
+# A.k.a helmfile apply --namespace myns
+namespace: myns
+
+releases:
+- name: myrelease
+  namespace: mynamespace
+  chart: mychart
+  values:
+  - values.yaml.gotmpl
+`)
+
+	fooYamlFile := "/example/path/to/foo.yaml"
+	fooYamlContent := []byte(`foo: foo
+# As this file doesn't have an file extension ".gotmpl", this template expression should not be evaluated
+baz: "{{ readFile \"baz.txt\" }}"`)
+
+	barYamlFile := "/example/path/to/bar.yaml.gotmpl"
+	barYamlContent := []byte(`foo: FOO
+bar: {{ readFile "bar.txt" }}
+`)
+
+	barTextFile := "/example/path/to/bar.txt"
+	barTextContent := []byte("BAR")
+
+	expected := map[string]interface{}{
+		"foo": "FOO",
+		"bar": "BAR",
+		// As the file doesn't have an file extension ".gotmpl", this template expression should not be evaluated
+		"baz": "{{ readFile \"baz.txt\" }}",
+	}
+
+	valuesFile := "/example/path/to/values.yaml.gotmpl"
+	valuesContent := []byte(`env: {{ .Environment.Name }}
+releaseName: {{ .Release.Name }}
+releaseNamespace: {{ .Release.Namespace }}
+overrideNamespace: {{ .Namespace }}
+`)
+
+	expectedValues := `env: production
+releaseName: myrelease
+releaseNamespace: myns
+overrideNamespace: myns
+`
+
+	testFs := testhelper.NewTestFs(map[string]string{
+		fooYamlFile: string(fooYamlContent),
+		barYamlFile: string(barYamlContent),
+		barTextFile: string(barTextContent),
+		valuesFile:  string(valuesContent),
+	})
+	testFs.Cwd = "/example/path/to"
+
+	r := remote.NewRemote(logger, testFs.Cwd, testFs.ReadFile, testFs.DirectoryExistsAt, testFs.FileExistsAt)
+	state, err := NewCreator(logger, testFs.ReadFile, testFs.FileExists, testFs.Abs, testFs.Glob, testFs.DirectoryExistsAt, nil, nil, "", r).
+		ParseAndLoad(yamlContent, filepath.Dir(yamlFile), yamlFile, "production", true, nil)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	actual := state.Env.Values
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("unexpected environment values: expected=%v, actual=%v", expected, actual)
+	}
+
+	release := state.Releases[0]
+
+	state.ApplyOverrides(&release)
+
+	actualValuesData, err := state.RenderReleaseValuesFileToBytes(&release, valuesFile)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	actualValues := string(actualValuesData)
+
+	if !reflect.DeepEqual(expectedValues, actualValues) {
+		t.Errorf("unexpected values: expected=%v, actual=%v", expectedValues, actualValues)
+	}
+}
+
+func TestReadFromYaml_StrictUnmarshalling(t *testing.T) {
+	yamlFile := "example/path/to/yaml/file"
+	yamlContent := []byte(`releases:
+- name: myrelease
+  namespace: mynamespace
+  releases: mychart
+`)
+	_, err := createFromYaml(yamlContent, yamlFile, DefaultEnv, logger)
+	if err == nil {
+		t.Error("expected an error for wrong key 'releases' which is not in struct")
+	}
+}
+
+func TestReadFromYaml_DeprecatedReleaseReferences(t *testing.T) {
+	yamlFile := "example/path/to/yaml/file"
+	yamlContent := []byte(`charts:
+- name: myrelease
+  chart: mychart
+`)
+	state, err := createFromYaml(yamlContent, yamlFile, DefaultEnv, logger)
+	if err != nil {
+		t.Errorf("unxpected error: %v", err)
+	}
+
+	if state.Releases[0].Name != "myrelease" {
+		t.Errorf("unexpected release name: expected=myrelease actual=%s", state.Releases[0].Name)
+	}
+	if state.Releases[0].Chart != "mychart" {
+		t.Errorf("unexpected chart name: expected=mychart actual=%s", state.Releases[0].Chart)
+	}
+}
+
+func TestReadFromYaml_ConflictingReleasesConfig(t *testing.T) {
+	yamlFile := "example/path/to/yaml/file"
+	yamlContent := []byte(`charts:
+- name: myrelease1
+  chart: mychart1
+releases:
+- name: myrelease2
+  chart: mychart2
+`)
+	_, err := createFromYaml(yamlContent, yamlFile, DefaultEnv, logger)
+	if err == nil {
+		t.Error("expected error")
+	}
+}
+
+func TestReadFromYaml_FilterReleasesOnLabels(t *testing.T) {
+	yamlFile := "example/path/to/yaml/file"
+	yamlContent := []byte(`releases:
+- name: myrelease1
+  chart: mychart1
+  labels:
+    tier: frontend
+    foo: bar
+- name: myrelease2
+  chart: mychart2
+  labels:
+    tier: frontend
+- name: myrelease3
+  chart: mychart3
+  labels:
+    tier: backend
+`)
+	cases := []struct {
+		filter  LabelFilter
+		results []bool
+	}{
+		{LabelFilter{positiveLabels: [][]string{[]string{"tier", "frontend"}}},
+			[]bool{true, true, false}},
+		{LabelFilter{positiveLabels: [][]string{[]string{"tier", "frontend"}, []string{"foo", "bar"}}},
+			[]bool{true, false, false}},
+		{LabelFilter{negativeLabels: [][]string{[]string{"tier", "frontend"}}},
+			[]bool{false, false, true}},
+		{LabelFilter{positiveLabels: [][]string{[]string{"tier", "frontend"}}, negativeLabels: [][]string{[]string{"foo", "bar"}}},
+			[]bool{false, true, false}},
+	}
+	state, err := createFromYaml(yamlContent, yamlFile, DefaultEnv, logger)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	for idx, c := range cases {
+		for idx2, expected := range c.results {
+			if f := c.filter.Match(state.Releases[idx2]); f != expected {
+				t.Errorf("[case: %d][outcome: %d] Unexpected outcome wanted %t, got %t", idx, idx2, expected, f)
+			}
+		}
+	}
+}
+
+func TestReadFromYaml_FilterNegatives(t *testing.T) {
+	yamlFile := "example/path/to/yaml/file"
+	yamlContent := []byte(`releases:
+- name: myrelease1
+  chart: mychart1
+  labels:
+    stage: pre
+    foo: bar
+- name: myrelease2
+  chart: mychart2
+  labels:
+    stage: post
+- name: myrelease3
+  chart: mychart3
+`)
+	cases := []struct {
+		filter  LabelFilter
+		results []bool
+	}{
+		{LabelFilter{positiveLabels: [][]string{[]string{"stage", "pre"}}},
+			[]bool{true, false, false}},
+		{LabelFilter{positiveLabels: [][]string{[]string{"stage", "post"}}},
+			[]bool{false, true, false}},
+		{LabelFilter{negativeLabels: [][]string{[]string{"stage", "pre"}, []string{"stage", "post"}}},
+			[]bool{false, false, true}},
+		{LabelFilter{negativeLabels: [][]string{[]string{"foo", "bar"}}},
+			[]bool{false, true, true}},
+	}
+	state, err := createFromYaml(yamlContent, yamlFile, DefaultEnv, logger)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	for idx, c := range cases {
+		for idx2, expected := range c.results {
+			if f := c.filter.Match(state.Releases[idx2]); f != expected {
+				t.Errorf("[case: %d][outcome: %d] Unexpected outcome wanted %t, got %t", idx, idx2, expected, f)
+			}
+		}
+	}
+}
+
+func TestReadFromYaml_Helmfiles_Selectors(t *testing.T) {
+	tests := []struct {
+		path      string
+		content   []byte
+		wantErr   bool
+		helmfiles []SubHelmfileSpec
+	}{
+		{
+			path: "working/selector",
+			content: []byte(`helmfiles:
+- simple/helmfile.yaml
+- path: path/prefix/selector.yaml
+  selectors:
+    - name=zorba
+    - foo=bar
+- path: path/prefix/empty/selector.yaml
+  selectors: []
+- path: path/prefix/inherits/selector.yaml
+  selectorsInherited: true
+`),
+			wantErr: false,
+			helmfiles: []SubHelmfileSpec{{Path: "simple/helmfile.yaml", Selectors: nil, SelectorsInherited: false},
+				{Path: "path/prefix/selector.yaml", Selectors: []string{"name=zorba", "foo=bar"}, SelectorsInherited: false},
+				{Path: "path/prefix/empty/selector.yaml", Selectors: []string{}, SelectorsInherited: false},
+				{Path: "path/prefix/inherits/selector.yaml", Selectors: nil, SelectorsInherited: true},
+			},
+		},
+		{
+			path: "failing2/selector",
+			content: []byte(`helmfiles:
+- path: failing2/helmfile.yaml
+    wrongkey:
+`),
+			wantErr: true,
+		},
+		{
+			path: "failing3/selector",
+			content: []byte(`helmfiles:
+- path: failing3/helmfile.yaml
+    selectors: foo
+`),
+			wantErr: true,
+		},
+		{
+			path: "failing4/selector",
+			content: []byte(`helmfiles:
+- path: failing4/helmfile.yaml
+    selectors:
+`),
+			wantErr: true,
+		},
+		{
+			path: "failing4/selector",
+			content: []byte(`helmfiles:
+- path: failing4/helmfile.yaml
+    selectors:
+      - colon: not-authorized
+`),
+			wantErr: true,
+		},
+		{
+			path: "failing6/selector",
+			content: []byte(`helmfiles:
+- selectors:
+    - whatever
+`),
+			wantErr: true,
+		},
+		{
+			path: "failing7/selector",
+			content: []byte(`helmfiles:
+- path: foo/bar
+  selectors:
+  - foo=bar
+  selectorsInherited: true
+`),
+			wantErr: true,
+		},
+	}
+	for _, test := range tests {
+		st, err := createFromYaml(test.content, test.path, DefaultEnv, logger)
+		if err != nil {
+			if test.wantErr {
+				continue
+			} else {
+				t.Error("unexpected error:", err)
+			}
+		}
+		Assert(t, cmp.DeepEqual(st.Helmfiles, test.helmfiles), "for path %v", test.path)
+	}
+}

pkg/state/environment.go

@@ -0,0 +1,16 @@
+package state
+
+type EnvironmentSpec struct {
+	Values      []interface{} `yaml:"values,omitempty"`
+	Secrets     []string      `yaml:"secrets,omitempty"`
+	KubeContext string        `yaml:"kubeContext,omitempty"`
+
+	// MissingFileHandler instructs helmfile to fail when unable to find a environment values file listed
+	// under `environments.NAME.values`.
+	//
+	// Possible values are  "Error", "Warn", "Info", "Debug". The default is "Error".
+	//
+	// Use "Warn", "Info", or "Debug" if you want helmfile to not fail when a values file is missing, while just leaving
+	// a message about the missing file at the log-level.
+	MissingFileHandler *string `yaml:"missingFileHandler,omitempty"`
+}

pkg/state/envvals_loader.go

@@ -0,0 +1,92 @@
+package state
+
+import (
+	"fmt"
+	"github.com/imdario/mergo"
+	"github.com/roboll/helmfile/pkg/environment"
+	"github.com/roboll/helmfile/pkg/maputil"
+	"github.com/roboll/helmfile/pkg/remote"
+	"github.com/roboll/helmfile/pkg/tmpl"
+	"go.uber.org/zap"
+	"gopkg.in/yaml.v2"
+	"path/filepath"
+)
+
+type EnvironmentValuesLoader struct {
+	storage *Storage
+
+	readFile func(string) ([]byte, error)
+
+	logger *zap.SugaredLogger
+
+	remote *remote.Remote
+}
+
+func NewEnvironmentValuesLoader(storage *Storage, readFile func(string) ([]byte, error), logger *zap.SugaredLogger, remote *remote.Remote) *EnvironmentValuesLoader {
+	return &EnvironmentValuesLoader{
+		storage:  storage,
+		readFile: readFile,
+		logger:   logger,
+		remote:   remote,
+	}
+}
+
+func (ld *EnvironmentValuesLoader) LoadEnvironmentValues(missingFileHandler *string, valuesEntries []interface{}) (map[string]interface{}, error) {
+	result := map[string]interface{}{}
+
+	for _, entry := range valuesEntries {
+		maps := []interface{}{}
+
+		switch strOrMap := entry.(type) {
+		case string:
+			urlOrPath := strOrMap
+			localPath, err := ld.remote.Locate(urlOrPath)
+			if err == nil {
+				urlOrPath = localPath
+			}
+
+			files, skipped, err := ld.storage.resolveFile(missingFileHandler, "environment values", urlOrPath)
+			if err != nil {
+				return nil, err
+			}
+			if skipped {
+				continue
+			}
+
+			for _, f := range files {
+				tmplData := EnvironmentTemplateData{environment.EmptyEnvironment, "", map[string]interface{}{}}
+				r := tmpl.NewFileRenderer(ld.readFile, filepath.Dir(f), tmplData)
+				bytes, err := r.RenderToBytes(f)
+				if err != nil {
+					return nil, fmt.Errorf("failed to load environment values file \"%s\": %v", f, err)
+				}
+				m := map[string]interface{}{}
+				if err := yaml.Unmarshal(bytes, &m); err != nil {
+					return nil, fmt.Errorf("failed to load environment values file \"%s\": %v\n\nOffending YAML:\n%s", f, err, bytes)
+				}
+				maps = append(maps, m)
+				if ld.logger != nil {
+					ld.logger.Debugf("envvals_loader: loaded %s:%v", strOrMap, m)
+				}
+			}
+		case map[interface{}]interface{}:
+			maps = append(maps, strOrMap)
+		default:
+			return nil, fmt.Errorf("unexpected type of value: value=%v, type=%T", strOrMap, strOrMap)
+		}
+		for _, m := range maps {
+			// All the nested map key should be string. Otherwise we get strange errors due to that
+			// mergo or reflect is unable to merge map[interface{}]interface{} with map[string]interface{} or vice versa.
+			// See https://github.com/roboll/helmfile/issues/677
+			vals, err := maputil.CastKeysToStrings(m)
+			if err != nil {
+				return nil, err
+			}
+			if err := mergo.Merge(&result, &vals, mergo.WithOverride, mergo.WithOverwriteWithEmptyValue); err != nil {
+				return nil, fmt.Errorf("failed to merge %v: %v", m, err)
+			}
+		}
+	}
+
+	return result, nil
+}

pkg/state/envvals_loader_test.go

@@ -0,0 +1,120 @@
+package state
+
+import (
+	"github.com/google/go-cmp/cmp"
+	"github.com/roboll/helmfile/pkg/remote"
+	"go.uber.org/zap"
+	"io/ioutil"
+	"path/filepath"
+	"testing"
+)
+
+func newLoader() *EnvironmentValuesLoader {
+	log, err := zap.NewDevelopment(zap.AddStacktrace(zap.DebugLevel))
+	if err != nil {
+		panic(err)
+	}
+
+	sugar := log.Sugar()
+
+	storage := &Storage{
+		FilePath: "./helmfile.yaml",
+		basePath: ".",
+		glob:     filepath.Glob,
+		logger:   sugar,
+	}
+
+	readFile := func(s string) ([]byte, error) { return []byte{}, nil }
+	dirExists := func(d string) bool { return false }
+	fileExists := func(f string) bool { return false }
+	return NewEnvironmentValuesLoader(storage, ioutil.ReadFile, sugar, remote.NewRemote(sugar, "/tmp", readFile, dirExists, fileExists))
+}
+
+// See https://github.com/roboll/helmfile/pull/1169
+func TestEnvValsLoad_SingleValuesFile(t *testing.T) {
+	l := newLoader()
+
+	actual, err := l.LoadEnvironmentValues(nil, []interface{}{"testdata/values.5.yaml"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected := map[string]interface{}{
+		"affinity": map[string]interface{}{},
+	}
+
+	if diff := cmp.Diff(expected, actual); diff != "" {
+		t.Errorf(diff)
+	}
+}
+
+// See https://github.com/roboll/helmfile/issues/1150
+func TestEnvValsLoad_OverwriteNilValue_Issue1150(t *testing.T) {
+	l := newLoader()
+
+	actual, err := l.LoadEnvironmentValues(nil, []interface{}{"testdata/values.1.yaml", "testdata/values.2.yaml"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected := map[string]interface{}{
+		"components": map[string]interface{}{
+			"etcd-operator": map[string]interface{}{
+				"version": "0.10.3",
+			},
+		},
+	}
+
+	if diff := cmp.Diff(expected, actual); diff != "" {
+		t.Errorf(diff)
+	}
+}
+
+// See https://github.com/roboll/helmfile/issues/1154
+func TestEnvValsLoad_OverwriteWithNilValue_Issue1154(t *testing.T) {
+	l := newLoader()
+
+	actual, err := l.LoadEnvironmentValues(nil, []interface{}{"testdata/values.3.yaml", "testdata/values.4.yaml"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected := map[string]interface{}{
+		"components": map[string]interface{}{
+			"etcd-operator": map[string]interface{}{
+				"version": "0.10.3",
+			},
+			"prometheus": nil,
+		},
+	}
+
+	if diff := cmp.Diff(expected, actual); diff != "" {
+		t.Errorf(diff)
+	}
+}
+
+// See https://github.com/roboll/helmfile/issues/1168
+func TestEnvValsLoad_OverwriteEmptyValue_Issue1168(t *testing.T) {
+	l := newLoader()
+
+	actual, err := l.LoadEnvironmentValues(nil, []interface{}{"testdata/issues/1168/addons.yaml", "testdata/issues/1168/addons2.yaml"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected := map[string]interface{}{
+		"addons": map[string]interface{}{
+			"mychart": map[string]interface{}{
+				"skip":      false,
+				"name":      "mychart",
+				"namespace": "kube-system",
+				"chart":     "stable/mychart",
+				"version":   "1.0.0",
+			},
+		},
+	}
+
+	if diff := cmp.Diff(expected, actual); diff != "" {
+		t.Errorf(diff)
+	}
+}

pkg/state/helmx.go

@@ -0,0 +1,211 @@
+package state
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/roboll/helmfile/pkg/helmexec"
+	"github.com/roboll/helmfile/pkg/remote"
+	"github.com/variantdev/chartify"
+)
+
+type Dependency struct {
+	Chart   string `yaml:"chart"`
+	Version string `yaml:"version"`
+	Alias   string `yaml:"alias"`
+}
+
+func (st *HelmState) appendHelmXFlags(flags []string, release *ReleaseSpec) ([]string, error) {
+	for _, adopt := range release.Adopt {
+		flags = append(flags, "--adopt", adopt)
+	}
+
+	return flags, nil
+}
+
+func fileExistsAt(path string) bool {
+	fileInfo, err := os.Stat(path)
+	return err == nil && fileInfo.Mode().IsRegular()
+}
+
+func directoryExistsAt(path string) bool {
+	fileInfo, err := os.Stat(path)
+	return err == nil && fileInfo.Mode().IsDir()
+}
+
+type Chartify struct {
+	Opts  *chartify.ChartifyOpts
+	Clean func()
+}
+
+func (st *HelmState) downloadChartWithGoGetter(r *ReleaseSpec) (string, error) {
+	pathElems := []string{
+		remote.DefaultCacheDir,
+	}
+
+	if r.Namespace != "" {
+		pathElems = append(pathElems, r.Namespace)
+	}
+
+	if r.KubeContext != "" {
+		pathElems = append(pathElems, r.KubeContext)
+	}
+
+	pathElems = append(pathElems, r.Name)
+
+	cacheDir := filepath.Join(pathElems...)
+
+	return st.goGetterChart(r.Chart, r.Directory, cacheDir, r.ForceGoGetter)
+}
+
+func (st *HelmState) goGetterChart(chart, dir, cacheDir string, force bool) (string, error) {
+	if dir != "" && chart == "" {
+		chart = dir
+	}
+
+	_, err := remote.Parse(chart)
+	if err != nil {
+		if force {
+			return "", fmt.Errorf("Parsing url from dir failed due to error %q.\nContinuing the process assuming this is a regular Helm chart or a local dir.", err.Error())
+		}
+	} else {
+		r := remote.NewRemote(st.logger, st.basePath, st.readFile, directoryExistsAt, fileExistsAt)
+
+		fetchedDir, err := r.Fetch(chart, cacheDir)
+		if err != nil {
+			return "", fmt.Errorf("fetching %q: %v", chart, err)
+		}
+
+		chart = fetchedDir
+	}
+
+	return chart, nil
+}
+
+func (st *HelmState) PrepareChartify(helm helmexec.Interface, release *ReleaseSpec, chart string, workerIndex int) (*Chartify, func(), error) {
+	c := &Chartify{
+		Opts: &chartify.ChartifyOpts{
+			WorkaroundOutputDirIssue:    true,
+			EnableKustomizeAlphaPlugins: true,
+			ChartVersion:                release.Version,
+			Namespace:                   release.Namespace,
+			ID:                          ReleaseToID(release),
+		},
+	}
+
+	var filesNeedCleaning []string
+
+	clean := func() {
+		st.removeFiles(filesNeedCleaning)
+	}
+
+	var shouldRun bool
+
+	dir := filepath.Join(st.basePath, chart)
+	if stat, _ := os.Stat(dir); stat != nil && stat.IsDir() {
+		if exists, err := st.fileExists(filepath.Join(dir, "Chart.yaml")); err == nil && !exists {
+			shouldRun = true
+		}
+	}
+
+	for _, d := range release.Dependencies {
+		chart := d.Chart
+		if st.directoryExistsAt(chart) {
+			var err error
+
+			// Otherwise helm-dependency-up on the temporary chart generated by chartify ends up errors like:
+			//   Error: directory /tmp/chartify945964195/myapp-57fb4495cf/test/integration/charts/httpbin not found]
+			// which is due to that the temporary chart is generated outside of the current working directory/basePath,
+			// and therefore the relative path in `chart` points to somewhere inexistent.
+			chart, err = filepath.Abs(filepath.Join(st.basePath, chart))
+			if err != nil {
+				return nil, clean, err
+			}
+		}
+
+		c.Opts.AdhocChartDependencies = append(c.Opts.AdhocChartDependencies, chartify.ChartDependency{
+			Alias:   d.Alias,
+			Chart:   chart,
+			Version: d.Version,
+		})
+
+		shouldRun = true
+	}
+
+	jsonPatches := release.JSONPatches
+	if len(jsonPatches) > 0 {
+		generatedFiles, err := st.generateTemporaryReleaseValuesFiles(release, jsonPatches, release.MissingFileHandler)
+		if err != nil {
+			return nil, clean, err
+		}
+
+		filesNeedCleaning = append(filesNeedCleaning, generatedFiles...)
+
+		for _, f := range generatedFiles {
+			c.Opts.JsonPatches = append(c.Opts.JsonPatches, f)
+		}
+
+		shouldRun = true
+	}
+
+	strategicMergePatches := release.StrategicMergePatches
+	if len(strategicMergePatches) > 0 {
+		generatedFiles, err := st.generateTemporaryReleaseValuesFiles(release, strategicMergePatches, release.MissingFileHandler)
+		if err != nil {
+			return nil, clean, err
+		}
+
+		for _, f := range generatedFiles {
+			c.Opts.StrategicMergePatches = append(c.Opts.StrategicMergePatches, f)
+		}
+
+		filesNeedCleaning = append(filesNeedCleaning, generatedFiles...)
+
+		shouldRun = true
+	}
+
+	transformers := release.Transformers
+	if len(transformers) > 0 {
+		generatedFiles, err := st.generateTemporaryReleaseValuesFiles(release, transformers, release.MissingFileHandler)
+		if err != nil {
+			return nil, clean, err
+		}
+
+		for _, f := range generatedFiles {
+			c.Opts.Transformers = append(c.Opts.Transformers, f)
+		}
+
+		filesNeedCleaning = append(filesNeedCleaning, generatedFiles...)
+
+		shouldRun = true
+	}
+
+	if release.ForceNamespace != "" {
+		c.Opts.OverrideNamespace = release.ForceNamespace
+
+		shouldRun = true
+	}
+
+	if shouldRun {
+		generatedFiles, err := st.generateValuesFiles(helm, release, workerIndex)
+		if err != nil {
+			return nil, clean, err
+		}
+
+		filesNeedCleaning = append(filesNeedCleaning, generatedFiles...)
+
+		c.Opts.ValuesFiles = generatedFiles
+		setFlags, err := st.setFlags(release.SetValues)
+		if err != nil {
+			return nil, clean, fmt.Errorf("rendering set value entry for release %s: %v", release.Name, err)
+		}
+		c.Opts.SetFlags = setFlags
+		c.Opts.TemplateData = st.newReleaseTemplateData(release)
+		c.Opts.TemplateFuncs = st.newReleaseTemplateFuncMap(dir)
+
+		return c, clean, nil
+	}
+
+	return nil, clean, nil
+}

pkg/state/release.go

@@ -0,0 +1,211 @@
+package state
+
+import (
+	"fmt"
+
+	"github.com/roboll/helmfile/pkg/tmpl"
+	"gopkg.in/yaml.v2"
+)
+
+func (r ReleaseSpec) ExecuteTemplateExpressions(renderer *tmpl.FileRenderer) (*ReleaseSpec, error) {
+	var result *ReleaseSpec
+	var err error
+
+	result, err = r.Clone()
+	if err != nil {
+		return nil, fmt.Errorf("failed executing template expressions in release \"%s\": %v", r.Name, err)
+	}
+
+	{
+		ts := result.Name
+		result.Name, err = renderer.RenderTemplateContentToString([]byte(ts))
+		if err != nil {
+			return nil, fmt.Errorf("failed executing template expressions in release \"%s\".name = \"%s\": %v", r.Name, ts, err)
+		}
+	}
+
+	{
+		ts := result.Chart
+		result.Chart, err = renderer.RenderTemplateContentToString([]byte(ts))
+		if err != nil {
+			return nil, fmt.Errorf("failed executing template expressions in release \"%s\".chart = \"%s\": %v", r.Name, ts, err)
+		}
+	}
+
+	{
+		ts := result.Namespace
+		result.Namespace, err = renderer.RenderTemplateContentToString([]byte(ts))
+		if err != nil {
+			return nil, fmt.Errorf("failed executing template expressions in release \"%s\".namespace = \"%s\": %v", r.Name, ts, err)
+		}
+	}
+
+	{
+		ts := result.Version
+		result.Version, err = renderer.RenderTemplateContentToString([]byte(ts))
+		if err != nil {
+			return nil, fmt.Errorf("failed executing template expressions in release \"%s\".version = \"%s\": %v", r.Name, ts, err)
+		}
+	}
+
+	if result.WaitTemplate != nil {
+		ts := *result.WaitTemplate
+		resultTmpl, err := renderer.RenderTemplateContentToString([]byte(ts))
+		if err != nil {
+			return nil, fmt.Errorf("failed executing template expressions in release \"%s\".version = \"%s\": %v", r.Name, ts, err)
+		}
+		result.WaitTemplate = &resultTmpl
+	}
+
+	if result.InstalledTemplate != nil {
+		ts := *result.InstalledTemplate
+		resultTmpl, err := renderer.RenderTemplateContentToString([]byte(ts))
+		if err != nil {
+			return nil, fmt.Errorf("failed executing template expressions in release \"%s\".version = \"%s\": %v", r.Name, ts, err)
+		}
+		result.InstalledTemplate = &resultTmpl
+	}
+
+	if result.TillerlessTemplate != nil {
+		ts := *result.TillerlessTemplate
+		resultTmpl, err := renderer.RenderTemplateContentToString([]byte(ts))
+		if err != nil {
+			return nil, fmt.Errorf("failed executing template expressions in release \"%s\".version = \"%s\": %v", r.Name, ts, err)
+		}
+		result.TillerlessTemplate = &resultTmpl
+	}
+
+	if result.VerifyTemplate != nil {
+		ts := *result.VerifyTemplate
+		resultTmpl, err := renderer.RenderTemplateContentToString([]byte(ts))
+		if err != nil {
+			return nil, fmt.Errorf("failed executing template expressions in release \"%s\".version = \"%s\": %v", r.Name, ts, err)
+		}
+		result.VerifyTemplate = &resultTmpl
+	}
+
+	for key, val := range result.Labels {
+		ts := val
+		s, err := renderer.RenderTemplateContentToBuffer([]byte(ts))
+		if err != nil {
+			return nil, fmt.Errorf("failed executing template expressions in release \"%s\".labels[%s] = \"%s\": %v", r.Name, key, ts, err)
+		}
+		result.Labels[key] = s.String()
+	}
+
+	if len(result.ValuesTemplate) > 0 {
+		for i, t := range result.ValuesTemplate {
+			switch ts := t.(type) {
+			case map[interface{}]interface{}:
+				serialized, err := yaml.Marshal(ts)
+				if err != nil {
+					return nil, fmt.Errorf("failed executing template expressions in release \"%s\".values[%d] = \"%v\": %v", r.Name, i, ts, err)
+				}
+
+				s, err := renderer.RenderTemplateContentToBuffer([]byte(serialized))
+				if err != nil {
+					return nil, fmt.Errorf("failed executing template expressions in release \"%s\".values[%d] = \"%v\": %v", r.Name, i, serialized, err)
+				}
+
+				var deserialized map[interface{}]interface{}
+
+				if err := yaml.Unmarshal(s.Bytes(), &deserialized); err != nil {
+					return nil, fmt.Errorf("failed executing template expressions in release \"%s\".values[%d] = \"%v\": %v", r.Name, i, ts, err)
+				}
+
+				result.ValuesTemplate[i] = deserialized
+			}
+		}
+
+		var newvals []interface{}
+		newvals = append(newvals, result.ValuesTemplate...)
+		result.Values = append(newvals, result.Values...)
+	}
+
+	for i, t := range result.Values {
+		switch ts := t.(type) {
+		case string:
+			s, err := renderer.RenderTemplateContentToBuffer([]byte(ts))
+			if err != nil {
+				return nil, fmt.Errorf("failed executing template expressions in release \"%s\".values[%d] = \"%s\": %v", r.Name, i, ts, err)
+			}
+			result.Values[i] = s.String()
+		}
+	}
+
+	for i, t := range result.Secrets {
+		switch ts := t.(type) {
+		case string:
+			s, err := renderer.RenderTemplateContentToBuffer([]byte(ts))
+			if err != nil {
+				return nil, fmt.Errorf("failed executing template expressions in release \"%s\".secrets[%d] = \"%s\": %v", r.Name, i, ts, err)
+			}
+			result.Secrets[i] = s.String()
+		}
+	}
+
+	if len(result.SetValuesTemplate) > 0 {
+		for i, val := range result.SetValuesTemplate {
+			{
+				// name
+				ts := val.Name
+				s, err := renderer.RenderTemplateContentToBuffer([]byte(ts))
+				if err != nil {
+					return nil, fmt.Errorf("failed executing template expressions in release \"%s\".set[%d].name = \"%s\": %v", r.Name, i, ts, err)
+				}
+				result.SetValuesTemplate[i].Name = s.String()
+			}
+			{
+				// value
+				ts := val.Value
+				s, err := renderer.RenderTemplateContentToBuffer([]byte(ts))
+				if err != nil {
+					return nil, fmt.Errorf("failed executing template expressions in release \"%s\".set[%d].value = \"%s\": %v", r.Name, i, ts, err)
+				}
+				result.SetValuesTemplate[i].Value = s.String()
+			}
+			{
+				// file
+				ts := val.File
+				s, err := renderer.RenderTemplateContentToBuffer([]byte(ts))
+				if err != nil {
+					return nil, fmt.Errorf("failed executing template expressions in release \"%s\".set[%d].file = \"%s\": %v", r.Name, i, ts, err)
+				}
+				result.SetValuesTemplate[i].File = s.String()
+			}
+			for j, ts := range val.Values {
+				// values
+				s, err := renderer.RenderTemplateContentToBuffer([]byte(ts))
+				if err != nil {
+					return nil, fmt.Errorf("failed executing template expressions in release \"%s\".set[%d].values[%d] = \"%s\": %v", r.Name, i, j, ts, err)
+				}
+				result.SetValuesTemplate[i].Values[j] = s.String()
+			}
+		}
+
+		var newvals []SetValue
+		newvals = append(newvals, result.SetValuesTemplate...)
+		result.SetValues = append(newvals, result.SetValues...)
+	}
+
+	return result, nil
+}
+
+func (r ReleaseSpec) Clone() (*ReleaseSpec, error) {
+	serialized, err := yaml.Marshal(r)
+	if err != nil {
+		return nil, fmt.Errorf("failed cloning release \"%s\": %v", r.Name, err)
+	}
+
+	var deserialized ReleaseSpec
+
+	if err := yaml.Unmarshal(serialized, &deserialized); err != nil {
+		return nil, fmt.Errorf("failed cloning release \"%s\": %v", r.Name, err)
+	}
+
+	return &deserialized, nil
+}
+
+func (r ReleaseSpec) Desired() bool {
+	return r.Installed == nil || *r.Installed
+}

pkg/state/release_error.go

@@ -0,0 +1,31 @@
+package state
+
+import (
+	"fmt"
+)
+
+const ReleaseErrorCodeFailure = 1
+
+type ReleaseError struct {
+	*ReleaseSpec
+	err  error
+	Code int
+}
+
+func (e *ReleaseError) Error() string {
+	return e.err.Error()
+}
+
+func NewReleaseError(release *ReleaseSpec, err error, code int) *ReleaseError {
+	return &ReleaseError{
+		ReleaseSpec: release,
+		err:         err,
+		Code:        code,
+	}
+}
+
+func newReleaseFailedError(release *ReleaseSpec, err error) *ReleaseError {
+	wrappedErr := fmt.Errorf("failed processing release %s: %v", release.Name, err.Error())
+
+	return NewReleaseError(release, wrappedErr, ReleaseErrorCodeFailure)
+}

pkg/state/release_filters.go

@@ -38,7 +38,7 @@ func (l LabelFilter) Match(r ReleaseSpec) bool {
 			k := element[0]
 			v := element[1]
 			if rVal, ok := r.Labels[k]; !ok {
-				return true
+
 			} else if rVal == v {
 				return false
 			}

pkg/state/selector_test.go

@@ -0,0 +1,97 @@
+package state
+
+import (
+	"github.com/google/go-cmp/cmp"
+	"testing"
+)
+
+func TestSelectReleasesWithOverrides(t *testing.T) {
+	type testcase struct {
+		subject  string
+		selector []string
+		want     []string
+	}
+
+	testcases := []testcase{
+		{
+			subject:  "multiple OR selectors (nillable label first)",
+			selector: []string{"type=bar", "name=nolabel2", "name=nolabel1"},
+			want:     []string{"nolabel1", "nolabel2", "foo"},
+		},
+		{
+			subject:  "multiple OR selectors (non-nillable label first)",
+			selector: []string{"name=foo", "type!=bar"},
+			want:     []string{"nolabel1", "nolabel2", "foo"},
+		},
+		{
+			subject:  "multiple AND conditions (nillable label first)",
+			selector: []string{"type!=bar,name!=nolabel2"},
+			want:     []string{"nolabel1"},
+		},
+		{
+			subject:  "multiple AND conditions (non-nillable label first)",
+			selector: []string{"name!=nolabel2,type!=bar"},
+			want:     []string{"nolabel1"},
+		},
+		{
+			subject:  "inequality on nillable label",
+			selector: []string{"type!=bar"},
+			want:     []string{"nolabel1", "nolabel2"},
+		},
+		{
+			subject:  "equality on nillable label",
+			selector: []string{"type=bar"},
+			want:     []string{"foo"},
+		},
+		{
+			subject:  "inequality on non-nillable label",
+			selector: []string{"name!=nolabel1"},
+			want:     []string{"nolabel2", "foo"},
+		},
+		{
+			subject:  "equality on non-nillable label",
+			selector: []string{"name=nolabel1"},
+			want:     []string{"nolabel1"},
+		},
+	}
+
+	example := []byte(`releases:
+- name: nolabel1
+  namespace: kube-system
+  chart: stable/nolabel
+- name: nolabel2
+  namespace: default
+  chart: stable/nolabel
+- name: foo
+  namespace: kube-system
+  chart: stable/foo
+  labels:
+    type: bar
+`)
+
+	state := stateTestEnv{
+		Files: map[string]string{
+			"/helmfile.yaml": string(example),
+		},
+		WorkDir: "/",
+	}.MustLoadState(t, "/helmfile.yaml", "default")
+
+	for _, tc := range testcases {
+		state.Selectors = tc.selector
+
+		rs, err := state.GetSelectedReleasesWithOverrides()
+		if err != nil {
+			t.Fatalf("%s %s: %v", tc.selector, tc.subject, err)
+		}
+
+		var got []string
+
+		for _, r := range rs {
+			got = append(got, r.Name)
+		}
+
+		if d := cmp.Diff(tc.want, got); d != "" {
+			t.Errorf("%s %s: %s", tc.selector, tc.subject, d)
+		}
+	}
+}

pkg/state/state_exec_tmpl.go

@@ -0,0 +1,127 @@
+package state
+
+import (
+	"fmt"
+	"reflect"
+
+	"github.com/roboll/helmfile/pkg/tmpl"
+	"gopkg.in/yaml.v2"
+)
+
+func (st *HelmState) Values() map[string]interface{} {
+	if st.RenderedValues == nil {
+		panic("[bug] RenderedValues is nil")
+	}
+
+	return st.RenderedValues
+}
+
+func (st *HelmState) createReleaseTemplateData(release *ReleaseSpec, vals map[string]interface{}) releaseTemplateData {
+	tmplData := releaseTemplateData{
+		Environment: st.Env,
+		KubeContext: st.OverrideKubeContext,
+		Namespace:   st.OverrideNamespace,
+		Chart:       st.OverrideChart,
+		Values:      vals,
+		Release: releaseTemplateDataRelease{
+			Name:        release.Name,
+			Chart:       release.Chart,
+			Namespace:   release.Namespace,
+			Labels:      release.Labels,
+			KubeContext: release.KubeContext,
+		},
+	}
+	tmplData.StateValues = &tmplData.Values
+	return tmplData
+}
+
+func getBoolRefFromStringTemplate(templateRef string) (*bool, error) {
+	var result bool
+	if err := yaml.Unmarshal([]byte(templateRef), &result); err != nil {
+		return nil, fmt.Errorf("failed deserialising string %s: %v", templateRef, err)
+	}
+	return &result, nil
+}
+
+func updateBoolTemplatedValues(r *ReleaseSpec) error {
+
+	if r.InstalledTemplate != nil {
+		if installed, err := getBoolRefFromStringTemplate(*r.InstalledTemplate); err != nil {
+			return fmt.Errorf("installedTemplate: %v", err)
+		} else {
+			r.InstalledTemplate = nil
+			r.Installed = installed
+		}
+	}
+
+	if r.WaitTemplate != nil {
+		if wait, err := getBoolRefFromStringTemplate(*r.WaitTemplate); err != nil {
+			return fmt.Errorf("waitTemplate: %v", err)
+		} else {
+			r.WaitTemplate = nil
+			r.Wait = wait
+		}
+	}
+
+	if r.TillerlessTemplate != nil {
+		if tillerless, err := getBoolRefFromStringTemplate(*r.TillerlessTemplate); err != nil {
+			return fmt.Errorf("tillerlessTemplate: %v", err)
+		} else {
+			r.TillerlessTemplate = nil
+			r.Tillerless = tillerless
+		}
+	}
+
+	if r.VerifyTemplate != nil {
+		if verify, err := getBoolRefFromStringTemplate(*r.VerifyTemplate); err != nil {
+			return fmt.Errorf("verifyTemplate: %v", err)
+		} else {
+			r.VerifyTemplate = nil
+			r.Verify = verify
+		}
+	}
+
+	return nil
+}
+
+func (st *HelmState) ExecuteTemplates() (*HelmState, error) {
+	r := *st
+
+	vals := st.Values()
+
+	for i, rt := range st.Releases {
+		if rt.KubeContext == "" {
+			rt.KubeContext = r.HelmDefaults.KubeContext
+		}
+		if rt.Labels == nil {
+			rt.Labels = map[string]string{}
+		}
+		for k, v := range st.CommonLabels {
+			rt.Labels[k] = v
+		}
+		successFlag := false
+		for it, prev := 0, &rt; it < 6; it++ {
+			tmplData := st.createReleaseTemplateData(prev, vals)
+			renderer := tmpl.NewFileRenderer(st.readFile, st.basePath, tmplData)
+			r, err := rt.ExecuteTemplateExpressions(renderer)
+			if err != nil {
+				return nil, fmt.Errorf("failed executing templates in release \"%s\".\"%s\": %v", st.FilePath, rt.Name, err)
+			}
+			if reflect.DeepEqual(prev, r) {
+				successFlag = true
+				if err := updateBoolTemplatedValues(r); err != nil {
+					return nil, fmt.Errorf("failed executing templates in release \"%s\".\"%s\": %v", st.FilePath, rt.Name, err)
+				}
+				st.Releases[i] = *r
+				break
+			}
+			prev = r
+		}
+		if !successFlag {
+			return nil, fmt.Errorf("failed executing templates in release \"%s\".\"%s\": %s", st.FilePath, rt.Name,
+				"recursive references can't be resolved")
+		}
+	}
+
+	return &r, nil
+}

pkg/state/state_exec_tmpl_test.go

@@ -0,0 +1,262 @@
+package state
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/go-test/deep"
+	"github.com/roboll/helmfile/pkg/environment"
+)
+
+func boolPtrToString(ptr *bool) string {
+	if ptr == nil {
+		return "<nil>"
+	}
+	return fmt.Sprintf("&%t", *ptr)
+}
+
+func ptr(v interface{}) interface{} {
+	r := v
+	return reflect.ValueOf(r).Addr().Interface()
+}
+
+func TestHelmState_executeTemplates(t *testing.T) {
+	tests := []struct {
+		name  string
+		input ReleaseSpec
+		want  ReleaseSpec
+	}{
+		{
+			name: "Has template expressions in chart, values, secrets, version, labels",
+			input: ReleaseSpec{
+				Chart:          "test-charts/{{ .Release.Name }}",
+				Version:        "{{ .Release.Name }}-0.1",
+				Name:           "test-app",
+				Namespace:      "test-namespace-{{ .Release.Name }}",
+				ValuesTemplate: []interface{}{"config/{{ .Environment.Name }}/{{ .Release.Name }}/values.yaml"},
+				Secrets:        []interface{}{"config/{{ .Environment.Name }}/{{ .Release.Name }}/secrets.yaml"},
+				Labels:         map[string]string{"id": "{{ .Release.Name }}"},
+			},
+			want: ReleaseSpec{
+				Chart:     "test-charts/test-app",
+				Version:   "test-app-0.1",
+				Name:      "test-app",
+				Namespace: "test-namespace-test-app",
+				Values:    []interface{}{"config/test_env/test-app/values.yaml"},
+				Secrets:   []interface{}{"config/test_env/test-app/secrets.yaml"},
+				Labels:    map[string]string{"id": "test-app"},
+			},
+		},
+		{
+			name: "Has template expressions in name with recursive refs",
+			input: ReleaseSpec{
+				Chart:     "test-chart",
+				Name:      "{{ .Release.Labels.id }}-{{ .Release.Namespace }}",
+				Namespace: "dev",
+				Labels:    map[string]string{"id": "{{ .Release.Chart }}"},
+			},
+			want: ReleaseSpec{
+				Chart:     "test-chart",
+				Name:      "test-chart-dev",
+				Namespace: "dev",
+				Labels:    map[string]string{"id": "test-chart"},
+			},
+		},
+		{
+			name: "Has template expressions in boolean values",
+			input: ReleaseSpec{
+				Chart:              "test-chart",
+				Name:               "app-dev",
+				Namespace:          "dev",
+				Labels:             map[string]string{"id": "app"},
+				InstalledTemplate:  func(i string) *string { return &i }(`{{ eq .Release.Labels.id "app" | ternary "yes" "no" }}`),
+				VerifyTemplate:     func(i string) *string { return &i }(`{{ true }}`),
+				Verify:             func(i bool) *bool { return &i }(false),
+				WaitTemplate:       func(i string) *string { return &i }(`{{ false }}`),
+				TillerlessTemplate: func(i string) *string { return &i }(`yes`),
+			},
+			want: ReleaseSpec{
+				Chart:      "test-chart",
+				Name:       "app-dev",
+				Namespace:  "dev",
+				Labels:     map[string]string{"id": "app"},
+				Installed:  func(i bool) *bool { return &i }(true),
+				Verify:     func(i bool) *bool { return &i }(true),
+				Wait:       func(i bool) *bool { return &i }(false),
+				Tillerless: func(i bool) *bool { return &i }(true),
+			},
+		},
+		{
+			name: "Has template in set-values",
+			input: ReleaseSpec{
+				Chart:     "test-charts/chart",
+				Name:      "test-app",
+				Namespace: "dev",
+				SetValuesTemplate: []SetValue{
+					SetValue{Name: "val1", Value: "{{ .Release.Name }}-val1"},
+					SetValue{Name: "val2", File: "{{ .Release.Name }}.yml"},
+					SetValue{Name: "val3", Values: []string{"{{ .Release.Name }}-val2", "{{ .Release.Name }}-val3"}},
+				},
+			},
+			want: ReleaseSpec{
+				Chart:     "test-charts/chart",
+				Name:      "test-app",
+				Namespace: "dev",
+				SetValues: []SetValue{
+					SetValue{Name: "val1", Value: "test-app-val1"},
+					SetValue{Name: "val2", File: "test-app.yml"},
+					SetValue{Name: "val3", Values: []string{"test-app-val2", "test-app-val3"}},
+				},
+			},
+		},
+		{
+			name: "Has template in values (map)",
+			input: ReleaseSpec{
+				Chart:          "test-charts/chart",
+				Verify:         nil,
+				Name:           "app",
+				Namespace:      "dev",
+				ValuesTemplate: []interface{}{map[string]string{"key": "{{ .Release.Name }}-val0"}},
+			},
+			want: ReleaseSpec{
+				Chart:     "test-charts/chart",
+				Verify:    nil,
+				Name:      "app",
+				Namespace: "dev",
+				Values:    []interface{}{map[interface{}]interface{}{"key": "app-val0"}},
+			},
+		},
+	}
+
+	for i := range tests {
+		tt := tests[i]
+		t.Run(tt.name, func(t *testing.T) {
+			state := &HelmState{
+				basePath: ".",
+				ReleaseSetSpec: ReleaseSetSpec{
+					HelmDefaults: HelmSpec{
+						KubeContext: "test_context",
+					},
+					Env:               environment.Environment{Name: "test_env"},
+					OverrideNamespace: "test-namespace_",
+					Repositories:      nil,
+					Releases: []ReleaseSpec{
+						tt.input,
+					},
+				},
+				RenderedValues: map[string]interface{}{},
+			}
+
+			r, err := state.ExecuteTemplates()
+			if err != nil {
+				t.Errorf("Unexpected error: %v", err)
+				t.FailNow()
+			}
+
+			actual := r.Releases[0]
+
+			if !reflect.DeepEqual(actual.Name, tt.want.Name) {
+				t.Errorf("expected Name %+v, got %+v", tt.want.Name, actual.Name)
+			}
+			if !reflect.DeepEqual(actual.Chart, tt.want.Chart) {
+				t.Errorf("expected Chart %+v, got %+v", tt.want.Chart, actual.Chart)
+			}
+			if !reflect.DeepEqual(actual.Namespace, tt.want.Namespace) {
+				t.Errorf("expected Namespace %+v, got %+v", tt.want.Namespace, actual.Namespace)
+			}
+			if diff := deep.Equal(actual.Values, tt.want.Values); diff != nil && len(actual.Values) > 0 {
+				t.Errorf("Values differs \n%+v", strings.Join(diff, "\n"))
+			}
+			if diff := deep.Equal(actual.Secrets, tt.want.Secrets); diff != nil && len(actual.Secrets) > 0 {
+				t.Errorf("Secrets differs \n%+v", strings.Join(diff, "\n"))
+			}
+			if diff := deep.Equal(actual.SetValues, tt.want.SetValues); diff != nil && len(actual.SetValues) > 0 {
+				t.Errorf("SetValues differs \n%+v", strings.Join(diff, "\n"))
+			}
+			if diff := deep.Equal(actual.Labels, tt.want.Labels); diff != nil && len(actual.Labels) > 0 {
+				t.Errorf("Labels differs \n%+v", strings.Join(diff, "\n"))
+			}
+			if !reflect.DeepEqual(actual.Version, tt.want.Version) {
+				t.Errorf("expected Version %+v, got %+v", tt.want.Version, actual.Version)
+			}
+			if !reflect.DeepEqual(actual.Installed, tt.want.Installed) {
+				t.Errorf("expected actual.Installed %+v, got %+v",
+					boolPtrToString(tt.want.Installed), boolPtrToString(actual.Installed),
+				)
+			}
+			if !reflect.DeepEqual(actual.Tillerless, tt.want.Tillerless) {
+				t.Errorf("expected actual.Tillerless %+v, got %+v",
+					boolPtrToString(tt.want.Tillerless), boolPtrToString(actual.Tillerless),
+				)
+			}
+			if !reflect.DeepEqual(actual.Verify, tt.want.Verify) {
+				t.Errorf("expected actual.Verify %+v, got %+v",
+					boolPtrToString(tt.want.Verify), boolPtrToString(actual.Verify),
+				)
+			}
+			if !reflect.DeepEqual(actual.Wait, tt.want.Wait) {
+				t.Errorf("expected actual.Wait %+v, got %+v",
+					boolPtrToString(tt.want.Wait), boolPtrToString(actual.Wait),
+				)
+			}
+		})
+	}
+}
+
+func TestHelmState_recursiveRefsTemplates(t *testing.T) {
+
+	tests := []struct {
+		name  string
+		input ReleaseSpec
+	}{
+		{
+			name: "Has reqursive references",
+			input: ReleaseSpec{
+				Chart:     "test-charts/{{ .Release.Name }}",
+				Verify:    nil,
+				Name:      "{{ .Release.Labels.id }}",
+				Namespace: "dev",
+				Labels:    map[string]string{"id": "app-{{ .Release.Name }}"},
+			},
+		},
+		{
+			name: "Has unresolvable boolean templates",
+			input: ReleaseSpec{
+				Name:         "app-dev",
+				Chart:        "test-charts/app",
+				Verify:       nil,
+				Namespace:    "dev",
+				WaitTemplate: func(i string) *string { return &i }("hi"),
+			},
+		},
+	}
+
+	for i := range tests {
+		tt := tests[i]
+		t.Run(tt.name, func(t *testing.T) {
+			state := &HelmState{
+				basePath: ".",
+				ReleaseSetSpec: ReleaseSetSpec{
+					HelmDefaults: HelmSpec{
+						KubeContext: "test_context",
+					},
+					Env:               environment.Environment{Name: "test_env"},
+					OverrideNamespace: "test-namespace_",
+					Repositories:      nil,
+					Releases: []ReleaseSpec{
+						tt.input,
+					},
+				},
+				RenderedValues: map[string]interface{}{},
+			}
+
+			r, err := state.ExecuteTemplates()
+			if err == nil {
+				t.Errorf("Expected error, got valid response: %v", r)
+				t.FailNow()
+			}
+		})
+	}
+}

pkg/state/state_gogetter_test.go

@@ -0,0 +1,61 @@
+package state
+
+import (
+	"fmt"
+	"github.com/google/go-cmp/cmp"
+	"github.com/roboll/helmfile/pkg/helmexec"
+	"io/ioutil"
+	"os"
+	"testing"
+)
+
+func TestGoGetter(t *testing.T) {
+	logger := helmexec.NewLogger(os.Stderr, "warn")
+
+	testcases := []struct {
+		chart, dir string
+		force      bool
+
+		out, err string
+	}{
+		{
+			chart: "raw/incubator",
+			dir:   "",
+			force: false,
+			out:   "raw/incubator",
+			err:   "",
+		},
+	}
+
+	for i, tc := range testcases {
+		t.Run(fmt.Sprintf("case %d", i), func(t *testing.T) {
+			d, err := ioutil.TempDir("", "testgogetter")
+			if err != nil {
+				panic(err)
+			}
+			defer os.RemoveAll(d)
+
+			st := &HelmState{
+				logger:   logger,
+				readFile: ioutil.ReadFile,
+				basePath: d,
+			}
+
+			out, err := st.goGetterChart(tc.chart, tc.dir, "", false)
+
+			if diff := cmp.Diff(tc.out, out); diff != "" {
+				t.Fatalf("Unexpected out:\n%s", diff)
+			}
+
+			var errMsg string
+
+			if err != nil {
+				errMsg = err.Error()
+			}
+
+			if diff := cmp.Diff(tc.err, errMsg); diff != "" {
+				t.Fatalf("Unexpected err:\n%s", diff)
+			}
+		})
+	}
+}

pkg/state/state_run.go

@@ -0,0 +1,257 @@
+package state
+
+import (
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+	"sync"
+
+	"github.com/roboll/helmfile/pkg/helmexec"
+	"github.com/variantdev/dag/pkg/dag"
+)
+
+type result struct {
+	release ReleaseSpec
+	err     error
+}
+
+func (st *HelmState) scatterGather(concurrency int, items int, produceInputs func(), receiveInputsAndProduceIntermediates func(int), aggregateIntermediates func()) {
+
+	if concurrency < 1 || concurrency > items {
+		concurrency = items
+	}
+
+	for _, r := range st.Releases {
+		if r.Tillerless != nil {
+			if *r.Tillerless {
+				concurrency = 1
+			}
+		} else if st.HelmDefaults.Tillerless {
+			concurrency = 1
+		}
+	}
+
+	// WaitGroup is required to wait until goroutine per job in job queue cleanly stops.
+	var waitGroup sync.WaitGroup
+	waitGroup.Add(concurrency)
+
+	go produceInputs()
+
+	for w := 1; w <= concurrency; w++ {
+		go func(id int) {
+			receiveInputsAndProduceIntermediates(id)
+			waitGroup.Done()
+		}(w)
+	}
+
+	aggregateIntermediates()
+
+	// Wait until all the goroutines to gracefully finish
+	waitGroup.Wait()
+}
+
+func (st *HelmState) scatterGatherReleases(helm helmexec.Interface, concurrency int,
+	do func(ReleaseSpec, int) error) []error {
+
+	return st.iterateOnReleases(helm, concurrency, st.Releases, do)
+}
+
+func (st *HelmState) iterateOnReleases(helm helmexec.Interface, concurrency int, inputs []ReleaseSpec,
+	do func(ReleaseSpec, int) error) []error {
+	var errs []error
+
+	inputsSize := len(inputs)
+
+	releases := make(chan ReleaseSpec)
+	results := make(chan result)
+
+	st.scatterGather(
+		concurrency,
+		inputsSize,
+		func() {
+			for _, release := range inputs {
+				releases <- release
+			}
+			close(releases)
+		},
+		func(id int) {
+			for release := range releases {
+				err := do(release, id)
+				st.logger.Debugf("release %q processed", release.Name)
+				results <- result{release: release, err: err}
+			}
+		},
+		func() {
+			for range inputs {
+				r := <-results
+				if r.err != nil {
+					errs = append(errs, fmt.Errorf("release \"%s\" failed: %v", r.release.Name, r.err))
+				}
+			}
+		},
+	)
+
+	if len(errs) != 0 {
+		return errs
+	}
+
+	return nil
+}
+
+type PlanOptions struct {
+	Reverse          bool
+	IncludeNeeds     bool
+	SkipNeeds        bool
+	SelectedReleases []ReleaseSpec
+}
+
+func (st *HelmState) PlanReleases(opts PlanOptions) ([][]Release, error) {
+	marked, err := st.SelectReleasesWithOverrides()
+	if err != nil {
+		return nil, err
+	}
+
+	groups, err := SortedReleaseGroups(marked, opts)
+	if err != nil {
+		return nil, err
+	}
+
+	return groups, nil
+}
+
+func SortedReleaseGroups(releases []Release, opts PlanOptions) ([][]Release, error) {
+	reverse := opts.Reverse
+
+	groups, err := GroupReleasesByDependency(releases, opts)
+	if err != nil {
+		return nil, err
+	}
+
+	if reverse {
+		for i, j := 0, len(groups)-1; i < j; i, j = i+1, j-1 {
+			groups[i], groups[j] = groups[j], groups[i]
+		}
+	}
+
+	return groups, nil
+}
+
+func GroupReleasesByDependency(releases []Release, opts PlanOptions) ([][]Release, error) {
+	idToReleases := map[string][]Release{}
+	idToIndex := map[string]int{}
+
+	d := dag.New()
+	for i, r := range releases {
+
+		id := ReleaseToID(&r.ReleaseSpec)
+
+		idToReleases[id] = append(idToReleases[id], r)
+		idToIndex[id] = i
+
+		// Only compute dependencies from non-filtered releases
+		if !r.Filtered {
+			var needs []string
+			for i := 0; i < len(r.Needs); i++ {
+				n := r.Needs[i]
+				needs = append(needs, n)
+			}
+			d.Add(id, dag.Dependencies(needs))
+		}
+	}
+
+	var ids []string
+	for id := range idToReleases {
+		ids = append(ids, id)
+	}
+
+	var selectedReleaseIDs []string
+
+	for _, r := range opts.SelectedReleases {
+		id := ReleaseToID(&r)
+		selectedReleaseIDs = append(selectedReleaseIDs, id)
+	}
+
+	plan, err := d.Plan(dag.SortOptions{
+		Only:                selectedReleaseIDs,
+		WithDependencies:    opts.IncludeNeeds,
+		WithoutDependencies: opts.SkipNeeds,
+	})
+	if err != nil {
+		if ude, ok := err.(*dag.UnhandledDependencyError); ok {
+			msgs := make([]string, len(ude.UnhandledDependencies))
+			for i, ud := range ude.UnhandledDependencies {
+				id := ud.Id
+
+				ds := make([]string, len(ud.Dependents))
+				for i, d := range ud.Dependents {
+					ds[i] = fmt.Sprintf("%q", d)
+				}
+
+				var dsHumanized string
+				if len(ds) < 3 {
+					dsHumanized = strings.Join(ds, " and ")
+				} else {
+					dsHumanized = strings.Join(ds[:len(ds)-1], ", ")
+					dsHumanized += ", and " + ds[len(ds)-1]
+				}
+
+				var verb string
+				if len(ds) == 1 {
+					verb = "depends"
+				} else {
+					verb = "depend"
+				}
+
+				idComponents := strings.Split(id, "/")
+				name := idComponents[len(idComponents)-1]
+
+				msg := fmt.Sprintf(
+					"release %s %s on %q which does not match the selectors. "+
+						"Please add a selector like \"--selector name=%s\", or indicate whether to skip (--skip-needs) or include (--include-needs) these dependencies",
+					dsHumanized,
+					verb,
+					id,
+					name,
+				)
+				msgs[i] = msg
+			}
+			return nil, errors.New(msgs[0])
+		}
+		return nil, err
+	}
+
+	var result [][]Release
+
+	for groupIndex := 0; groupIndex < len(plan); groupIndex++ {
+		dagNodesInGroup := plan[groupIndex]
+
+		var idsInGroup []string
+		var releasesInGroup []Release
+
+		for _, node := range dagNodesInGroup {
+			idsInGroup = append(idsInGroup, node.Id)
+		}
+
+		// Make the helmfile behavior deterministic for reproducibility and ease of testing
+		// We try to keep the order of definitions to keep backward-compatibility
+		// See https://github.com/roboll/helmfile/issues/988
+		sort.Slice(idsInGroup, func(i, j int) bool {
+			ii := idToIndex[idsInGroup[i]]
+			ij := idToIndex[idsInGroup[j]]
+			return ii < ij
+		})
+
+		for _, id := range idsInGroup {
+			rs, ok := idToReleases[id]
+			if !ok {
+				panic(fmt.Errorf("bug: unexpectedly failed to get releases for id %q: %v", id, ids))
+			}
+			releasesInGroup = append(releasesInGroup, rs...)
+		}
+
+		result = append(result, releasesInGroup)
+	}
+
+	return result, nil
+}

pkg/state/storage.go

@@ -0,0 +1,99 @@
+package state
+
+import (
+	"fmt"
+	"go.uber.org/zap"
+	"net/url"
+	"path/filepath"
+	"sort"
+)
+
+type Storage struct {
+	logger *zap.SugaredLogger
+
+	FilePath string
+
+	basePath string
+	glob     func(string) ([]string, error)
+}
+
+func NewStorage(forFile string, logger *zap.SugaredLogger, glob func(string) ([]string, error)) *Storage {
+	return &Storage{
+		FilePath: forFile,
+		basePath: filepath.Dir(forFile),
+		logger:   logger,
+		glob:     glob,
+	}
+}
+
+func (st *Storage) resolveFile(missingFileHandler *string, tpe, path string) ([]string, bool, error) {
+	title := fmt.Sprintf("%s file", tpe)
+
+	files, err := st.ExpandPaths(path)
+	if err != nil {
+		return nil, false, err
+	}
+
+	var handlerId string
+
+	if missingFileHandler != nil {
+		handlerId = *missingFileHandler
+	} else {
+		handlerId = MissingFileHandlerError
+	}
+
+	if len(files) == 0 {
+		switch handlerId {
+		case MissingFileHandlerError:
+			return nil, false, fmt.Errorf("%s matching \"%s\" does not exist in \"%s\"", title, path, st.basePath)
+		case MissingFileHandlerWarn:
+			st.logger.Warnf("skipping missing %s matching \"%s\"", title, path)
+			return nil, true, nil
+		case MissingFileHandlerInfo:
+			st.logger.Infof("skipping missing %s matching \"%s\"", title, path)
+			return nil, true, nil
+		case MissingFileHandlerDebug:
+			st.logger.Debugf("skipping missing %s matching \"%s\"", title, path)
+			return nil, true, nil
+		default:
+			available := []string{
+				MissingFileHandlerError,
+				MissingFileHandlerWarn,
+				MissingFileHandlerInfo,
+				MissingFileHandlerDebug,
+			}
+			return nil, false, fmt.Errorf("invalid missing file handler \"%s\" while processing \"%s\" in \"%s\": it must be one of %s", handlerId, path, st.FilePath, available)
+		}
+	}
+
+	return files, false, nil
+}
+
+func (st *Storage) ExpandPaths(globPattern string) ([]string, error) {
+	result := []string{}
+	absPathPattern := st.normalizePath(globPattern)
+	matches, err := st.glob(absPathPattern)
+	if err != nil {
+		return nil, fmt.Errorf("failed processing %s: %v", globPattern, err)
+	}
+
+	sort.Strings(matches)
+
+	result = append(result, matches...)
+	return result, nil
+}
+
+// normalizes relative path to absolute one
+func (st *Storage) normalizePath(path string) string {
+	u, _ := url.Parse(path)
+	if u.Scheme != "" || filepath.IsAbs(path) {
+		return path
+	} else {
+		return st.JoinBase(path)
+	}
+}
+
+// JoinBase returns an absolute path in the form basePath/relative
+func (st *Storage) JoinBase(relPath string) string {
+	return filepath.Join(st.basePath, relPath)
+}

pkg/state/temp.go

@@ -0,0 +1,90 @@
+package state
+
+import (
+	"errors"
+	"fmt"
+	"hash/fnv"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/davecgh/go-spew/spew"
+)
+
+func createTempValuesFile(release *ReleaseSpec, data interface{}) (*os.File, error) {
+	p, err := tempValuesFilePath(release, data)
+	if err != nil {
+		return nil, err
+	}
+
+	f, err := os.Create(*p)
+	if err != nil {
+		return nil, err
+	}
+
+	return f, nil
+}
+
+func tempValuesFilePath(release *ReleaseSpec, data interface{}) (*string, error) {
+	id, err := generateValuesID(release, data)
+	if err != nil {
+		panic(err)
+	}
+
+	workDir := os.Getenv("HELMFILE_TEMPDIR")
+	if workDir == "" {
+		workDir, err = ioutil.TempDir(os.TempDir(), "helmfile")
+		if err != nil {
+			panic(err)
+		}
+	}
+
+	d := filepath.Join(workDir, id)
+
+	info, err := os.Stat(d)
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		panic(err)
+	} else if info == nil {
+
+	}
+
+	return &d, nil
+}
+
+func generateValuesID(release *ReleaseSpec, data interface{}) (string, error) {
+	var id []string
+
+	if release.Namespace != "" {
+		id = append(id, release.Namespace)
+	}
+
+	id = append(id, release.Name, "values")
+
+	hash, err := HashObject([]interface{}{release, data})
+	if err != nil {
+		return "", err
+	}
+
+	id = append(id, hash)
+
+	return strings.Join(id, "-"), nil
+}
+
+func HashObject(obj interface{}) (string, error) {
+	hash := fnv.New32a()
+
+	hash.Reset()
+
+	printer := spew.ConfigState{
+		Indent:         " ",
+		SortKeys:       true,
+		DisableMethods: true,
+		SpewKeys:       true,
+	}
+	printer.Fprintf(hash, "%#v", obj)
+
+	sum := fmt.Sprint(hash.Sum32())
+
+	return SafeEncodeString(sum), nil
+}

pkg/state/temp_rand.go

@@ -0,0 +1,33 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+// See k8s.io/apimachinery/pkg/util/rand/rand.go
+package state
+
+const (
+	// We omit vowels from the set of available characters to reduce the chances
+	// of "bad words" being formed.
+	alphanums = "bcdfghjklmnpqrstvwxz2456789"
+)
+
+// SafeEncodeString encodes s using the same characters as rand.String. This reduces the chances of bad words and
+// ensures that strings generated from hash functions appear consistent throughout the API.
+func SafeEncodeString(s string) string {
+	r := make([]byte, len(s))
+	for i, b := range []rune(s) {
+		r[i] = alphanums[(int(b) % len(alphanums))]
+	}
+	return string(r)
+}