feat(workload): warn when a HelmRelease valuesFrom can't be resolved offline#6214
feat(workload): warn when a HelmRelease valuesFrom can't be resolved offline#6214devantler wants to merge 2 commits into
Conversation
…offline
workload validate/scan render HelmRelease charts offline so the real applied
manifests are checked. Values come from spec.values + valuesFrom ConfigMap/Secret
refs resolved from the in-repo stream. A non-optional valuesFrom whose object is
not in the stream (typically cluster-managed) was silently dropped: the chart
still rendered, but with incomplete values, so the offline output could diverge
from what Flux applies with no signal to the user.
Surface this through the existing render-degradation channel as a new
DegradationPartialValues kind with an accurate warning ("rendered ... with
incomplete values ... valuesFrom X could not be resolved offline"), distinct from
the "skipped Helm render" message (the chart did render). Optional references are
Flux-tolerated and stay silent. Warning only — no change to pass/fail, exit codes,
or rendered output. Applies to both validate and scan via the shared render path.
Extract lookupValuesRef as the single resolvability check shared by applyValuesFrom
and the new unresolvedValueRefs inspector. Tests cover all three states
(non-optional-missing warns, optional-missing silent, resolvable silent) at both
the render-package and end-to-end command levels.
Fixes #6213
Part of #5344
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
✅MegaLinter analysis: Success✅ Linters with no issuesactionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint Notices📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining See detailed reports in MegaLinter artifacts
|
Code Coverage OverviewLanguages: Go Go / code-coverage/goThe overall coverage in the branch remains at 67%, unchanged from the branch. Show a code coverage summary of the most impacted files.
Updated |
Verification + dependency note. RED/GREEN proven in-process: While user-evaluating via the real binary I found this warning (and every existing degradation/CRD/CEL warning) is currently swallowed on the CLI by a pre-existing error-handler bug that discards stderr on successful runs — filed as #6215 and fixed in #6216. So this warning only becomes user-visible once #6216 lands. This PR's logic is correct and independently mergeable; its user-facing effect is gated on #6216, so I am not self-promoting it until the effect is observable. |
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 participant
Why
workload validate/scanrender Helm charts offline so they check what Flux actually applies. When a chart pulls values from a cluster-managed ConfigMap/Secret that isn't in the repo, those values were silently dropped — the gate reported success while quietly validating a chart rendered with incomplete values. Users had no signal that coverage had diverged from the real cluster.What
Adds an honest, non-fatal warning when a required (non-optional)
valuesFromreference can't be resolved offline, naming the HelmRelease and the reference so the user can act. Optional references stay silent (matching Flux). No change to pass/fail or output — a warning only, on the same channel that already flags unrenderable chart sources. Applies to bothvalidateandscan.Fixes #6213
Part of #5344