Skip to content

Fix repository authentication when updating a helm_release with temporary credentials #1687

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Fix repository authentication when updating a helm_release with temporary credentials #1687

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
8cef8b7
Use repo credentials from plan (not state) during Update
kevinfrommelt Jul 31, 2025
ff42aae
Rename variable to plan to accurately reflect that it is the plan model
kevinfrommelt Jul 31, 2025
08ea59e
Merge branch 'main' into fix-repo-auth
kevinfrommelt Jul 31, 2025
39e3b53
Fix whitespace
kevinfrommelt Jul 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
100 changes: 50 additions & 50 deletions helm/resource_helm_release.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -744,8 +744,8 @@ func getInstalledReleaseVersion(ctx context.Context, m *Meta, cfg *action.Config
}

func (r *HelmRelease) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
var state HelmReleaseModel
diags := req.Plan.Get(ctx, &state)
var plan HelmReleaseModel
diags := req.Plan.Get(ctx, &plan)
Comment on lines -747 to +748
Copy link
Author

@kevinfrommelt kevinfrommelt Jul 31, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I renamed this variable to plan for clarity, since it is using the plan model.

Copy link

@platform-skyfed platform-skyfed Aug 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just wondering this is going to change the credentials to be used from the plan and removes it from the state? I assume this is the issue many people are having now where credentials are being saved in state and ephemeral tokens are timing out causing failures?

Copy link
Author

@kevinfrommelt kevinfrommelt Aug 14, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The issue is actually at the bottom of the diff in the Update() function. It's getting the login credentials from the previously applied state, rather than using the currently fetched credentials.

https://github.com/hashicorp/terraform-provider-helm/pull/1687/files#diff-c548ca21c915d6a4918945eb9741a292966d795ca0a4e9e6dfa4f8c8106f5691L1069-R1069

Copy link

@platform-skyfed platform-skyfed Aug 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah I see it now, thank you for the clarification. Appreciate you submitting this!

resp.Diagnostics.Append(diags...)
if resp.Diagnostics.HasError() {
return
Expand All @@ -757,39 +757,39 @@ func (r *HelmRelease) Create(ctx context.Context, req resource.CreateRequest, re
return
}

tflog.Debug(ctx, fmt.Sprintf("Plan state on Create: %+v", state))
tflog.Debug(ctx, fmt.Sprintf("Plan state on Create: %+v", plan))

meta := r.meta
if meta == nil {
resp.Diagnostics.AddError("Initialization Error", "Meta instance is not initialized")
return
}
namespace := state.Namespace.ValueString()
namespace := plan.Namespace.ValueString()
actionConfig, err := meta.GetHelmConfiguration(ctx, namespace)
if err != nil {
resp.Diagnostics.AddError("Error getting helm configuration", fmt.Sprintf("Unable to get Helm configuration for namespace %s: %s", namespace, err))
return
}
ociDiags := OCIRegistryLogin(ctx, meta, actionConfig, meta.RegistryClient, state.Repository.ValueString(), state.Chart.ValueString(), state.RepositoryUsername.ValueString(), state.RepositoryPassword.ValueString())
ociDiags := OCIRegistryLogin(ctx, meta, actionConfig, meta.RegistryClient, plan.Repository.ValueString(), plan.Chart.ValueString(), plan.RepositoryUsername.ValueString(), plan.RepositoryPassword.ValueString())
resp.Diagnostics.Append(ociDiags...)
if resp.Diagnostics.HasError() {
return
}

client := action.NewInstall(actionConfig)
cpo, chartName, cpoDiags := chartPathOptions(&state, meta, &client.ChartPathOptions)
cpo, chartName, cpoDiags := chartPathOptions(&plan, meta, &client.ChartPathOptions)
resp.Diagnostics.Append(cpoDiags...)
if resp.Diagnostics.HasError() {
return
}

c, cpath, chartDiags := getChart(ctx, &state, meta, chartName, cpo)
c, cpath, chartDiags := getChart(ctx, &plan, meta, chartName, cpo)
resp.Diagnostics.Append(chartDiags...)
if resp.Diagnostics.HasError() {
return
}

updated, depDiags := checkChartDependencies(ctx, &state, c, cpath, meta)
updated, depDiags := checkChartDependencies(ctx, &plan, c, cpath, meta)
resp.Diagnostics.Append(depDiags...)
if resp.Diagnostics.HasError() {
return
Expand All @@ -801,7 +801,7 @@ func (r *HelmRelease) Create(ctx context.Context, req resource.CreateRequest, re
}
}

values, valuesDiags := getValues(ctx, &state)
values, valuesDiags := getValues(ctx, &plan)
resp.Diagnostics.Append(valuesDiags...)
if resp.Diagnostics.HasError() {
return
Expand All @@ -826,30 +826,30 @@ func (r *HelmRelease) Create(ctx context.Context, req resource.CreateRequest, re

client.ClientOnly = false
client.DryRun = false
client.DisableHooks = state.DisableWebhooks.ValueBool()
client.Wait = state.Wait.ValueBool()
client.WaitForJobs = state.WaitForJobs.ValueBool()
client.Devel = state.Devel.ValueBool()
client.DependencyUpdate = state.DependencyUpdate.ValueBool()
client.TakeOwnership = state.TakeOwnership.ValueBool()
client.Timeout = time.Duration(state.Timeout.ValueInt64()) * time.Second
client.Namespace = state.Namespace.ValueString()
client.ReleaseName = state.Name.ValueString()
client.Atomic = state.Atomic.ValueBool()
client.SkipCRDs = state.SkipCrds.ValueBool()
client.SubNotes = state.RenderSubchartNotes.ValueBool()
client.DisableOpenAPIValidation = state.DisableOpenapiValidation.ValueBool()
client.Replace = state.Replace.ValueBool()
client.Description = state.Description.ValueString()
client.CreateNamespace = state.CreateNamespace.ValueBool()
client.DisableHooks = plan.DisableWebhooks.ValueBool()
client.Wait = plan.Wait.ValueBool()
client.WaitForJobs = plan.WaitForJobs.ValueBool()
client.Devel = plan.Devel.ValueBool()
client.DependencyUpdate = plan.DependencyUpdate.ValueBool()
client.TakeOwnership = plan.TakeOwnership.ValueBool()
client.Timeout = time.Duration(plan.Timeout.ValueInt64()) * time.Second
client.Namespace = plan.Namespace.ValueString()
client.ReleaseName = plan.Name.ValueString()
client.Atomic = plan.Atomic.ValueBool()
client.SkipCRDs = plan.SkipCrds.ValueBool()
client.SubNotes = plan.RenderSubchartNotes.ValueBool()
client.DisableOpenAPIValidation = plan.DisableOpenapiValidation.ValueBool()
client.Replace = plan.Replace.ValueBool()
client.Description = plan.Description.ValueString()
client.CreateNamespace = plan.CreateNamespace.ValueBool()

var releaseAlreadyExists bool
var installedVersion string
var rel *release.Release

releaseName := state.Name.ValueString()
releaseName := plan.Name.ValueString()

if state.UpgradeInstall.ValueBool() {
if plan.UpgradeInstall.ValueBool() {
tflog.Debug(ctx, fmt.Sprintf("Checking if %q is already installed", releaseName))

ver, err := getInstalledReleaseVersion(ctx, meta, actionConfig, releaseName)
Expand All @@ -866,26 +866,26 @@ func (r *HelmRelease) Create(ctx context.Context, req resource.CreateRequest, re
}
}

if state.UpgradeInstall.ValueBool() && releaseAlreadyExists {
if plan.UpgradeInstall.ValueBool() && releaseAlreadyExists {
tflog.Debug(ctx, fmt.Sprintf("Upgrade-installing chart %q", releaseName))

upgradeClient := action.NewUpgrade(actionConfig)
upgradeClient.ChartPathOptions = *cpo
upgradeClient.DryRun = false
upgradeClient.DisableHooks = state.DisableWebhooks.ValueBool()
upgradeClient.Wait = state.Wait.ValueBool()
upgradeClient.Devel = state.Devel.ValueBool()
upgradeClient.Timeout = time.Duration(state.Timeout.ValueInt64()) * time.Second
upgradeClient.Namespace = state.Namespace.ValueString()
upgradeClient.Atomic = state.Atomic.ValueBool()
upgradeClient.SkipCRDs = state.SkipCrds.ValueBool()
upgradeClient.SubNotes = state.RenderSubchartNotes.ValueBool()
upgradeClient.DisableOpenAPIValidation = state.DisableOpenapiValidation.ValueBool()
upgradeClient.Description = state.Description.ValueString()

if state.PostRender != nil {
binaryPath := state.PostRender.BinaryPath.ValueString()
argsList := state.PostRender.Args.Elements()
upgradeClient.DisableHooks = plan.DisableWebhooks.ValueBool()
upgradeClient.Wait = plan.Wait.ValueBool()
upgradeClient.Devel = plan.Devel.ValueBool()
upgradeClient.Timeout = time.Duration(plan.Timeout.ValueInt64()) * time.Second
upgradeClient.Namespace = plan.Namespace.ValueString()
upgradeClient.Atomic = plan.Atomic.ValueBool()
upgradeClient.SkipCRDs = plan.SkipCrds.ValueBool()
upgradeClient.SubNotes = plan.RenderSubchartNotes.ValueBool()
upgradeClient.DisableOpenAPIValidation = plan.DisableOpenapiValidation.ValueBool()
upgradeClient.Description = plan.Description.ValueString()

if plan.PostRender != nil {
binaryPath := plan.PostRender.BinaryPath.ValueString()
argsList := plan.PostRender.Args.Elements()
if binaryPath != "" {
var args []string
for _, arg := range argsList {
Expand All @@ -903,9 +903,9 @@ func (r *HelmRelease) Create(ctx context.Context, req resource.CreateRequest, re
rel, err = upgradeClient.Run(releaseName, c, values)
} else {
tflog.Debug(ctx, fmt.Sprintf("Installing chart %q", releaseName))
if state.PostRender != nil {
binaryPath := state.PostRender.BinaryPath.ValueString()
argsList := state.PostRender.Args.Elements()
if plan.PostRender != nil {
binaryPath := plan.PostRender.BinaryPath.ValueString()
argsList := plan.PostRender.Args.Elements()

if binaryPath != "" {
var args []string
Expand All @@ -930,7 +930,7 @@ func (r *HelmRelease) Create(ctx context.Context, req resource.CreateRequest, re
}

if err != nil && rel != nil {
exists, existsDiags := resourceReleaseExists(ctx, state.Name.ValueString(), state.Namespace.ValueString(), meta)
exists, existsDiags := resourceReleaseExists(ctx, plan.Name.ValueString(), plan.Namespace.ValueString(), meta)
resp.Diagnostics.Append(existsDiags...)
if resp.Diagnostics.HasError() {
return
Expand All @@ -940,7 +940,7 @@ func (r *HelmRelease) Create(ctx context.Context, req resource.CreateRequest, re
return
}

diags := setReleaseAttributes(ctx, &state, resp.Identity, rel, meta)
diags := setReleaseAttributes(ctx, &plan, resp.Identity, rel, meta)
resp.Diagnostics.Append(diags...)
if resp.Diagnostics.HasError() {
return
Expand All @@ -952,13 +952,13 @@ func (r *HelmRelease) Create(ctx context.Context, req resource.CreateRequest, re
return
}

diags = setReleaseAttributes(ctx, &state, resp.Identity, rel, meta)
diags = setReleaseAttributes(ctx, &plan, resp.Identity, rel, meta)
resp.Diagnostics.Append(diags...)
if resp.Diagnostics.HasError() {
return
}

diags = resp.State.Set(ctx, &state)
diags = resp.State.Set(ctx, &plan)
resp.Diagnostics.Append(diags...)
if resp.Diagnostics.HasError() {
return
Expand Down Expand Up @@ -1066,7 +1066,7 @@ func (r *HelmRelease) Update(ctx context.Context, req resource.UpdateRequest, re
resp.Diagnostics.AddError("Error getting helm configuration", fmt.Sprintf("Unable to get Helm configuration for namespace %s: %s", namespace, err))
return
}
ociDiags := OCIRegistryLogin(ctx, meta, actionConfig, meta.RegistryClient, state.Repository.ValueString(), state.Chart.ValueString(), state.RepositoryUsername.ValueString(), state.RepositoryPassword.ValueString())
ociDiags := OCIRegistryLogin(ctx, meta, actionConfig, meta.RegistryClient, plan.Repository.ValueString(), plan.Chart.ValueString(), plan.RepositoryUsername.ValueString(), plan.RepositoryPassword.ValueString())
resp.Diagnostics.Append(ociDiags...)
if resp.Diagnostics.HasError() {
return
Expand Down