Remove annotations

Author: jaylonmcshan19-x

helm/kube_resources.go

@@ -137,12 +137,21 @@ func mapRuntimeObjects(ctx context.Context, kc *kube.Client, objects []runtime.O
 			return nil, diags
 		}
 
+		// volatile metadata always removed
 		accessor.SetUID(types.UID(""))
 		accessor.SetCreationTimestamp(metav1.Time{})
 		accessor.SetResourceVersion("")
 		accessor.SetManagedFields(nil)
 
-		objJSON, err := json.Marshal(obj)
+		// >>> unify cleanup at the choke point <<<
+		umap, err := runtime.DefaultUnstructuredConverter.ToUnstructured(obj)
+		if err != nil {
+			diags.AddError("Unstructured Conversion Error", err.Error())
+			return nil, diags
+		}
+		normalizeK8sObject(umap)
+
+		objJSON, err := json.Marshal(umap)
 		if err != nil {
 			diags.AddError("Marshal Error", err.Error())
 			return nil, diags
@@ -205,7 +214,7 @@ func getLiveResources(ctx context.Context, r *release.Release, m *Meta) (map[str
 		diags.AddError("Kube Client Error", err.Error())
 		return nil, diags
 	}
-	resources, resDiags := mapResources(ctx, actionConfig, r, func(i *resource.Info) (runtime.Object, error) {
+	rawResources, resDiags := mapResources(ctx, actionConfig, r, func(i *resource.Info) (runtime.Object, error) {
 		gvk := i.Object.GetObjectKind().GroupVersionKind()
 		return kc.Factory.NewBuilder().
 			Unstructured().
@@ -216,10 +225,28 @@ func getLiveResources(ctx context.Context, r *release.Release, m *Meta) (map[str
 			Object()
 	})
 	diags.Append(resDiags...)
-	return resources, diags
+	if resDiags.HasError() {
+		return rawResources, diags
+	}
+
+	cleaned := make(map[string]string, len(rawResources))
+	for k, v := range rawResources {
+		var obj map[string]any
+		if err := json.Unmarshal([]byte(v), &obj); err != nil {
+			cleaned[k] = v
+			continue
+		}
+		normalizeK8sObject(obj)
+		if b, err := json.Marshal(obj); err == nil {
+			cleaned[k] = string(b)
+		} else {
+			cleaned[k] = v
+		}
+	}
+
+	return cleaned, diags
 }
 
-// getDryRunResources simulates applying a manifest and returns the resulting objects.
 func getDryRunResources(ctx context.Context, r *release.Release, m *Meta) (map[string]string, diag.Diagnostics) {
 	var diags diag.Diagnostics
 
@@ -238,7 +265,7 @@ func getDryRunResources(ctx context.Context, r *release.Release, m *Meta) (map[s
 		fieldManager = filepath.Base(os.Args[0])
 	}
 
-	resources, resDiags := mapResources(ctx, actionConfig, r, func(i *resource.Info) (runtime.Object, error) {
+	rawResources, resDiags := mapResources(ctx, actionConfig, r, func(i *resource.Info) (runtime.Object, error) {
 		info := &diff.InfoObject{
 			LocalObj:        i.Object,
 			Info:            i,
@@ -252,5 +279,23 @@ func getDryRunResources(ctx context.Context, r *release.Release, m *Meta) (map[s
 		return info.Merged()
 	})
 	diags.Append(resDiags...)
-	return resources, diags
+	if resDiags.HasError() {
+		return rawResources, diags
+	}
+	cleaned := make(map[string]string, len(rawResources))
+	for k, v := range rawResources {
+		var obj map[string]any
+		if err := json.Unmarshal([]byte(v), &obj); err != nil {
+			cleaned[k] = v
+			continue
+		}
+		normalizeK8sObject(obj)
+		if b, err := json.Marshal(obj); err == nil {
+			cleaned[k] = string(b)
+		} else {
+			cleaned[k] = v
+		}
+	}
+
+	return cleaned, diags
 }

helm/resource_helm_release.go

@@ -2448,3 +2448,121 @@ func valuesUnknown(plan HelmReleaseModel) bool {
 	}
 	return false
 }
+func isInternalAnno(key string) bool {
+	u, err := url.Parse("//" + key)
+	if err != nil {
+		return false
+	}
+	host := u.Hostname()
+
+	// allow some known external prefixes to remain (examples)
+	if host == "app.kubernetes.io" || host == "service.beta.kubernetes.io" {
+		return false
+	}
+	// internal *.kubernetes.io (and .k8s.io, just in case)
+	if strings.HasSuffix(host, "kubernetes.io") || strings.HasSuffix(host, "k8s.io") {
+		return true
+	}
+	// server-generated DaemonSet thing
+	if strings.Contains(key, "deprecated.daemonset.template.generation") {
+		return true
+	}
+	return false
+}
+
+func stripServerSideAnnotations(obj map[string]any) {
+	md, _ := obj["metadata"].(map[string]any)
+	if md == nil {
+		return
+	}
+	ann, _ := md["annotations"].(map[string]any)
+	if ann == nil {
+		return
+	}
+
+	for k := range ann {
+		if isInternalAnno(k) {
+			delete(ann, k)
+		}
+	}
+	if len(ann) == 0 {
+		delete(md, "annotations")
+	}
+}
+
+// Always remove Helm meta annotations (dry-run usually lacks them; live adds them)
+func stripHelmMetaAnnotations(obj map[string]any) {
+	md, _ := obj["metadata"].(map[string]any)
+	if md == nil {
+		return
+	}
+	ann, _ := md["annotations"].(map[string]any)
+	if ann == nil {
+		return
+	}
+
+	changed := false
+	for k := range ann {
+		if strings.HasPrefix(k, "meta.helm.sh/") {
+			delete(ann, k)
+			changed = true
+		}
+	}
+	if changed && len(ann) == 0 {
+		delete(md, "annotations")
+	}
+}
+
+// Remove fields that commonly differ; keep metadata.generation
+func stripVolatileFields(obj map[string]any) {
+	if md, _ := obj["metadata"].(map[string]any); md != nil {
+		delete(md, "managedFields")
+		delete(md, "resourceVersion")
+		delete(md, "uid")
+		delete(md, "creationTimestamp")
+		// keep "generation"
+	}
+
+	// Service fields assigned by API server
+	if kind, _ := obj["kind"].(string); kind == "Service" {
+		if spec, _ := obj["spec"].(map[string]any); spec != nil {
+			delete(spec, "clusterIP")
+			delete(spec, "clusterIPs")
+		}
+	}
+}
+
+// Historical tweak: drop managed-by label only for Secrets
+func stripSecretManagedByLabel(obj map[string]any) {
+	if kind, _ := obj["kind"].(string); kind != "Secret" {
+		return
+	}
+	md, _ := obj["metadata"].(map[string]any)
+	if md == nil {
+		return
+	}
+	labels, _ := md["labels"].(map[string]any)
+	if labels == nil {
+		return
+	}
+
+	delete(labels, "app.kubernetes.io/managed-by")
+	if len(labels) == 0 {
+		delete(md, "labels")
+	}
+}
+
+// If "status" exists, force it to null; don't add if missing
+func coerceStatusToNull(obj map[string]any) {
+	if _, ok := obj["status"]; ok {
+		obj["status"] = nil
+	}
+}
+
+func normalizeK8sObject(obj map[string]any) {
+	stripServerSideAnnotations(obj) // internal k8s junk
+	stripHelmMetaAnnotations(obj)   // meta.helm.sh/* on ALL kinds
+	stripVolatileFields(obj)
+	stripSecretManagedByLabel(obj)
+	coerceStatusToNull(obj)
+}

helm/resource_helm_release_test.go

@@ -2798,7 +2798,26 @@ func getReleaseJSONResourcesPF(t *testing.T, namespace, name string) map[string]
 	if diags.HasError() {
 		t.Fatalf("failed to map runtime objects: %v", diags)
 	}
-	return result
+
+	// IMPORTANT: mirror provider cleanup (normalizeK8sObject) so tests compare like-for-like.
+	cleaned := make(map[string]string, len(result))
+	for k, v := range result {
+		var obj map[string]any
+		if err := json.Unmarshal([]byte(v), &obj); err != nil {
+			// if we somehow can't unmarshal, fall back to raw
+			cleaned[k] = v
+			continue
+		}
+		normalizeK8sObject(obj) // strips server-side + Helm meta (per kind), redacts, etc.
+		b, err := json.Marshal(obj)
+		if err != nil {
+			cleaned[k] = v
+			continue
+		}
+		cleaned[k] = string(b)
+	}
+
+	return cleaned
 }
 
 // patchDeploymentPF patches a Deployment resource and waits until it stabilizes.