Skip to content

Fix repository authentication when updating a helm_release with temporary credentials #1687

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kevinfrommelt wants to merge 5 commits into
base: main
Choose a base branch
from
+51 −51
Open

Fix repository authentication when updating a helm_release with temporary credentials #1687

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8cef8b7
Use repo credentials from plan (not state) during Update
kevinfrommelt Jul 31, 2025
ff42aae
Rename variable to plan to accurately reflect that it is the plan model
kevinfrommelt Jul 31, 2025
08ea59e
Merge branch 'main' into fix-repo-auth
kevinfrommelt Jul 31, 2025
39e3b53
Fix whitespace
kevinfrommelt Jul 31, 2025
a77e5f1
Merge branch 'main' into fix-repo-auth
kevinfrommelt Dec 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
102 changes: 51 additions & 51 deletions helm/resource_helm_release.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -758,14 +758,14 @@ func getInstalledReleaseVersion(ctx context.Context, m *Meta, cfg *action.Config
}

func (r *HelmRelease) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
var state HelmReleaseModel
diags := req.Plan.Get(ctx, &state)
var plan HelmReleaseModel
diags := req.Plan.Get(ctx, &plan)
Comment on lines -761 to +762

@kevinfrommelt kevinfrommelt Jul 31, 2025

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I renamed this variable to plan for clarity, since it is using the plan model.

@platform-skyfed platform-skyfed Aug 14, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just wondering this is going to change the credentials to be used from the plan and removes it from the state? I assume this is the issue many people are having now where credentials are being saved in state and ephemeral tokens are timing out causing failures?

@kevinfrommelt kevinfrommelt Aug 14, 2025 •
edited
Loading

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The issue is actually at the bottom of the diff in the Update() function. It's getting the login credentials from the previously applied state, rather than using the currently fetched credentials.

https://github.com/hashicorp/terraform-provider-helm/pull/1687/files#diff-c548ca21c915d6a4918945eb9741a292966d795ca0a4e9e6dfa4f8c8106f5691L1069-R1069

@platform-skyfed platform-skyfed Aug 14, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah I see it now, thank you for the clarification. Appreciate you submitting this!

resp.Diagnostics.Append(diags...)
if resp.Diagnostics.HasError() {
return
}

createTimeout, diags := state.Timeouts.Create(ctx, 20*time.Minute)
createTimeout, diags := plan.Timeouts.Create(ctx, 20*time.Minute)
resp.Diagnostics.Append(diags...)
if resp.Diagnostics.HasError() {
return
Expand All @@ -777,7 +777,7 @@ func (r *HelmRelease) Create(ctx context.Context, req resource.CreateRequest, re
return
}

tflog.Debug(ctx, fmt.Sprintf("Plan state on Create: %+v", state))
tflog.Debug(ctx, fmt.Sprintf("Plan state on Create: %+v", plan))
ctx, cancel := context.WithTimeout(ctx, createTimeout)
defer cancel()

Expand All @@ -786,32 +786,32 @@ func (r *HelmRelease) Create(ctx context.Context, req resource.CreateRequest, re
resp.Diagnostics.AddError("Initialization Error", "Meta instance is not initialized")
return
}
namespace := state.Namespace.ValueString()
namespace := plan.Namespace.ValueString()
actionConfig, err := meta.GetHelmConfiguration(ctx, namespace)
if err != nil {
resp.Diagnostics.AddError("Error getting helm configuration", fmt.Sprintf("Unable to get Helm configuration for namespace %s: %s", namespace, err))
return
}
ociDiags := OCIRegistryLogin(ctx, meta, actionConfig, meta.RegistryClient, state.Repository.ValueString(), state.Chart.ValueString(), state.RepositoryUsername.ValueString(), state.RepositoryPassword.ValueString())
ociDiags := OCIRegistryLogin(ctx, meta, actionConfig, meta.RegistryClient, plan.Repository.ValueString(), plan.Chart.ValueString(), plan.RepositoryUsername.ValueString(), plan.RepositoryPassword.ValueString())
resp.Diagnostics.Append(ociDiags...)
if resp.Diagnostics.HasError() {
return
}

client := action.NewInstall(actionConfig)
cpo, chartName, cpoDiags := chartPathOptions(&state, meta, &client.ChartPathOptions)
cpo, chartName, cpoDiags := chartPathOptions(&plan, meta, &client.ChartPathOptions)
resp.Diagnostics.Append(cpoDiags...)
if resp.Diagnostics.HasError() {
return
}

c, cpath, chartDiags := getChart(ctx, &state, meta, chartName, cpo)
c, cpath, chartDiags := getChart(ctx, &plan, meta, chartName, cpo)
resp.Diagnostics.Append(chartDiags...)
if resp.Diagnostics.HasError() {
return
}

updated, depDiags := checkChartDependencies(ctx, &state, c, cpath, meta)
updated, depDiags := checkChartDependencies(ctx, &plan, c, cpath, meta)
resp.Diagnostics.Append(depDiags...)
if resp.Diagnostics.HasError() {
return
Expand All @@ -823,7 +823,7 @@ func (r *HelmRelease) Create(ctx context.Context, req resource.CreateRequest, re
}
}

values, valuesDiags := getValues(ctx, &state)
values, valuesDiags := getValues(ctx, &plan)
resp.Diagnostics.Append(valuesDiags...)
if resp.Diagnostics.HasError() {
return
Expand All @@ -848,30 +848,30 @@ func (r *HelmRelease) Create(ctx context.Context, req resource.CreateRequest, re

client.ClientOnly = false
client.DryRun = false
client.DisableHooks = state.DisableWebhooks.ValueBool()
client.Wait = state.Wait.ValueBool()
client.WaitForJobs = state.WaitForJobs.ValueBool()
client.Devel = state.Devel.ValueBool()
client.DependencyUpdate = state.DependencyUpdate.ValueBool()
client.TakeOwnership = state.TakeOwnership.ValueBool()
client.Timeout = time.Duration(state.Timeout.ValueInt64()) * time.Second
client.Namespace = state.Namespace.ValueString()
client.ReleaseName = state.Name.ValueString()
client.Atomic = state.Atomic.ValueBool()
client.SkipCRDs = state.SkipCrds.ValueBool()
client.SubNotes = state.RenderSubchartNotes.ValueBool()
client.DisableOpenAPIValidation = state.DisableOpenapiValidation.ValueBool()
client.Replace = state.Replace.ValueBool()
client.Description = state.Description.ValueString()
client.CreateNamespace = state.CreateNamespace.ValueBool()
client.DisableHooks = plan.DisableWebhooks.ValueBool()
client.Wait = plan.Wait.ValueBool()
client.WaitForJobs = plan.WaitForJobs.ValueBool()
client.Devel = plan.Devel.ValueBool()
client.DependencyUpdate = plan.DependencyUpdate.ValueBool()
client.TakeOwnership = plan.TakeOwnership.ValueBool()
client.Timeout = time.Duration(plan.Timeout.ValueInt64()) * time.Second
client.Namespace = plan.Namespace.ValueString()
client.ReleaseName = plan.Name.ValueString()
client.Atomic = plan.Atomic.ValueBool()
client.SkipCRDs = plan.SkipCrds.ValueBool()
client.SubNotes = plan.RenderSubchartNotes.ValueBool()
client.DisableOpenAPIValidation = plan.DisableOpenapiValidation.ValueBool()
client.Replace = plan.Replace.ValueBool()
client.Description = plan.Description.ValueString()
client.CreateNamespace = plan.CreateNamespace.ValueBool()

var releaseAlreadyExists bool
var installedVersion string
var rel *release.Release

releaseName := state.Name.ValueString()
releaseName := plan.Name.ValueString()

if state.UpgradeInstall.ValueBool() {
if plan.UpgradeInstall.ValueBool() {
tflog.Debug(ctx, fmt.Sprintf("Checking if %q is already installed", releaseName))

ver, err := getInstalledReleaseVersion(ctx, meta, actionConfig, releaseName)
Expand All @@ -888,26 +888,26 @@ func (r *HelmRelease) Create(ctx context.Context, req resource.CreateRequest, re
}
}

if state.UpgradeInstall.ValueBool() && releaseAlreadyExists {
if plan.UpgradeInstall.ValueBool() && releaseAlreadyExists {
tflog.Debug(ctx, fmt.Sprintf("Upgrade-installing chart %q", releaseName))

upgradeClient := action.NewUpgrade(actionConfig)
upgradeClient.ChartPathOptions = *cpo
upgradeClient.DryRun = false
upgradeClient.DisableHooks = state.DisableWebhooks.ValueBool()
upgradeClient.Wait = state.Wait.ValueBool()
upgradeClient.Devel = state.Devel.ValueBool()
upgradeClient.Timeout = time.Duration(state.Timeout.ValueInt64()) * time.Second
upgradeClient.Namespace = state.Namespace.ValueString()
upgradeClient.Atomic = state.Atomic.ValueBool()
upgradeClient.SkipCRDs = state.SkipCrds.ValueBool()
upgradeClient.SubNotes = state.RenderSubchartNotes.ValueBool()
upgradeClient.DisableOpenAPIValidation = state.DisableOpenapiValidation.ValueBool()
upgradeClient.Description = state.Description.ValueString()

if state.PostRender != nil {
binaryPath := state.PostRender.BinaryPath.ValueString()
argsList := state.PostRender.Args.Elements()
upgradeClient.DisableHooks = plan.DisableWebhooks.ValueBool()
upgradeClient.Wait = plan.Wait.ValueBool()
upgradeClient.Devel = plan.Devel.ValueBool()
upgradeClient.Timeout = time.Duration(plan.Timeout.ValueInt64()) * time.Second
upgradeClient.Namespace = plan.Namespace.ValueString()
upgradeClient.Atomic = plan.Atomic.ValueBool()
upgradeClient.SkipCRDs = plan.SkipCrds.ValueBool()
upgradeClient.SubNotes = plan.RenderSubchartNotes.ValueBool()
upgradeClient.DisableOpenAPIValidation = plan.DisableOpenapiValidation.ValueBool()
upgradeClient.Description = plan.Description.ValueString()

if plan.PostRender != nil {
binaryPath := plan.PostRender.BinaryPath.ValueString()
argsList := plan.PostRender.Args.Elements()
if binaryPath != "" {
var args []string
for _, arg := range argsList {
Expand All @@ -925,9 +925,9 @@ func (r *HelmRelease) Create(ctx context.Context, req resource.CreateRequest, re
rel, err = upgradeClient.Run(releaseName, c, values)
} else {
tflog.Debug(ctx, fmt.Sprintf("Installing chart %q", releaseName))
if state.PostRender != nil {
binaryPath := state.PostRender.BinaryPath.ValueString()
argsList := state.PostRender.Args.Elements()
if plan.PostRender != nil {
binaryPath := plan.PostRender.BinaryPath.ValueString()
argsList := plan.PostRender.Args.Elements()

if binaryPath != "" {
var args []string
Expand All @@ -952,7 +952,7 @@ func (r *HelmRelease) Create(ctx context.Context, req resource.CreateRequest, re
}

if err != nil && rel != nil {
exists, existsDiags := resourceReleaseExists(ctx, state.Name.ValueString(), state.Namespace.ValueString(), meta)
exists, existsDiags := resourceReleaseExists(ctx, plan.Name.ValueString(), plan.Namespace.ValueString(), meta)
resp.Diagnostics.Append(existsDiags...)
if resp.Diagnostics.HasError() {
return
Expand All @@ -962,7 +962,7 @@ func (r *HelmRelease) Create(ctx context.Context, req resource.CreateRequest, re
return
}

diags := setReleaseAttributes(ctx, &state, resp.Identity, rel, meta)
diags := setReleaseAttributes(ctx, &plan, resp.Identity, rel, meta)
resp.Diagnostics.Append(diags...)
if resp.Diagnostics.HasError() {
return
Expand All @@ -974,13 +974,13 @@ func (r *HelmRelease) Create(ctx context.Context, req resource.CreateRequest, re
return
}

diags = setReleaseAttributes(ctx, &state, resp.Identity, rel, meta)
diags = setReleaseAttributes(ctx, &plan, resp.Identity, rel, meta)
resp.Diagnostics.Append(diags...)
if resp.Diagnostics.HasError() {
return
}

diags = resp.State.Set(ctx, &state)
diags = resp.State.Set(ctx, &plan)
resp.Diagnostics.Append(diags...)
if resp.Diagnostics.HasError() {
return
Expand Down Expand Up @@ -1106,7 +1106,7 @@ func (r *HelmRelease) Update(ctx context.Context, req resource.UpdateRequest, re
resp.Diagnostics.AddError("Error getting helm configuration", fmt.Sprintf("Unable to get Helm configuration for namespace %s: %s", namespace, err))
return
}
ociDiags := OCIRegistryLogin(ctx, meta, actionConfig, meta.RegistryClient, state.Repository.ValueString(), state.Chart.ValueString(), state.RepositoryUsername.ValueString(), state.RepositoryPassword.ValueString())
ociDiags := OCIRegistryLogin(ctx, meta, actionConfig, meta.RegistryClient, plan.Repository.ValueString(), plan.Chart.ValueString(), plan.RepositoryUsername.ValueString(), plan.RepositoryPassword.ValueString())

@kevinfrommelt kevinfrommelt Dec 18, 2025

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use the credentials provided in the plan instead of the state. Users may have provided new credentials, especially when using temporary credentials that have a short expiration.

resp.Diagnostics.Append(ociDiags...)
if resp.Diagnostics.HasError() {
return
Expand Down