Migrate to Helm v4 SDK

[dennismdejong]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

No changes to security controls.

Description

This PR migrates the provider from the Helm v3 SDK (helm.sh/helm/v3) to the Helm v4 SDK (helm.sh/helm/v4 v4.2.3), resolving issues #1730 and #1792.

What changed

• Dependency bump: helm.sh/helm/v3 → helm.sh/helm/v4 v4.2.3; k8s.io deps upgraded to v0.36.1
• Import paths: All 31 helm.sh/helm/v3/... imports updated to helm.sh/helm/v4/... across 6 source files + tests
• Removed packages: chartutil, releaseutil, pkg/repo, pkg/postrender no longer exist in v4:
  • Added helm/compat_v4.go shims for ParseKubeVersion, SplitManifests, and dependency conversion
  • Added helm/postrender_exec.go to preserve binary-path post-renderer support (v3's postrender.NewExec was removed)
• Action field changes (v4 API):
  • Wait bool → WaitStrategy (kube.WaitStrategy)
  • WaitForJobs → handled by StatusWatcherStrategy
  • Atomic → RollbackOnFailure
  • Force/ForceUpdate → ForceReplace
  • DryRun → DryRunStrategy
  • ClientOnly → DryRunStrategy
  • Removed Recreate (removed in Helm v4)
• Type assertions: loader.Load returns chart.Charter (→ *v2.Chart); action Run() returns release.Releaser (→ *v1.Release)
• Config: actionConfig.Init no longer accepts a logging callback
• Tests: Updated test helpers (kube.GetConfig → ConfigFlags, StatusDeployed → release/common, status action fields)

Breaking changes for users

• Bundled Helm engine is now v4 (server-side apply default, digest pinning, multi-doc YAML values)
• postrender binary executables are deprecated in favor of Helm v4 plugins (still supported via compat layer)
• recreate_pods is no longer supported

Acceptance tests

• Have you added an acceptance test for the functionality being added?

(Note: This is a large migration. Acceptance tests require a live Kubernetes cluster and were not run here; the code compiles and passes go vet.)

Release Note

Migrate the provider to the Helm v4 SDK

References

Fixes #1730, Fixes #1792

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[dennismdejong]

Acceptance test results

All acceptance tests now pass against a live Kubernetes cluster (minikube v1.38.1 with the podman driver, Kubernetes v1.35.1).

Ran the full TestAcc suite: all tests pass (ok ... 241s).

What was validated

• helm_release: basic CRUD, values/set/set_list/literalSet/set_wo, postrender, update, upgrade_install (cold+warm start), dependency, delete_regression, createNamespace, Timeouts, takeOwnership, identity, import, parallel, multiple_releases, chartURL, repository_url, helm_repo_add, LintFail, FailedDeploy, emptyVersion, inconsistentVersion
• manifest experiment: manifest, manifestUnknownValues, manifestServerDiff (fixed)
• OCI: OCI_repository, OCI_registry_login, OCI_login (fixed - now works with podman + plain-HTTP local registries)
• helm_template data source: basic, crds, templates, kubeVersion, configSetNull
• state upgrader: MetadataStructure, values, PostrenderStructure
• unit: TestConvertYAMLManifestToJSON

Notable fixes made during test validation

• ** → ** (not ): in Helm v4, ForceReplace cannot be combined with server-side apply. Mapping force_update to ForceConflicts correctly enables drift recovery under SSA.
• OCI plain-HTTP: added needsPlainHTTP + a dedicated plain-HTTP registry client for local (localhost/127.0.0.1) OCI registries, fixing LocateChart pulls against local registries.
• metadata.generation stripping: removed metadata.generation from tracked resources to avoid spurious diffs under Helm v4 server-side apply.
• valuesUnknown bug: fixed a copy-paste bug where set_list values were read from plan.Set.
• podman support: setupOCIRegistry now prefers podman over docker for the local test registry.

[dennismdejong]

Correction to the previous comment (the force_update → ForceConflicts line was garbled):

• force_update → ForceConflicts (not ForceReplace): in Helm v4, ForceReplace cannot be combined with server-side apply (error: "cannot use server-side apply and force replace together"). Mapping force_update to ForceConflicts correctly enables drift recovery under the default server-side apply behavior.