Helm Operator 1.4.0 SIGSEGV #628
Comments
|
Thank you for the report! Is this a Helm Plugin issue? Looks like the report in #626 We have an idea of how to restore the capability to use plugins, which was broken by a Helm upgrade. Very sorry for the inconvenience. (We're pretty certain the breakage is also present in 1.3.0, FYI.) |
|
@kingdonb thank you! It's the same for 1.3.0, I just tried it. |
|
I think we definitely want to fix this, but to be clear Helm Operator is not planned to be supported forever, and Helm Controller does not (and does not plan to) support Helm plugins, as I understand it. I personally don't have a lot of details or context about this position and it's not my decision, but from what I understand it's not very likely to change going forward. So while there is a path to restore this functionality in Helm Operator, I'm inclined to try and help you migrate away from using a Helm plugin if possible, or better understand why it is not possible and what use cases this will break. We really don't want for there to be a substantial number of users to be stuck on Helm Operator when support is ultimately ended in favor of Helm Controller. Can you elaborate on what this plugin is for, and how you're using it, so we can think and talk about how this could perhaps be solved without a Helm plugin (and so that we can help you consider migrating to the new Helm Controller, if possible?) |
|
We are on Azure, we used to use a service principal to access azure container services (with fixed passwords) and moved to user-assigned identities with short-lived passwords. So the plugin is a tool to work with short (around 1 hour) passwords. |
|
Will this issue be fixed? |
|
Unlikely to be fixed in Helm Operator, at least soon, given the current state of things. Helm Controller does not support plugins anymore, and Helm Operator is no longer being developed, just maintained for security fixes. Can you say something about your use case and what issue you perceive as the most urgent? I do not have the fix for Helm Operator at my fingertips, though I had a discussion with @hiddeco we are both on vacation at present and the company is shut down for holiday, so nothing is going to happen right now. We are adding support for Flux v2 to use auto-login capabilities in the IAM stack of all major cloud vendors to connect with container registry services like ECR, ACR, GCR, Artifact Registry... so with that support in place, I think there should be no need for helm plugins to do auth anymore. But I may have not identified a gap covered by your use case. What are you using plugins for? I'm afraid that due to security posturing the capability to use plugins is unlikely to return in current Flux versions. |
|
We are using s3 as repository. I think i will try to use ECR. Would it work with Flux v1? |
|
I don't have enough information about your use case to answer definitively, but I do not recommend using Flux v1 for anything at this point, new users should please try Flux v2 first. This feature (ECR support) has been available in Flux v1, the new support in Flux v2 is (well, new, docs are still a bit WIP) mentioned here: fluxcd/image-reflector-controller#193 – there are two approaches you can take, depending on if you intend to use ambient credentials or not. ECR was the first to be supported with ambient creds. I do not know anything at all about using S3 directly as a repository. |
|
Sorry if your issue remains unresolved. The Helm Operator is in maintenance mode, we recommend everybody upgrades to Flux v2 and Helm Controller. A new release of Helm Operator is out this week, 1.4.4. We will continue to support Helm Operator in maintenance mode for an indefinite period of time, and eventually archive this repository. Please be aware that Flux v2 has a vibrant and active developer community who are actively working through minor releases and delivering new features on the way to General Availability for Flux v2. In the mean time, this repo will still be monitored, but support is basically limited to migration issues only. I will have to close many issues today without reading them all in detail because of time constraints. If your issue is very important, you are welcome to reopen it, but due to staleness of all issues at this point a new report is more likely to be in order. Please open another issue if you have unresolved problems that prevent your migration in the appropriate Flux v2 repo. Helm Operator releases will continue as possible for a limited time, as a courtesy for those who still cannot migrate yet, but these are strongly not recommended for ongoing production use as our strict adherence to semver backward compatibility guarantees limit many dependencies and we can only upgrade them so far without breaking compatibility. So there are likely known CVEs that cannot be resolved. We recommend upgrading to Flux v2 which is actively maintained ASAP. I am going to go ahead and close every issue at once today, |
Describe the bug
Upgrading from 1.2.0 to 1.4.0, fresh 1.4.0 (1.3.0 as well) helm install, old version removed, CRD also removed.
To Reproduce
Steps to reproduce the behaviour:
kubectl describe helmrelease <name>no release installed.
Expected behavior
A clear and concise description of what you expected to happen.
Logs
Additional context
The text was updated successfully, but these errors were encountered: