Latest version in HelmRelease does not pull expected version from OCI Registry

[tparnold]

Describe the bug

The registry contains helm charts the versions 0.9.0, 0.10.0, 0.11.0, ...
When I configure a HelmRelease with the version "0.*", the helm chart with version 0.9.0 is pulled. Expecting the highest version to be pulled.

HelmRelease:

spec:
  interval: 1m
  chart:
    spec:
      chart: demoapp
      version: "0.*"
      sourceRef:
        kind: HelmRepository
        name: my-helm-repo
        namespace: gitops-flux-configuration
      interval: 1m

The problem ONLY occurs if the HelmRepository references an OCI Registry.
For testing purposes I switched to a dedicated Helm Repository in artifactory and the expected latest version was pulled.

I tried several different values for version in the HelmRelease resource:

version: "0.*"
version: "0.x.x"
version: "*"

All with the same result: Version 0.9.0 of the helm chart is pulled.

I encountered the problem last week with the new release of the source controller and have the same result after updating to the Flux v0.31.0 release today.

Can anyone confirm this behavior?

Steps to reproduce

Setup HelmRelease and HelmRepository resources to pull a version range from an OCI registry.
Provide multiple versions of the helm chart in the docker registry e.g. 0.9.0, 0.10.0, ...

Expected behavior

Latest version of the helm chart is pulled. (i.e., the one with the highest version)

Screenshots and recordings

No response

OS / Distro

N/A

Flux version

v0.31.0

Flux check

N/A

Git provider

No response

Container Registry provider

Artifactory

Additional context

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[stefanprodan]

We use Helm's semver parser, if you do helm pull oci://<chart-URL> --version="0.x" does it pull the right version?

[tparnold]

Thanks for the quick reply.
The command helm pull oci://<chart-URL> --version="0.x" pulls the expected version.

I had a look at getLastMatchingVersionOrConstraint in oci_chart_repository.go.
It seems the semver parser is used to reduce the versions received from the repository by applying the pattern specified in the HelmRelease resource.
The result is then a new list of versions, which is sorted (by string comparison?) and index 0 is returned.

If my interpretation is correct and a string comparator is used to sort the list of 0.9, 0.10, ... we get exactly the result I observed.