v1.226.0-rc.9

🚀 Enhancements

fix(helm): native Helm UX fixes (repo isolation, status output, default identity, namespace) Andriy Knysh (@aknysh) (#2941)

## what

Four independent fixes to the native Helm implementation (pkg/component/helm):

• 1. Repository config/cache isolation. newSettings now points Helm's RepositoryConfig and
  RepositoryCache at an atmos-managed XDG location (<xdg-config>/atmos/helm/repositories.yaml,
  <xdg-cache>/atmos/helm/repository) unless HELM_REPOSITORY_CONFIG / HELM_REPOSITORY_CACHE is set,
  instead of inheriting the user's global Helm config.

• 2. Status output on apply/delete. atmos helm apply and atmos helm delete now print a one-line
  status (release name, namespace, chart) instead of succeeding silently.

• 3. Stack default-identity resolution. atmos helm apply/diff/delete resolve the stack's
  default: true identity binding the same way atmos terraform does, so an explicit --identity is
  no longer required for cluster operations. The offline template render never triggers auth.

• 4. Namespace for namespace-less charts. newActionContext now sets the namespace on the Helm
  EnvSettings (SetNamespace), so charts whose manifests omit metadata.namespace install into the
  component's configured namespace instead of the kubeconfig-default namespace.

why

• 1. Because settings inherited the user's global Helm config, resolving a declared repo/name
  chart sent Helm down downloader.(*ChartDownloader).scanReposForURL, which iterates every repository
  in the user's global repositories.yaml and fails on the first one whose index is not cached
  (e.g. no cached repo found ... <repo>-index.yaml). An unrelated repository in the user's global
  config could break an atmos chart render, and setupHelmRepositories also mutated the user's global
  config. Isolation makes chart resolution depend only on the repositories the components declare, keeps
  it reproducible across workstations/CI, and mirrors how the kubeconfig is already isolated under the
  atmos XDG dir.

• 2. A successful apply/delete produced no output, so there was no confirmation of what happened
  (release, namespace, chart) without separately querying the cluster. template/diff already emit
  their own output; apply/delete now do too.

• 3. The helm exec path set up auth only when an explicit identity was given, so without --identity
  no auth manager was created, no KUBECONFIG was injected, and the command could not reach the cluster.
  Terraform/helmfile already auto-resolve the stack default identity; helm now matches them for cluster
  operations while keeping template fully offline. When no auth is configured, the identity stays empty
  and the ambient KUBECONFIG is used, preserving prior behavior.

• 4. Helm derives the namespace for namespace-less objects from the settings/RESTClientGetter,
  which atmos left at the kubeconfig context default; only the install action's namespace was set. Charts
  that hardcode namespace: {{ .Release.Namespace }} worked, but charts that do not landed in default.

testing

Automated (in-code, pkg/component/helm)

• repo_isolation_test.go - isolation is applied when the HELM_REPOSITORY_* env vars are unset;
  explicit values are respected unchanged.
• status_output_test.go - a status line is written for apply/delete on success only (silent on error
  and for template/diff), and the message names the release and namespace.
• default_identity_test.go - the decision logic (shouldSetupComponentAuth, operationRequiresCluster),
  plus an executor test asserting a cluster operation resolves component auth with no explicit identity
  while template stays offline.
• namespace_test.go - newActionContext sets the settings namespace; an empty namespace leaves Helm's
  default untouched.

New functions are covered at 100%; package total is ~89.6%. gofmt and go vet are clean, and the full
module builds. TestMain initializes the data writer once for the package since apply/delete now emit
output.

Manual (against a live AKS cluster)

Built a binary and deployed two native Helm components: one local chart (files in the repo) and one chart
pulled from a public Helm repository.

• 1. With the global Helm config holding unrelated, uncached repositories, apply previously failed on
  an unrelated repo's index; after the fix it succeeds, writes only to the atmos-managed repository config
  (which then contains only the declared repository), and leaves the user's global config untouched.
• 2. apply and delete both print their status line.
• 3. both charts were applied and deleted with no --identity, resolving the stack's default identity.
• 4. the public chart (whose manifests set no namespace) installed into the configured namespace
  instead of default.

references

• docs/fixes/2026-08-14-native-helm-ux-fixes.md

Summary by CodeRabbit

New Features

• Helm repository configuration and cache are isolated from global Helm state by default, with support for custom paths.
• Successful Helm apply and delete operations now display release and namespace status.
• Stack default identities are automatically used for cluster operations.
• Configured component namespaces are applied during Helm operations.

Bug Fixes

• Offline template rendering remains unauthenticated when no identity is specified.
• Status output is suppressed for failed, template, and preview operations.