--disable-validation doesn't work with HELM_DIFF_THREE_WAY_MERGE

[andrewnazarov]

We've noticed that for the new releases with CRDs we started getting errors like "Error: unable to build kubernetes objects from new release manifest: unable to recognize "": no matches for kind "ClusterSecretStore" in version "external-secrets.io/v1alpha1"".

disableValidation was set to true for these releases. And we were wondering what might get wrong as everything had worked properly before. Then we noticed that HELM_DIFF_THREE_WAY_MERGE=true was set not that long ago. We set it to false and the error was gone.

That means that these two properties can't co-exist. Is this intended? Or it's a bug?

Upd: we are using helmfile. That's why I made a reference to a helmfile's key:)

[mumoshu]

@andrewnazarov Hey! Good catch. I now believe this is a bug or a feature in helm.

I've tried it with the vanilla helm command for a few cases, and helm template --disable-openapi-validation and helm template --validate=false (which each corresponds with helmfile's dsisableOpenAPIValidation and disableValidation) both works whereas helm diff --dry-run --disable-openapi-validation doesn't work, and the helm-upgrade-dry-run lacks support for --validate.

Here's what I used for reproduction:

raw.yml:

templates:
- |
    apiVersion: v1/example.com
    kind: Foo
    metadata:
      name: signal
      namespace: {{.Release.Namespace}}
    data:
      foo: FOO

# These work;

$ helm template --disable-openapi-validation incubator/raw -f raw.yml
$ helm template --validate=false incubator/raw -f raw.yml

# These don't work;

$ helm upgrade --install --dry-run --validate=false -f raw.yml foo1 incubator/raw
Error: unknown flag: --validate

$ helm upgrade --install --dry-run --disable-openapi-validation -f raw.yml foo1 incubator/raw
Release "foo1" does not exist. Installing it now.
WARNING: This chart is deprecated
Error: unable to build kubernetes objects from release manifest: unable to recognize "": no matches for kind "Foo" in version "v1/example.com"

Do you know any alternative to --validate=false for helm upgrade --install --dry-run? If not, this might be worth a bug report or a feature request to helm.

[mumoshu]

I think this explanation on helm's validation gives us enough background of the problem.
Perhaps we'd better just use helm/v3 package directly, without shelling out to helm upgrade --dry-run, to achieve the functionality?

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.