Depdendencies between OCIRepo and HelmRelease / timming issue

[runningman84]

Best on the latest best practices we migrated our setup from this concept:

---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
  name: trivy-operator
  namespace: security-system
spec:
  type: oci
  interval: 17m
  url: oci://ghcr.io/myorg
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  upgrade:
    crds: CreateReplace
  interval: 9m
  chart:
    spec:
      chart: trivy-operator-chart
      version: 0.33.1
      sourceRef:
        kind: HelmRepository
        name: trivy-operator
        namespace: security-system
      interval: 14m
  values:
    fullnameOverride: trivy-operator
    excludeNamespaces: "security-system"

to this concept:

---
kind: OCIRepository
metadata:
  name: trivy-operator
  namespace: security-system
spec:
  interval: 17m
  url: oci://ghcr.io/myorg/trivy-operator-chart
  layerSelector:
    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
    operation: copy
  ref:
    tag: 0.33.1
---
kind: HelmRelease
metadata:
  upgrade:
    crds: CreateReplace
  interval: 9m
  chartRef:
    kind: OCIRepository
    name: trivy-operator
  values:
    fullnameOverride: trivy-operator
    excludeNamespaces: "security-system"

Unfortunatly this lead to timing issues.

If a new version requeires special values it can happen that the new values are applied with an old oci helm chart.

It would be great if flux would have some hidden dependencies which would ensure that doesn't happen

[matheuscscp]

This is a fair complaint. We came up with an idea to fix this, we will track it here: fluxcd/helm-controller#1594