Why isn't dry run catching this validation error?

[red8888]

Output of helm version: "v3.8.0"

Output of kubectl version:

Client Version: version.Info{Major:"1", Minor:"21", GitVersion:"v1.21.5", GitCommit:"aea7bbadd2fc0cd689de94a54e5b7b758869d691", GitTreeState:"clean", BuildDate:"2021-09-15T21:10:45Z", GoVersion:"go1.16.8", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"20+", GitVersion:"v1.20.15-gke.1000", GitCommit:"d71f5620130949cf5f74de04e6ae8f3a96e4b718", GitTreeState:"clean", BuildDate:"2022-02-02T09:21:18Z", GoVersion:"go1.15.15b5", Compiler:"gc", Platform:"linux/amd64"}

Cloud Provider/Platform (AKS, GKE, Minikube etc.): GKE

When I do a dry run I get no errors, but when I do an actual deploy I get this error:
Error: UPGRADE FAILED: cannot patch "myApp" with kind Application: Application.app.k8s.io "myApp" is invalid: spec.info.value: Invalid value: "integer": spec.info.value in body must be of type string: "integer"

The error is because a field in a k8s resource is invalid (I'm using the Application CRD). Fixing this was easy (just changed an int to string in my manifest), but this is something I would expect dry run to catch.

Is this helm specific or just how the dry-run method of the k8s API works? I'm running the same helm upgrade command just with and without the --dry-run switch. Shouldn't it be doing this level of validation on dry run?

[joejulian]

To catch that, a dry-run would have to be server-side. Helm specifically does not do server-side dry-runs due to a perceived security issue.

There has been discussion at #9426 with no resolution.

I wonder if you could use dry-run along with post-renderer to get this behavior where this script is the post-renderer:

#!/bin/bash
kubectl apply --dry-run=server -f -

[red8888]

So a dry run through kubectl would have caught this but helm currently cannot?

[joejulian]

Correct. Helm does not have any way of parsing CRDs and comparing a resource with the definition of that CRD.

[github-actions]

This issue has been marked as stale because it has been open for 90 days with no activity. This thread will be automatically closed in 30 days if no further activity occurs.