Helm upgrade install --force fails with "already exists"

[HamzaZo]

I can't do an upgrade over an existing resource, even thought I used hooks.

For instance, I already installed a release named myproject that had a secret

kind: Secret
metadata:
  name: secret
  annotations:
    "helm.sh/hook": pre-install,pre-upgrade
  labels:
    app: {{ .Values.global.environment.app }}
    environment: {{ $env }}
type: Opaque
{{- end }}

when I do helm upgrade --install --force project --tiller-namespace dev dev/
I got this as result

Error: UPGRADE FAILED: secrets "secret" already exists

Logs of Tiller:

[tiller] 2019/03/20 10:51:39 creating updated release for project
[storage] 2019/03/20 10:51:39 creating release "project.v2"
[tiller] 2019/03/20 10:51:39 performing update for project
[tiller] 2019/03/20 10:51:39 executing 2 pre-upgrade hooks for project
[kube] 2019/03/20 10:51:39 building resources from manifest
[kube] 2019/03/20 10:51:40 creating 1 resource(s)
[tiller] 2019/03/20 10:51:40 warning: Release project pre-upgrade project/templates/secret.yaml failed: secrets "secret" already exists
[storage] 2019/03/20 10:58:34 listing all releases with filter

Any help for this issue ?

Thank you

Output of helm version:

Client: &version.Version{SemVer:"v2.11.0", GitCommit:"2e55dbe1fdb5fdb96b75ff144a339489417b146b", GitTreeState:"clean"}
Server: &version.Version{SemVer:"v2.11.0", GitCommit:"2e55dbe1fdb5fdb96b75ff144a339489417b146b", GitTreeState:"clean"}

Output of kubectl version:

Client Version: version.Info{Major:"1", Minor:"12", GitVersion:"v1.12.0", GitCommit:"0ed33881dc4355495f623c6f22e7dd0b7632b7c0", GitTreeState:"clean", BuildDate:"2018-09-27T17:05:32Z", GoVersion:"go1.10.4", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"11", GitVersion:"v1.11.6", GitCommit:"b1d75deca493a24a2f87eb1efde1a569e52fc8d9", GitTreeState:"clean", BuildDate:"2018-12-16T04:30:10Z", GoVersion:"go1.10.3", Compiler:"gc", Platform:"linux/amd64"}

Cloud Provider/Platform (AKS, GKE, Minikube etc.): kubespray

[jlegrone]

@HamzaK8s I believe you just need to add a hook delete policy:

https://github.com/helm/helm/blob/c85f9ee8a37d79383b1c65dfd2056c371f8334ff/docs/charts_hooks.md#hook-resources-are-not-managed-with-corresponding-releases

kind: Secret
metadata:
  name: secret
  annotations:
    "helm.sh/hook": pre-install,pre-upgrade
+   "helm.sh/hook-delete-policy": before-hook-creation
  labels:
    app: {{ .Values.global.environment.app }}
    environment: {{ $env }}
type: Opaque

[HamzaZo]

@jlegrone if I use the hook "helm.sh/hook-delete-policy": before-hook-creation it will delete the secret before it creates, and my pods will crash so it does not make sense

I think that using hooks with Helm upgrade --install --force not a good idea

[jlegrone]

I think that using hooks with Helm upgrade --install --force not a good idea

I agree that you probably don't need to be using the pre-upgrade hook here if you already are using pre-install.

if I use the hook "helm.sh/hook-delete-policy": before-hook-creation it will delete the secret before it creates, and my pods will crash so it does not make sense

Please verify that this is the actual behavior. My understanding is that the secret will be deleted and re-created if it already exists in this case, not that it will only be deleted.

[HamzaZo]

@jlegrone when I used the pre-install hook only, the helm upgrade --install failed because when we use hooks, helm does not delete the resource that are manged by hooks that's why you need to use "helm.sh/hook-delete-policy": before-hook-creation or other type of delete-policy to delete the policy that wasn't managed with your release

[mbelang]

@jlegrone if I use the hook "helm.sh/hook-delete-policy": before-hook-creation it will delete the secret before it creates, and my pods will crash so it does not make sense

I think that using hooks with Helm upgrade --install --force not a good idea

I tested that and secrets recreation by helm hook is not an issue for running pods because the secrets are already mounted.