dependabot / dependabot/dependabot-core

Support for Helm via Flux/HelmRelease

Open
#12,482 2 comments 15 reactions 0 assignees View on GitHub
L: elm L: helm T: feature-request
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Feature description

This is a re-open of https://github.com/dependabot/dependabot-core/issues/1744 which was **erroneously** closed as a duplicate.
This ticket can be thought of as the "flux version" of #12202.

Essentially, flux has a [`HemlRelase` kind](https://fluxcd.io/flux/components/helm/helmreleases/) that points to a particular repo/chart/version like so:

```yaml
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: podinfo
namespace: default
spec:
interval: 5m
url: https://stefanprodan.github.io/podinfo
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: podinfo
namespace: default
spec:
interval: 10m
timeout: 5m
chart:
spec:
chart: podinfo
version: '6.5.*'
sourceRef:
kind: HelmRepository
name: podinfo
interval: 5m
releaseName: podinfo
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
test:
enable: true
driftDetection:
mode: enabled
ignore:
- paths: ["/spec/replicas"]
target:
kind: Deployment
values:
replicaCount: 2
```

Parsing the `sourceRef.{kind=HelmRepository?}.name` and the matching `kind: HelmRepository` should be possible with a configuration akin to:

```yaml
version: 2
updates:
- package-ecosystem: "flux-helmrelease"
directories:
- deploy/*.yaml # Account for cases where a single `yaml` file contains both `HelmRelease` and `HelmRepository` or when they're broken up into distinct files.
# <...>
```

Once the `HelmRelease` has been parsed and mated with the matching `HelmRepository`, [the _existing_ helm version update / check logic](https://github.com/dependabot/dependabot-core/blob/main/helm/lib/dependabot/helm/update_checker.rb) should be reusable.

Contributor guide

Open the contributing guide

Research direction

Start with helm/lib/dependabot/helm/update_checker.rb and the Flux HelmRelease and HelmRepository examples in the issue. Trace how the existing Helm update logic receives parsed files and configuration, then determine how a flux-helmrelease ecosystem would pair matching resources across the listed directories. Done means matching repositories are parsed and existing Helm version checks can run for HelmRelease entries.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, ruby
Domain
devops, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.