dependabot / dependabot/dependabot-core
Support for Helm via Flux/HelmRelease
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Feature description
This is a re-open of https://github.com/dependabot/dependabot-core/issues/1744 which was **erroneously** closed as a duplicate.
This ticket can be thought of as the "flux version" of #12202.
Essentially, flux has a [`HemlRelase` kind](https://fluxcd.io/flux/components/helm/helmreleases/) that points to a particular repo/chart/version like so:
```yaml
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: podinfo
namespace: default
spec:
interval: 5m
url: https://stefanprodan.github.io/podinfo
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: podinfo
namespace: default
spec:
interval: 10m
timeout: 5m
chart:
spec:
chart: podinfo
version: '6.5.*'
sourceRef:
kind: HelmRepository
name: podinfo
interval: 5m
releaseName: podinfo
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
test:
enable: true
driftDetection:
mode: enabled
ignore:
- paths: ["/spec/replicas"]
target:
kind: Deployment
values:
replicaCount: 2
```
Parsing the `sourceRef.{kind=HelmRepository?}.name` and the matching `kind: HelmRepository` should be possible with a configuration akin to:
```yaml
version: 2
updates:
- package-ecosystem: "flux-helmrelease"
directories:
- deploy/*.yaml # Account for cases where a single `yaml` file contains both `HelmRelease` and `HelmRepository` or when they're broken up into distinct files.
# <...>
```
Once the `HelmRelease` has been parsed and mated with the matching `HelmRepository`, [the _existing_ helm version update / check logic](https://github.com/dependabot/dependabot-core/blob/main/helm/lib/dependabot/helm/update_checker.rb) should be reusable.
Contributor guide
Research direction
Start with helm/lib/dependabot/helm/update_checker.rb and the Flux HelmRelease and HelmRepository examples in the issue. Trace how the existing Helm update logic receives parsed files and configuration, then determine how a flux-helmrelease ecosystem would pair matching resources across the listed directories. Done means matching repositories are parsed and existing Helm version checks can run for HelmRelease entries.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, ruby
- Domain
- devops, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100