Initial support for HelmRelease for upgrading CRDs

Signed-off-by: Alexander Berger <alex-berger@gmx.ch>

.github/workflows/e2e.yaml

@@ -1,6 +1,7 @@
 name: e2e
 
 on:
+  workflow_dispatch:
   pull_request:
   push:
     branches:
@@ -511,6 +512,33 @@ jobs:
             exit 1
           fi
           kubectl -n helm-system delete -f config/testdata/post-renderer-kustomize
+      - name: Boostrap CRDs Upgrade Tests
+        run: |
+          REF=${{ github.ref }}
+          if echo "$REF" | grep 'refs/tags/'; then 
+            TYPE=tag
+            REF=${REF#refs/tags/}
+          else
+            TYPE=branch
+            if echo "$REF" | grep 'refs/pull/'; then 
+              REF=${REF#refs/pull/}
+            else
+              REF=${REF#refs/heads/}
+            fi
+          fi
+          echo "$HEAD_REF,$CURR_REF -> $REF of type $TYPE"
+          echo "helm install --namespace default --set $TYPE=$REF --set url=https://github.com/${{ github.repository }} this config/testdata/charts/crds/bootstrap"
+          helm install --namespace default --set $TYPE=$REF --set url=https://github.com/${{ github.repository }} this config/testdata/charts/crds/bootstrap
+          kubectl -n default apply -f config/testdata/crds-upgrade/init
+          kubectl -n default wait helmreleases/crds-upgrade-test --for=condition=ready --timeout=2m
+      - name: CRDs Upgrade Test Create
+        run: |
+          kubectl -n default apply -f config/testdata/crds-upgrade/create
+          kubectl -n default wait helmreleases/crds-upgrade-test --for=condition=ready --timeout=2m
+      - name: CRDs Upgrade Test CreateReplace
+        run: |
+          kubectl -n default apply -f config/testdata/crds-upgrade/create-replace
+          kubectl -n default wait helmreleases/crds-upgrade-test --for=condition=ready --timeout=2m
       - name: Logs
         run: |
           kubectl -n helm-system logs deploy/source-controller

api/v2beta1/helmrelease_types.go

@@ -421,6 +421,19 @@ func (in InstallRemediation) RetriesExhausted(hr HelmRelease) bool {
 	return in.Retries >= 0 && in.GetFailureCount(hr) > int64(in.Retries)
 }
 
+// CRDsUpgradePolicy defines the upgrade approach to use for CRDs when upgrading
+// a HelmRelease.
+type CRDsChangePolicy string
+
+const (
+	// Create CRDs which do not already exist, do not replace already existing CRDs
+	// and keep (do not delete) CRDs which no longer exist in the current release.
+	Create CRDsChangePolicy = "Create"
+	// Create CRDs which do not already exist, Replace already existing CRDs
+	// and keep (do not delete) CRDs which no longer exist in the current release.
+	CreateReplace CRDsChangePolicy = "CreateReplace"
+)
+
 // Upgrade holds the configuration for Helm upgrade actions for this
 // HelmRelease.
 type Upgrade struct {
@@ -463,6 +476,24 @@ type Upgrade struct {
 	// upgrade action when it fails.
 	// +optional
 	CleanupOnFail bool `json:"cleanupOnFail,omitempty"`
+
+	// UpgradeCRDs upgrade CRDs from the Helm Chart's crds directory according
+	// to the CRD upgrade policy provided here. Valid values are `Create` or
+	// `CreateReplace`. If omitted (the default) CRDs
+	// are not upgraded.
+	//
+	// Create: new CRDs are created, existing CRDs are neither updated nor deleted.
+	//
+	// CreateReplace: new CRDs are created, existing CRDs are updated (replaced)
+	// but not deleted.
+	//
+	// By default, CRDs are not applied during Helm upgrade action. With this
+	// option users can opt-in to CRD upgrade, which is not (yet) natively supported by Helm.
+	// https://helm.sh/docs/chart_best_practices/custom_resource_definitions.
+	//
+	// +kubebuilder:validation:Enum=Create;CreateReplace
+	// +optional
+	UpgradeCRDs CRDsChangePolicy `json:"upgradeCRDs,omitempty"`
 }
 
 // GetTimeout returns the configured timeout for the Helm upgrade action, or the

config/crd/bases/helm.toolkit.fluxcd.io_helmreleases.yaml

@@ -504,6 +504,20 @@ spec:
                       operation (like Jobs for hooks) during the performance of a
                       Helm upgrade action. Defaults to 'HelmReleaseSpec.Timeout'.
                     type: string
+                  upgradeCRDs:
+                    description: "UpgradeCRDs upgrade CRDs from the Helm Chart's crds
+                      directory according to the CRD upgrade policy provided here.
+                      Valid values are `Create` or `CreateReplace`. If omitted (the
+                      default) CRDs are not upgraded. \n Create: new CRDs are created,
+                      existing CRDs are neither updated nor deleted. \n CreateReplace:
+                      new CRDs are created, existing CRDs are updated (replaced) but
+                      not deleted. \n By default, CRDs are not applied during Helm
+                      upgrade action. With this option users can opt-in to CRD upgrade,
+                      which is not (yet) natively supported by Helm. https://helm.sh/docs/chart_best_practices/custom_resource_definitions."
+                    enum:
+                    - Create
+                    - CreateReplace
+                    type: string
                 type: object
               values:
                 description: Values holds the values for this Helm release.

config/testdata/charts/crds/bootstrap/.helmignore

@@ -0,0 +1,7 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore

config/testdata/charts/crds/bootstrap/Chart.yaml

@@ -0,0 +1,23 @@
+apiVersion: v2
+name: crd-upgrade-bootstrap
+description: Helper Chart to bootstrap e2e test GitRepository
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 1.0.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+appVersion: 1.0.0

config/testdata/charts/crds/bootstrap/templates/git-repository.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: GitRepository
+metadata:
+  name: this
+  namespace: default
+spec:
+  interval: 1m
+  url: "{{ .Values.url }}"
+  ref:
+    {{- if .Values.branch }}
+    branch: "{{ .Values.branch }}"
+    {{- end}}
+    {{- if .Values.branch }}
+    tag: "{{ .Values.tag }}"
+    {{- end}}

config/testdata/charts/crds/bootstrap/values.yaml

@@ -0,0 +1,3 @@
+url: "https://github.com/fluxcd/helm-controller"
+branch: null
+tag: null

config/testdata/charts/crds/v1/.helmignore

@@ -0,0 +1,7 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore

config/testdata/charts/crds/v1/Chart.yaml

@@ -0,0 +1,23 @@
+apiVersion: v2
+name: crd-upgrade
+description: CRDs Upgrade Test Chart v1
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 1.0.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+appVersion: 1.0.0

config/testdata/charts/crds/v1/crds/a.yaml

@@ -0,0 +1,38 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: crdupgradetestas.crd-upgrades.helmreleases.helm.toolkit.fluxcd.io
+spec:
+  group: crd-upgrades.helmreleases.helm.toolkit.fluxcd.io
+  names:
+    kind: CrdUpgradeTesta
+    listKind: CrdUpgradeTestaList
+    plural: crdupgradetestas
+    singular: crdupgradetesta
+  scope: Namespaced
+  versions:
+  - name: v2beta1
+    schema:
+      openAPIV3Schema:
+        description: Test
+        properties:
+          apiVersion:
+            type: string
+          kind:
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties: {}
+            type: object
+          status:
+            properties: {}
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+

config/testdata/charts/crds/v1/crds/b.yaml

@@ -0,0 +1,38 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: crdupgradetestbs.crd-upgrades.helmreleases.helm.toolkit.fluxcd.io
+spec:
+  group: crd-upgrades.helmreleases.helm.toolkit.fluxcd.io
+  names:
+    kind: CrdUpgradeTestb
+    listKind: CrdUpgradeTestbList
+    plural: crdupgradetestbs
+    singular: crdupgradetestb
+  scope: Namespaced
+  versions:
+  - name: v2beta1
+    schema:
+      openAPIV3Schema:
+        description: Test
+        properties:
+          apiVersion:
+            type: string
+          kind:
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties: {}
+            type: object
+          status:
+            properties: {}
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+

config/testdata/charts/crds/v1/crds/d.yaml

@@ -0,0 +1,38 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: crdupgradetestds.crd-upgrades.helmreleases.helm.toolkit.fluxcd.io
+spec:
+  group: crd-upgrades.helmreleases.helm.toolkit.fluxcd.io
+  names:
+    kind: CrdUpgradeTestd
+    listKind: CrdUpgradeTestdList
+    plural: crdupgradetestds
+    singular: crdupgradetestd
+  scope: Namespaced
+  versions:
+  - name: v2beta1
+    schema:
+      openAPIV3Schema:
+        description: Test
+        properties:
+          apiVersion:
+            type: string
+          kind:
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties: {}
+            type: object
+          status:
+            properties: {}
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+

config/testdata/charts/crds/v1/templates/dummy.yaml

@@ -0,0 +1,6 @@
+---
+kind: CrdUpgradeTesta
+apiVersion: crd-upgrades.helmreleases.helm.toolkit.fluxcd.io/v2beta1
+metadata:
+  name: a
+spec: {}

config/testdata/charts/crds/v2/.helmignore

@@ -0,0 +1,7 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore

config/testdata/charts/crds/v2/Chart.yaml

@@ -0,0 +1,23 @@
+apiVersion: v2
+name: crd-upgrade
+description: CRDs Upgrade Test Chart v1
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 1.0.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+appVersion: 1.0.0

config/testdata/charts/crds/v2/crds/a.yaml

@@ -0,0 +1,38 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: crdupgradetestas.crd-upgrades.helmreleases.helm.toolkit.fluxcd.io
+spec:
+  group: crd-upgrades.helmreleases.helm.toolkit.fluxcd.io
+  names:
+    kind: CrdUpgradeTesta
+    listKind: CrdUpgradeTestaList
+    plural: crdupgradetestas
+    singular: crdupgradetesta
+  scope: Namespaced
+  versions:
+  - name: v2beta1
+    schema:
+      openAPIV3Schema:
+        description: Test
+        properties:
+          apiVersion:
+            type: string
+          kind:
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties: {}
+            type: object
+          status:
+            properties: {}
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+