option for helm-template step to run helm dep build command first

[jvmdc]

Checklist

• I've searched the issue queue to verify this is not a duplicate feature request.
• I've pasted the output of kargo version, if applicable.
• I've pasted logs, if applicable.

Client Version: v1.1.2

Proposed Feature

The ability to do helm dependency update without specifying a specific subchart.

Motivation

Our Chart.yaml file has the following structure:

apiVersion: v2
name: <Some name here>
type: application
version: 0.1.0

dependencies:
  - alias: <some alias>
    name: <subDependencyName>
    version: "0.1.0"
    repository: <Helm repo URL - Not OCI repository btw.>

Currently I am trying to setup a single-freight warehouse that simply points at the Git repository hosting the above Chart.yaml file (and values.yaml etc.).
My PromotionTemplate steps are the following:

1. git-clone Git repository's main branch (hosting above file) to src dir, clone dev branch to out directory
2. git-clear dev branch
3. helm-template

The promotion will fail at the 3rd step because the dependency has not been fetched: step execution failed: step 2 met error threshold of 1: failed to run step "helm-template": missing chart dependencies: found in Chart.yaml, but missing in charts/ directory: <subDependencyName>

A workaround that I can apply if I know my subDependency's name, repository and version is to add another step:

1. git-clone Git repository's main branch (hosting above file) to src dir, clone dev branch to out directory
2. git-clear dev branch
3. helm-update-chart (with an entry for the known subDependency in the charts array)
4. helm-template

This does require me to know the subDependency when I build my PromotionTemplate - As my setup is meant as a very generic setup across the organization, that is probably not feasible.

I had hoped to do it using helm-update-chart without any entries in the charts array, but that fails with an error: step execution failed: step 2 met error threshold of 1: failed to run step "helm-update-chart": invalid helm-update-chart config: charts: Array must have at least 1 items

I could workaround the issue by having a dummy chart whose version I never change that I reference in helm-update-chart, but that would be a bit clunky.

Suggested Implementation

Allow having an empty charts array in the helm-update-chart - Based on a brief glance at the code, that should still update dependencies.

[krancour]

To summarize succinctly, you don't have the tarballs for the subcharts checked in -- which is fine and common.

I think what you need is for helm dep build to be run and not helm dep update, as the latter is for updating the lock file, which is something you probably should have done and committed.

It is probably actually the helm-template step that requires an option to run helm dep build before helm template.

Sound about right?

cc @hiddeco

[hiddeco]

I think what you need is for helm dep build to be run and not helm dep update, as the latter is for updating the lock file, which is something you probably should have done and committed.

This we agree on.

It is probably actually the helm-template step that requires an option to run helm dep build before helm template.

This is one option indeed. But I do wonder if we can think of scenarios where people for some reason want to run helm dep build as a distinctive step, to e.g. commit the dependencies for some reason.

[jvmdc]

To summarize succinctly, you don't have the tarballs for the subcharts checked in -- which is fine and common.

I think what you need is for helm dep build to be run and not helm dep update, as the latter is for updating the lock file, which is something you probably should have done and committed.

It is probably actually the helm-template step that requires an option to run helm dep build before helm template.

Sound about right?

cc @hiddeco

Yes, that would fit nicely :)

[krancour]

This is one option indeed. But I do wonder if we can think of scenarios where people for some reason want to run helm dep build as a distinctive step

It seems within the realm of possibility, but I think we should just start with building it into helm-template and then if we hear of a real need to do it as it's own thing, we can pretty easily create a distinct step for it that will reuse the same underlying bits.

[hiddeco]

Some pointers for whomever may be implementing this:

• Some work is involved to fetch the credentials, as some dependencies may require authentication. An example of how this is done can be found in the helm-update-chart step:

  kargo/internal/directives/helm_chart_updater.go

  Line 328 in 124a3f1

  func (h *helmChartUpdater) loadDependencyCredentials(

  
  It may be worth seeing if this can be factored out and become shared.
• To run the equivalent of helm dep build, we need to make use of the Build() method of Helm's download manager. The download manager should be set up in such a way that it runs in isolation, an example of this can again be found in the helm-update-chart step:
  

  kargo/internal/directives/helm_chart_updater.go

  Lines 225 to 228 in 124a3f1

  	repositoryConfig := filepath.Join(helmHome, "repositories.yaml")
  	if err = repositoryFile.WriteFile(repositoryConfig, 0o600); err != nil {
  	return nil, fmt.Errorf("failed to write Helm repositories file: %w", err)
  	}

  
  

  kargo/internal/directives/helm_chart_updater.go

  Lines 256 to 265 in 124a3f1

  	manager := downloader.Manager{
  	Out: io.Discard,
  	ChartPath: chartPath,
  	Verify: downloader.VerifyNever,
  	SkipUpdate: false,
  	Getters: getter.All(env),
  	RegistryClient: registryClient,
  	RepositoryConfig: env.RepositoryConfig,
  	RepositoryCache: env.RepositoryCache,
  	}

• In case no Chart.lock file is found, the Build() method will automatically run a dependency update. We need to decide if this is what we want to happen. If not, we should set SkipUpdate to true.