Update to Helm v3.7.1, allow to pass credentials and new OCI support (a…

…rgoproj#7249)

* chore: Update Helm to v3.7.1

Signed-off-by: Mathieu Parent <math.parent@gmail.com>

cmd/argocd/commands/app.go

@@ -668,6 +668,10 @@ func NewApplicationUnsetCommand(clientOpts *argocdclient.ClientOptions) *cobra.C
 						}
 					}
 				}
+				if app.Spec.Source.Helm.PassCredentials {
+					app.Spec.Source.Helm.PassCredentials = false
+					updated = true
+				}
 			}
 
 			if app.Spec.Source.Plugin != nil {

cmd/util/app.go

@@ -40,6 +40,7 @@ type AppOptions struct {
 	helmSetStrings                  []string
 	helmSetFiles                    []string
 	helmVersion                     string
+	helmPassCredentials             bool
 	project                         string
 	syncPolicy                      string
 	syncOptions                     []string
@@ -86,6 +87,7 @@ func AddAppFlags(command *cobra.Command, opts *AppOptions) {
 	command.Flags().StringVar(&opts.values, "values-literal-file", "", "Filename or URL to import as a literal Helm values block")
 	command.Flags().StringVar(&opts.releaseName, "release-name", "", "Helm release-name")
 	command.Flags().StringVar(&opts.helmVersion, "helm-version", "", "Helm version")
+	command.Flags().BoolVar(&opts.helmPassCredentials, "helm-pass-credentials", false, "Pass credentials to all domain")
 	command.Flags().StringArrayVar(&opts.helmSets, "helm-set", []string{}, "Helm set values on the command line (can be repeated to set several values: --helm-set key1=val1 --helm-set key2=val2)")
 	command.Flags().StringArrayVar(&opts.helmSetStrings, "helm-set-string", []string{}, "Helm set STRING values on the command line (can be repeated to set several values: --helm-set-string key1=val1 --helm-set-string key2=val2)")
 	command.Flags().StringArrayVar(&opts.helmSetFiles, "helm-set-file", []string{}, "Helm set values from respective files specified via the command line (can be repeated to set several values: --helm-set-file key1=path1 --helm-set-file key2=path2)")
@@ -156,6 +158,8 @@ func SetAppSpecOptions(flags *pflag.FlagSet, spec *argoappv1.ApplicationSpec, ap
 			setHelmOpt(&spec.Source, helmOpts{releaseName: appOpts.releaseName})
 		case "helm-version":
 			setHelmOpt(&spec.Source, helmOpts{version: appOpts.helmVersion})
+		case "helm-pass-credentials":
+			setHelmOpt(&spec.Source, helmOpts{passCredentials: appOpts.helmPassCredentials})
 		case "helm-set":
 			setHelmOpt(&spec.Source, helmOpts{helmSets: appOpts.helmSets})
 		case "helm-set-string":
@@ -372,13 +376,14 @@ func setPluginOptEnvs(src *argoappv1.ApplicationSource, envs []string) {
 }
 
 type helmOpts struct {
-	valueFiles     []string
-	values         string
-	releaseName    string
-	version        string
-	helmSets       []string
-	helmSetStrings []string
-	helmSetFiles   []string
+	valueFiles      []string
+	values          string
+	releaseName     string
+	version         string
+	helmSets        []string
+	helmSetStrings  []string
+	helmSetFiles    []string
+	passCredentials bool
 }
 
 func setHelmOpt(src *argoappv1.ApplicationSource, opts helmOpts) {
@@ -397,6 +402,9 @@ func setHelmOpt(src *argoappv1.ApplicationSource, opts helmOpts) {
 	if opts.version != "" {
 		src.Helm.Version = opts.version
 	}
+	if opts.passCredentials {
+		src.Helm.PassCredentials = opts.passCredentials
+	}
 	for _, text := range opts.helmSets {
 		p, err := argoappv1.NewHelmParameter(text, false)
 		if err != nil {

cmd/util/app_test.go

@@ -45,6 +45,11 @@ func Test_setHelmOpt(t *testing.T) {
 		setHelmOpt(&src, helmOpts{version: "v3"})
 		assert.Equal(t, "v3", src.Helm.Version)
 	})
+	t.Run("HelmPassCredentials", func(t *testing.T) {
+		src := v1alpha1.ApplicationSource{}
+		setHelmOpt(&src, helmOpts{passCredentials: true})
+		assert.Equal(t, true, src.Helm.PassCredentials)
+	})
 }
 
 func Test_setKustomizeOpt(t *testing.T) {

docs/operator-manual/upgrading/2.1-2.2.md

@@ -0,0 +1,16 @@
+# v2.1 to 2.2
+
+## Upgraded Helm Version
+
+Note that bundled Helm has been upgraded from 3.6.0 to v3.7+. This includes following breaking changes:
+
+- Repository credentials are no longer passed to download charts that
+  are being served from a different domain than the repository.
+
+  You can still force older behavior with `--helm-pass-credentials` option to `argocd app create`.
+
+  More information in the [Helm v3.6.1 release notes](https://github.com/helm/helm/releases/tag/v3.6.1).
+
+- Experimental OCI support has been rewritten.
+
+  More information in the [Helm v3.7.0 release notes](https://github.com/helm/helm/releases/tag/v3.7.0).

docs/operator-manual/upgrading/overview.md

@@ -3,7 +3,7 @@
 !!!note
 
     This section contains information on upgrading Argo CD. Before upgrading please make sure to read details about
-    the breaking changes between Argo CD versions. 
+    the breaking changes between Argo CD versions.
 
 Argo CD uses the semver versioning and ensures that following rules:
 
@@ -16,7 +16,7 @@ please make sure to check upgrading details in  both [v1.3 to v1.4](./1.3-1.4.md
  Argo CD settings using disaster recovery [guide](../disaster_recovery.md).
 
 After reading the relevant notes about possible breaking changes introduced in Argo CD version use the following
-command to upgrade Argo CD. Make sure to replace `<version>` with the required version number: 
+command to upgrade Argo CD. Make sure to replace `<version>` with the required version number:
 
 **Non-HA**:
 
@@ -33,17 +33,18 @@ kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/<v
 
     Even though some releases require only image change it is still recommended to apply whole manifests set.
     Manifest changes might include important parameter modifications and applying the whole set will protect you from
-    introducing misconfiguration. 
+    introducing misconfiguration.
 
 <hr/>
 
+* [v2.1 to v2.2](./2.1-2.2.md)
 * [v2.0 to v2.1](./2.0-2.1.md)
 * [v1.8 to v2.0](./1.8-2.0.md)
-* [v1.7 to v1.8](./1.7-1.8.md) 
-* [v1.6 to v1.7](./1.6-1.7.md) 
-* [v1.5 to v1.6](./1.5-1.6.md) 
-* [v1.4 to v1.5](./1.4-1.5.md) 
-* [v1.3 to v1.4](./1.3-1.4.md) 
+* [v1.7 to v1.8](./1.7-1.8.md)
+* [v1.6 to v1.7](./1.6-1.7.md)
+* [v1.5 to v1.6](./1.5-1.6.md)
+* [v1.4 to v1.5](./1.4-1.5.md)
+* [v1.3 to v1.4](./1.3-1.4.md)
 * [v1.2 to v1.3](./1.2-1.3.md)
-* [v1.1 to v1.2](./1.1-1.2.md) 
-* [v1.0 to v1.1](./1.0-1.1.md) 
+* [v1.1 to v1.2](./1.1-1.2.md)
+* [v1.0 to v1.1](./1.0-1.1.md)

docs/user-guide/commands/argocd_admin_app_generate-spec.md

@@ -46,6 +46,7 @@ argocd admin app generate-spec APPNAME [flags]
       --env string                                 Application environment to monitor
   -f, --file string                                Filename or URL to Kubernetes manifests for the app
       --helm-chart string                          Helm Chart name
+      --helm-pass-credentials                      Pass credentials to all domain
       --helm-set stringArray                       Helm set values on the command line (can be repeated to set several values: --helm-set key1=val1 --helm-set key2=val2)
       --helm-set-file stringArray                  Helm set values from respective files specified via the command line (can be repeated to set several values: --helm-set-file key1=path1 --helm-set-file key2=path2)
       --helm-set-string stringArray                Helm set STRING values on the command line (can be repeated to set several values: --helm-set-string key1=val1 --helm-set-string key2=val2)

docs/user-guide/commands/argocd_app_create.md

@@ -46,6 +46,7 @@ argocd app create APPNAME [flags]
       --env string                                 Application environment to monitor
   -f, --file string                                Filename or URL to Kubernetes manifests for the app
       --helm-chart string                          Helm Chart name
+      --helm-pass-credentials                      Pass credentials to all domain
       --helm-set stringArray                       Helm set values on the command line (can be repeated to set several values: --helm-set key1=val1 --helm-set key2=val2)
       --helm-set-file stringArray                  Helm set values from respective files specified via the command line (can be repeated to set several values: --helm-set-file key1=path1 --helm-set-file key2=path2)
       --helm-set-string stringArray                Helm set STRING values on the command line (can be repeated to set several values: --helm-set-string key1=val1 --helm-set-string key2=val2)

docs/user-guide/commands/argocd_app_set.md

@@ -20,6 +20,7 @@ argocd app set APPNAME [flags]
       --directory-recurse                          Recurse directory
       --env string                                 Application environment to monitor
       --helm-chart string                          Helm Chart name
+      --helm-pass-credentials                      Pass credentials to all domain
       --helm-set stringArray                       Helm set values on the command line (can be repeated to set several values: --helm-set key1=val1 --helm-set key2=val2)
       --helm-set-file stringArray                  Helm set values from respective files specified via the command line (can be repeated to set several values: --helm-set-file key1=path1 --helm-set-file key2=path2)
       --helm-set-string stringArray                Helm set STRING values on the command line (can be repeated to set several values: --helm-set-string key1=val1 --helm-set-string key2=val2)

docs/user-guide/helm.md

@@ -33,8 +33,8 @@ flag. The flag can be repeated to support multiple values files:
 argocd app set helm-guestbook --values values-production.yaml
 ```
 !!! note
-    Values files must be in the same git repository as the Helm chart. The files can be in a different 
-    location in which case it can be accessed using a relative path relative to the root directory of 
+    Values files must be in the same git repository as the Helm chart. The files can be in a different
+    location in which case it can be accessed using a relative path relative to the root directory of
     the Helm chart.
 
 ## Helm Parameters
@@ -217,3 +217,24 @@ spec:
     helm:
       version: v3
 ```
+
+## Helm `--pass-credentials`
+
+Helm, [starting with v3.6.1](https://github.com/helm/helm/releases/tag/v3.6.1),
+prevents sending repository credentials to download charts that are being served
+from a different domain than the repository.
+
+If needed, it is possible to specifically set the Helm version to template with by setting the `helm-pass-credentials` flag on the cli:
+
+```bash
+argocd app set helm-guestbook --helm-pass-credentials
+```
+
+Or using declarative syntax:
+
+```yaml
+spec:
+  source:
+    helm:
+      passCredentials: true
+```

hack/installers/checksums/helm-v3.7.1-linux-amd64.tar.gz.sha256

@@ -0,0 +1 @@
+6cd6cad4b97e10c33c978ff3ac97bb42b68f79766f1d2284cfd62ec04cd177f4  helm-v3.7.1-linux-amd64.tar.gz

hack/tool-versions.sh

@@ -9,7 +9,7 @@
 # SHA256 sum of the binary.
 ###############################################################################
 helm2_version=2.17.0
-helm3_version=3.6.0
+helm3_version=3.7.1
 jq_version=1.6
 ksonnet_version=0.13.1
 kubectl_version=1.17.8

manifests/core-install.yaml

@@ -254,6 +254,10 @@ spec:
                                   type: string
                               type: object
                             type: array
+                          passCredentials:
+                            description: PassCredentials pass credentials to all domains
+                              (Helm's --pass-credentials)
+                            type: boolean
                           releaseName:
                             description: ReleaseName is the Helm release name to use.
                               If omitted it will use the application name
@@ -606,6 +610,10 @@ spec:
                               type: string
                           type: object
                         type: array
+                      passCredentials:
+                        description: PassCredentials pass credentials to all domains
+                          (Helm's --pass-credentials)
+                        type: boolean
                       releaseName:
                         description: ReleaseName is the Helm release name to use.
                           If omitted it will use the application name
@@ -972,6 +980,10 @@ spec:
                                     type: string
                                 type: object
                               type: array
+                            passCredentials:
+                              description: PassCredentials pass credentials to all
+                                domains (Helm's --pass-credentials)
+                              type: boolean
                             releaseName:
                               description: ReleaseName is the Helm release name to
                                 use. If omitted it will use the application name
@@ -1353,6 +1365,10 @@ spec:
                                           type: string
                                       type: object
                                     type: array
+                                  passCredentials:
+                                    description: PassCredentials pass credentials
+                                      to all domains (Helm's --pass-credentials)
+                                    type: boolean
                                   releaseName:
                                     description: ReleaseName is the Helm release name
                                       to use. If omitted it will use the application
@@ -1713,6 +1729,10 @@ spec:
                                       type: string
                                   type: object
                                 type: array
+                              passCredentials:
+                                description: PassCredentials pass credentials to all
+                                  domains (Helm's --pass-credentials)
+                                type: boolean
                               releaseName:
                                 description: ReleaseName is the Helm release name
                                   to use. If omitted it will use the application name
@@ -2060,6 +2080,10 @@ spec:
                                       type: string
                                   type: object
                                 type: array
+                              passCredentials:
+                                description: PassCredentials pass credentials to all
+                                  domains (Helm's --pass-credentials)
+                                type: boolean
                               releaseName:
                                 description: ReleaseName is the Helm release name
                                   to use. If omitted it will use the application name

manifests/crds/application-crd.yaml

@@ -253,6 +253,10 @@ spec:
                                   type: string
                               type: object
                             type: array
+                          passCredentials:
+                            description: PassCredentials pass credentials to all domains
+                              (Helm's --pass-credentials)
+                            type: boolean
                           releaseName:
                             description: ReleaseName is the Helm release name to use.
                               If omitted it will use the application name
@@ -605,6 +609,10 @@ spec:
                               type: string
                           type: object
                         type: array
+                      passCredentials:
+                        description: PassCredentials pass credentials to all domains
+                          (Helm's --pass-credentials)
+                        type: boolean
                       releaseName:
                         description: ReleaseName is the Helm release name to use.
                           If omitted it will use the application name
@@ -971,6 +979,10 @@ spec:
                                     type: string
                                 type: object
                               type: array
+                            passCredentials:
+                              description: PassCredentials pass credentials to all
+                                domains (Helm's --pass-credentials)
+                              type: boolean
                             releaseName:
                               description: ReleaseName is the Helm release name to
                                 use. If omitted it will use the application name
@@ -1352,6 +1364,10 @@ spec:
                                           type: string
                                       type: object
                                     type: array
+                                  passCredentials:
+                                    description: PassCredentials pass credentials
+                                      to all domains (Helm's --pass-credentials)
+                                    type: boolean
                                   releaseName:
                                     description: ReleaseName is the Helm release name
                                       to use. If omitted it will use the application
@@ -1712,6 +1728,10 @@ spec:
                                       type: string
                                   type: object
                                 type: array
+                              passCredentials:
+                                description: PassCredentials pass credentials to all
+                                  domains (Helm's --pass-credentials)
+                                type: boolean
                               releaseName:
                                 description: ReleaseName is the Helm release name
                                   to use. If omitted it will use the application name
@@ -2059,6 +2079,10 @@ spec:
                                       type: string
                                   type: object
                                 type: array
+                              passCredentials:
+                                description: PassCredentials pass credentials to all
+                                  domains (Helm's --pass-credentials)
+                                type: boolean
                               releaseName:
                                 description: ReleaseName is the Helm release name
                                   to use. If omitted it will use the application name