Merge pull request #1286 from cappyzawa/feat/object-level-config-validation

Add object-level configuration validation

.github/dependabot.yaml

@@ -0,0 +1,39 @@
+version: 2
+
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/"
+    labels: ["dependencies"]
+    schedule:
+      interval: "daily"
+    groups:
+      go-deps:
+        patterns:
+          - "*"
+    allow:
+      - dependency-type: "direct"
+    ignore:
+      # Kubernetes deps are updated by fluxcd/pkg/runtime
+      - dependency-name: "k8s.io/*"
+      - dependency-name: "sigs.k8s.io/*"
+      - dependency-name: "github.com/go-logr/*"
+      # jsondiff is updated by fluxcd/pkg/ssa
+      - dependency-name: "github.com/wI2L/jsondiff"
+      # OCI deps are updated by fluxcd/pkg/oci
+      - dependency-name: "github.com/google/go-containerregistry*"
+      - dependency-name: "github.com/opencontainers/*"
+      # Helm deps are updated by fluxcd/pkg/helmtestserver
+      - dependency-name: "helm.sh/helm/*"
+      - dependency-name: "github.com/Masterminds/semver/*"
+      # Flux APIs are updated at release time
+      - dependency-name: "github.com/fluxcd/helm-controller/api"
+      - dependency-name: "github.com/fluxcd/source-controller/api"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    labels: ["area/ci", "dependencies"]
+    groups:
+      ci:
+        patterns:
+          - "*"
+    schedule:
+      interval: "monthly"

.github/labels.yaml

@@ -0,0 +1,27 @@
+# Configuration file to declaratively configure labels
+# Ref: https://github.com/EndBug/label-sync#Config-files
+
+- name: area/drift
+  description: Drift detection/correction related issues and pull requests
+  color: '#ff5c00'
+- name: area/helm
+  description: Helm related issues and pull requests
+  color: '#1673b6'
+- name: area/kustomize
+  description: Kustomize (post-rendering) related issues and pull requests
+  color: '#00e54d'
+- name: area/oci
+  description: OCI related issues and pull requests
+  color: '#c739ff'
+- name: backport:release/v1.0.x
+  description: To be backported to release/v1.0.x
+  color: '#ffd700'
+- name: backport:release/v1.1.x
+  description: To be backported to release/v1.1.x
+  color: '#ffd700'
+- name: backport:release/v1.2.x
+  description: To be backported to release/v1.2.x
+  color: '#ffd700'
+- name: backport:release/v1.3.x
+  description: To be backported to release/v1.3.x
+  color: '#ffd700'

.github/workflows/backport.yaml

@@ -0,0 +1,34 @@
+name: backport
+
+on:
+  pull_request_target:
+    types: [closed, labeled]
+
+permissions:
+  contents: read
+
+jobs:
+  pull-request:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    if: github.event.pull_request.state == 'closed' && github.event.pull_request.merged && (github.event_name != 'labeled' || startsWith('backport:', github.event.label.name))
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Create backport PRs
+        uses: korthout/backport-action@0193454f0c5947491d348f33a275c119f30eb736 # v3.2.1
+        # xref: https://github.com/korthout/backport-action#inputs
+        with:
+          # Use token to allow workflows to be triggered for the created PR
+          github_token: ${{ secrets.BOT_GITHUB_TOKEN }}
+          # Match labels with a pattern `backport:<target-branch>`
+          label_pattern: '^backport:([^ ]+)$'
+          # A bit shorter pull-request title than the default
+          pull_title: '[${target_branch}] ${pull_title}'
+          # Simpler PR description than default
+          pull_description: |-
+            Automated backport to `${target_branch}`, triggered by a label in #${pull_number}.

.github/workflows/cifuzz.yaml

@@ -2,7 +2,8 @@ name: fuzz
 on:
   pull_request:
     branches:
-      - main
+      - "main"
+      - "release/**"
 
 permissions:
   contents: read # for actions/checkout to fetch code
@@ -12,17 +13,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - name: Setup Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
       with:
-        go-version: 1.19.x
-    - name: Restore Go cache
-      uses: actions/cache@v3
-      with:
-        path: ~/go/pkg/mod
-        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-        restore-keys: |
-          ${{ runner.os }}-go
+        go-version: 1.24.x
+        cache-dependency-path: |
+          **/go.sum
+          **/go.mod
     - name: Smoke test Fuzzers
       run: make fuzz-smoketest

.github/workflows/e2e.yaml

@@ -4,8 +4,8 @@ on:
   pull_request:
   push:
     branches:
-      - main
-      - "feature/**"
+      - "main"
+      - "release/**"
 
 permissions:
   contents: read # for actions/checkout to fetch code
@@ -15,25 +15,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Setup QEMU
-        uses: docker/setup-qemu-action@v1
-        with:
-          platforms: all
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
       - name: Setup Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
         with:
           buildkitd-flags: "--debug"
-      - name: Restore Go cache
-        uses: actions/cache@v3
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-
       - name: Cache Docker layers
-        uses: actions/cache@v3
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         id: cache
         with:
           path: /tmp/.buildx-cache
@@ -41,26 +32,24 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-buildx-ghcache-
       - name: Setup Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
-          go-version: 1.19.x
+          go-version: 1.24.x
+          cache-dependency-path: |
+            **/go.sum
+            **/go.mod
       - name: Setup Kubernetes
-        uses: engineerd/setup-kind@v0.5.0
+        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
         with:
-          version: v0.11.1
-          image: kindest/node:v1.21.1@sha256:69860bda5563ac81e3c0057d654b5253219618a22ec3a346306239bba8cfa1a6
+          version: v0.20.0
+          cluster_name: kind
+          node_image: kindest/node:v1.27.3@sha256:3966ac761ae0136263ffdb6cfd4db23ef8a83cba8a463690e98317add2c9ba72
       - name: Setup Helm
         uses: fluxcd/pkg/actions/helm@main
       - name: Setup Kustomize
         uses: fluxcd/pkg/actions/kustomize@main
-      - name: Setup Kubebuilder
-        uses: fluxcd/pkg/actions/kubebuilder@main
-      - name: Setup Kubectl
-        uses: fluxcd/pkg/actions/kubectl@main
       - name: Run tests
         run: make test
-        env:
-          KUBEBUILDER_ASSETS: ${{ github.workspace }}/kubebuilder/bin
       - name: Check if working tree is dirty
         run: |
           if [[ $(git diff --stat) != '' ]]; then
@@ -102,6 +91,14 @@ jobs:
           kubectl -n helm-system rollout status deploy/helm-controller --timeout=1m
         env:
           KUBEBUILDER_ASSETS: ${{ github.workspace }}/kubebuilder/bin
+      - name: Test samples
+        run: |
+          kubectl create ns samples
+          kubectl -n samples apply -f config/samples
+          kubectl -n samples wait hr/podinfo-ocirepository --for=condition=ready --timeout=4m
+          kubectl -n samples wait hr/podinfo-gitrepository --for=condition=ready --timeout=4m
+          kubectl -n samples wait hr/podinfo-helmrepository --for=condition=ready --timeout=4m
+          kubectl delete ns samples
       - name: Install sources
         run: |
           kubectl -n helm-system apply -f config/testdata/sources
@@ -149,6 +146,16 @@ jobs:
           kubectl -n install-create-target-ns get deployment install-create-target-ns-install-create-target-ns-podinfo
 
           kubectl -n helm-system delete -f config/testdata/install-create-target-ns
+      - name: Run install from helmChart test
+        run: |
+          kubectl -n helm-system apply -f config/testdata/install-from-hc-source
+          kubectl -n helm-system wait helmreleases/podinfo-from-hc --for=condition=ready --timeout=4m
+          kubectl -n helm-system delete -f config/testdata/install-from-hc-source
+      - name: Run install from ocirepo test
+        run: |
+          kubectl -n helm-system apply -f config/testdata/install-from-ocirepo-source
+          kubectl -n helm-system wait helmreleases/podinfo-from-ocirepo --for=condition=ready --timeout=4m
+          kubectl -n helm-system delete -f config/testdata/install-from-ocirepo-source
       - name: Run install fail test
         run: |
           test_name=install-fail
@@ -180,7 +187,7 @@ jobs:
           kubectl -n helm-system apply -f config/testdata/$test_name
           echo -n ">>> Waiting for expected conditions"
           count=0
-          until [ 'true' == "$( kubectl -n helm-system get helmrelease/$test_name -o json | jq '.status.conditions | map( { (.type): .status } ) | add | .Released=="False" and .TestSuccess=="False" and .Ready=="False"' )" ]; do
+          until [ 'true' == "$( kubectl -n helm-system get helmrelease/$test_name -o json | jq '.status.conditions | map( { (.type): .status } ) | add | .Released=="True" and .TestSuccess=="False" and .Ready=="False"' )" ]; do
             echo -n '.'
             sleep 5
             count=$((count + 1))
@@ -224,7 +231,7 @@ jobs:
           fi
 
           kubectl -n helm-system delete -f config/testdata/$test_name
-      - name: Run install fail with remedition test
+      - name: Run install fail with remediation test
         run: |
           test_name=install-fail-remediate
           kubectl -n helm-system apply -f config/testdata/$test_name
@@ -241,21 +248,22 @@ jobs:
           done
           echo ' done'
 
-          # Ensure release does not exist (was uninstalled).
-          HISTORY=$(helm -n helm-system history $test_name 2>&1; exit 0)
-          if [ "$HISTORY" != 'Error: release: not found' ]; then
-            echo -e "Unexpected release history: $HISTORY"
+          # Ensure release was uninstalled.
+          RELEASE_STATUS=$(helm -n helm-system history $test_name -o json | jq -r 'if length == 1 then .[0].status else empty end')
+          if [ "$RELEASE_STATUS" != "uninstalled" ]; then
+            echo -e "Unexpected release status: $RELEASE_STATUS"
             exit 1
           fi
 
           kubectl -n helm-system delete -f config/testdata/$test_name
+          helm -n helm-system delete $test_name
       - name: Run install fail with retry test
         run: |
           test_name=install-fail-retry
           kubectl -n helm-system apply -f config/testdata/$test_name
           echo -n ">>> Waiting for expected conditions"
           count=0
-          until [ 'true' == "$( kubectl -n helm-system get helmrelease/$test_name -o json | jq '.status.installFailures == 2 and ( .status.conditions | map( { (.type): .status } ) | add | .Released=="False" and .Ready=="False" )' )" ]; do
+          until [ 'true' == "$( kubectl -n helm-system get helmrelease/$test_name -o json | jq '.status.installFailures == 2 and ( .status.conditions | map( { (.type): .status } ) | add | .Released=="False" and .Ready=="False" and .Stalled=="True" )' )" ]; do
             echo -n '.'
             sleep 5
             count=$((count + 1))
@@ -301,7 +309,7 @@ jobs:
           kubectl -n helm-system apply -f config/testdata/$test_name/upgrade.yaml
           echo -n ">>> Waiting for expected conditions"
           count=0
-          until [ 'true' == "$( kubectl -n helm-system get helmrelease/$test_name -o json | jq '.status.conditions | map( { (.type): .status } ) | add | .Released=="False" and .Ready=="False"' )" ]; do
+          until [ 'true' == "$( kubectl -n helm-system get helmrelease/$test_name -o json | jq '.status.conditions | map( { (.type): .status } ) | add | .Released=="False" and .Ready=="False" and .Stalled=="True"' )" ]; do
             echo -n '.'
             sleep 5
             count=$((count + 1))
@@ -347,7 +355,7 @@ jobs:
           kubectl -n helm-system apply -f config/testdata/$test_name/upgrade.yaml
           echo -n ">>> Waiting for expected conditions"
           count=0
-          until [ 'true' == "$( kubectl -n helm-system get helmrelease/$test_name -o json | jq '.status.conditions | map( { (.type): .status } ) | add | .Released=="False" and .TestSuccess=="False" and .Ready=="False"' )" ]; do
+          until [ 'true' == "$( kubectl -n helm-system get helmrelease/$test_name -o json | jq '.status.conditions | map( { (.type): .status } ) | add | .Released=="True" and .TestSuccess=="False" and .Ready=="False" and .Stalled=="True"' )" ]; do
             echo -n '.'
             sleep 5
             count=$((count + 1))
@@ -468,6 +476,45 @@ jobs:
           fi
 
           kubectl delete -n helm-system -f config/testdata/$test_name/install.yaml
+      - name: Run upgrade from ocirepo source
+        run: |
+            test_name=upgrade-from-ocirepo-source
+            kubectl -n helm-system apply -f config/testdata/$test_name/install.yaml
+            echo -n ">>> Waiting for expected conditions"
+            count=0
+            until [ 'true' == "$( kubectl -n helm-system get helmrelease/$test_name -o json | jq '.status.conditions | map( { (.type): .status } ) | add | .Released=="True" and .Ready=="True"' )" ]; do
+              echo -n '.'
+              sleep 5
+              count=$((count + 1))
+              if [[ ${count} -eq 24 ]]; then
+                echo ' No more retries left!'
+                exit 1
+              fi
+            done
+            echo ' done'
+  
+            # Validate release was installed.
+            REVISION_COUNT=$(helm -n helm-system history -o json $test_name | jq 'length')
+            if [ "$REVISION_COUNT" != 1 ]; then
+              echo -e "Unexpected revision count: $REVISION_COUNT"
+              exit 1
+            fi
+  
+            kubectl -n helm-system apply -f config/testdata/$test_name/upgrade.yaml
+            echo -n ">>> Waiting for expected conditions"
+            count=0
+            until [ 'true' == "$( kubectl -n helm-system get helmrelease/$test_name -o json | jq '.status.conditions | map( { (.type): .status } ) | add | .Released=="True" and .Ready=="True"' )" ]; do
+              echo -n '.'
+              sleep 5
+              count=$((count + 1))
+              if [[ ${count} -eq 24 ]]; then
+                echo ' No more retries left!'
+                exit 1
+              fi
+            done
+            echo ' done'
+  
+            kubectl delete -n helm-system -f config/testdata/$test_name/install.yaml
       - name: Run upgrade fail with uninstall remediation strategy test
         run: |
           test_name=upgrade-fail-remediate-uninstall
@@ -542,6 +589,19 @@ jobs:
             fi
           done
           echo ' done'
+      - name: Run delete-ns tests
+        run: |
+          kubectl apply -f config/testdata/delete-ns
+          kubectl -n delete-ns wait helmreleases/podinfo --for=condition=ready --timeout=2m
+          kubectl delete ns delete-ns 1>/dev/null 2>&1 &
+          echo -n ">>> Waiting for namespace to be deleted"
+          if kubectl wait --for=delete namespace delete-ns --timeout=5m; then
+            echo ' Namespace deleted successfully'
+          else
+            echo ' Timed out waiting for namespace to be deleted'
+            kubectl get all -n delete-ns
+            exit 1
+          fi
       - name: Run post-renderer-kustomize test
         run: |
           kubectl -n helm-system apply -f config/testdata/post-renderer-kustomize
@@ -557,7 +617,7 @@ jobs:
             exit 1
           fi
           kubectl -n helm-system delete -f config/testdata/post-renderer-kustomize
-      - name: Boostrap CRDs Upgrade Tests
+      - name: Bootstrap CRDs Upgrade Tests
         if: ${{ startsWith(github.ref, 'refs/tags/') || startsWith(github.ref, 'refs/heads/') }}
         run: |
           REF=${{ github.ref }}
@@ -594,9 +654,6 @@ jobs:
       - name: Debug failure
         if: failure()
         run: |
-          which kubectl
-          kubectl version
-          helm version
           kubectl -n helm-system get helmrepositories -oyaml || true
           kubectl -n helm-system get helmcharts -oyaml || true
           kubectl -n helm-system get helmreleases -oyaml || true

.github/workflows/nightly.yaml

@@ -14,18 +14,17 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Setup QEMU
-        uses: docker/setup-qemu-action@v1
-        with:
-          platforms: all
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
       - name: Setup Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
         with:
           buildkitd-flags: "--debug"
       - name: Build multi-arch container image
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           push: false
           builder: ${{ steps.buildx.outputs.name }}

.github/workflows/release.yml

@@ -7,22 +7,29 @@ on:
     inputs:
       tag:
         description: 'image tag prefix'
-        default: 'rc'
+        default: 'preview'
         required: true
 
 permissions:
-  contents: write # needed to write releases
-  id-token: write # needed for keyless signing
-  packages: write # needed for ghcr access
+  contents: read
 
 env:
   CONTROLLER: ${{ github.event.repository.name }}
 
 jobs:
-  build-push:
+  release:
+    outputs:
+      hashes: ${{ steps.slsa.outputs.hashes }}
+      image_url: ${{ steps.slsa.outputs.image_url }}
+      image_digest: ${{ steps.slsa.outputs.image_digest }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # for creating the GitHub release.
+      id-token: write # for creating OIDC tokens for signing.
+      packages: write # for pushing and signing container images.
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Setup Kustomize
         uses: fluxcd/pkg/actions/kustomize@main
       - name: Prepare
@@ -32,27 +39,27 @@ jobs:
           if [[ $GITHUB_REF == refs/tags/* ]]; then
             VERSION=${GITHUB_REF/refs\/tags\//}
           fi
-          echo ::set-output name=BUILD_DATE::$(date -u +'%Y-%m-%dT%H:%M:%SZ')
-          echo ::set-output name=VERSION::${VERSION}
+          echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
+          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
       - name: Setup QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
       - name: Setup Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
           registry: ghcr.io
           username: fluxcdbot
           password: ${{ secrets.GHCR_TOKEN }}
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
           username: fluxcdbot
           password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
       - name: Generate images meta
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
         with:
           images: |
             fluxcd/${{ env.CONTROLLER }}
@@ -60,8 +67,11 @@ jobs:
           tags: |
             type=raw,value=${{ steps.prep.outputs.VERSION }}
       - name: Publish images
-        uses: docker/build-push-action@v3
+        id: build-push
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
+          sbom: true
+          provenance: true
           push: true
           builder: ${{ steps.buildx.outputs.name }}
           context: .
@@ -69,32 +79,82 @@ jobs:
           platforms: linux/amd64,linux/arm/v7,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-      - name: Check images
-        run: |
-          docker buildx imagetools inspect docker.io/fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.VERSION }}
-          docker buildx imagetools inspect ghcr.io/fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.VERSION }}
-          docker pull docker.io/fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.VERSION }}
-          docker pull ghcr.io/fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.VERSION }}
-      - uses: sigstore/cosign-installer@main
+      - uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1
       - name: Sign images
         env:
           COSIGN_EXPERIMENTAL: 1
         run: |
-          cosign sign fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.VERSION }}
-          cosign sign ghcr.io/fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.VERSION }}
+          cosign sign --yes fluxcd/${{ env.CONTROLLER }}@${{ steps.build-push.outputs.digest }}
+          cosign sign --yes ghcr.io/fluxcd/${{ env.CONTROLLER }}@${{ steps.build-push.outputs.digest }}
       - name: Generate release artifacts
         if: startsWith(github.ref, 'refs/tags/v')
         run: |
           mkdir -p config/release
           kustomize build ./config/crd > ./config/release/${{ env.CONTROLLER }}.crds.yaml
           kustomize build ./config/manager > ./config/release/${{ env.CONTROLLER }}.deployment.yaml
-          echo '[CHANGELOG](https://github.com/fluxcd/${{ env.CONTROLLER }}/blob/main/CHANGELOG.md)' > ./config/release/notes.md
-      - uses: anchore/sbom-action/download-syft@v0
+      - uses: anchore/sbom-action/download-syft@cee1b8e05ae5b2593a75e197229729eabaa9f8ec # v0.20.2
       - name: Create release and SBOM
+        id: run-goreleaser
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: goreleaser/goreleaser-action@v3
+        uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
         with:
           version: latest
-          args: release --release-notes=config/release/notes.md --rm-dist --skip-validate
+          args: release --clean --skip=validate
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Generate SLSA metadata
+        id: slsa
+        env:
+          ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}"
+        run: |
+          hashes=$(echo -E $ARTIFACTS | jq --raw-output '.[] | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {digest} + {name} | join("  ") | sub("^sha256:";"")' | base64 -w0)
+          echo "hashes=$hashes" >> $GITHUB_OUTPUT
+          
+          image_url=fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.version }}
+          echo "image_url=$image_url" >> $GITHUB_OUTPUT
+          
+          image_digest=${{ steps.build-push.outputs.digest }}
+          echo "image_digest=$image_digest" >> $GITHUB_OUTPUT
+
+  release-provenance:
+    needs: [release]
+    permissions:
+      actions: read # for detecting the Github Actions environment.
+      id-token: write # for creating OIDC tokens for signing.
+      contents: write # for uploading attestations to GitHub releases.
+    if: startsWith(github.ref, 'refs/tags/v')
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
+    with:
+      provenance-name: "provenance.intoto.jsonl"
+      base64-subjects: "${{ needs.release.outputs.hashes }}"
+      upload-assets: true
+
+  dockerhub-provenance:
+    needs: [release]
+    permissions:
+      actions: read # for detecting the Github Actions environment.
+      id-token: write # for creating OIDC tokens for signing.
+      packages: write # for uploading attestations.
+    if: startsWith(github.ref, 'refs/tags/v')
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
+    with:
+      image: ${{ needs.release.outputs.image_url }}
+      digest: ${{ needs.release.outputs.image_digest }}
+      registry-username: fluxcdbot
+    secrets:
+      registry-password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
+
+  ghcr-provenance:
+    needs: [release]
+    permissions:
+      actions: read # for detecting the Github Actions environment.
+      id-token: write # for creating OIDC tokens for signing.
+      packages: write # for uploading attestations.
+    if: startsWith(github.ref, 'refs/tags/v')
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
+    with:
+      image: ghcr.io/${{ needs.release.outputs.image_url }}
+      digest: ${{ needs.release.outputs.image_digest }}
+      registry-username: fluxcdbot
+    secrets:
+      registry-password: ${{ secrets.GHCR_TOKEN }}

.github/workflows/scan.yaml

@@ -1,9 +1,9 @@
 name: scan
 on:
   push:
-    branches: [ main ]
+    branches: [ "main", "release/**" ]
   pull_request:
-    branches: [ main ]
+    branches: [ "main", "release/**" ]
   schedule:
     - cron: '18 10 * * 3'
 
@@ -16,47 +16,36 @@ jobs:
     name: FOSSA
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Run FOSSA scan and upload build data
-        uses: fossa-contrib/fossa-action@v1
+        uses: fossa-contrib/fossa-action@3d2ef181b1820d6dcd1972f86a767d18167fa19b # v3.0.1
         with:
           # FOSSA Push-Only API Token
           fossa-api-key: 5ee8bf422db1471e0bcf2bcb289185de
           github-token: ${{ github.token }}
 
-  snyk:
-    name: Snyk
-    runs-on: ubuntu-latest
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-    steps:
-      - uses: actions/checkout@v3
-      - name: Run Snyk to check for vulnerabilities
-        uses: snyk/actions/golang@master
-        continue-on-error: true
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        with:
-          args: --sarif-file-output=snyk.sarif
-      - name: Upload result to GitHub Code Scanning
-        uses: github/codeql-action/upload-sarif@v1
-        with:
-          sarif_file: snyk.sarif
-
   codeql:
     name: CodeQL
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v3
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Setup Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
-          go-version: 1.19.x
+          go-version: 1.24.x
+          cache-dependency-path: |
+            **/go.sum
+            **/go.mod
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           languages: go
+          # xref: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+          # xref: https://codeql.github.com/codeql-query-help/go/
+          queries: security-and-quality
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v2
+        uses: github/codeql-action/autobuild@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2

.github/workflows/sync-labels.yaml

@@ -0,0 +1,28 @@
+name: sync-labels
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - .github/labels.yaml
+
+permissions:
+  contents: read
+
+jobs:
+  labels:
+    name: Run sync
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: EndBug/label-sync@52074158190acb45f3077f9099fea818aa43f97a # v2.3.3
+        with:
+          # Configuration file
+          config-file: |
+            https://raw.githubusercontent.com/fluxcd/community/main/.github/standard-labels.yaml
+            .github/labels.yaml
+          # Strictly declarative
+          delete-other-labels: true

.goreleaser.yaml

@@ -4,9 +4,26 @@ builds:
   - skip: true
 
 release:
-  prerelease: "true"
   extra_files:
     - glob: config/release/*.yaml
+  prerelease: "auto"
+  header: |
+    ## Changelog
+
+    [{{.Tag}} changelog](https://github.com/fluxcd/{{.ProjectName}}/blob/{{.Tag}}/CHANGELOG.md)
+  footer: |
+    ## Container images
+    
+    - `docker.io/fluxcd/{{.ProjectName}}:{{.Tag}}`
+    - `ghcr.io/fluxcd/{{.ProjectName}}:{{.Tag}}`
+    
+    Supported architectures: `linux/amd64`, `linux/arm64` and `linux/arm/v7`.
+    
+    The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
+    To verify the images and their provenance (SLSA level 3), please see the [security documentation](https://fluxcd.io/flux/security/).
+
+changelog:
+  disable: true
 
 checksum:
   extra_files:
@@ -32,6 +49,7 @@ signs:
     certificate: "${artifact}.pem"
     args:
       - sign-blob
+      - "--yes"
       - "--output-certificate=${certificate}"
       - "--output-signature=${signature}"
       - "${artifact}"

DEVELOPMENT.md

@@ -24,7 +24,7 @@ If any of the above dependencies are not present on your system, the first invoc
 ## How to run the test suite
 
 Prerequisites:
-* Go >= 1.18
+* Go >= 1.24
 
 You can run the test suite by simply doing
 

Dockerfile

@@ -1,10 +1,10 @@
-ARG GO_VERSION=1.19
-ARG XX_VERSION=1.1.0
+ARG GO_VERSION=1.24
+ARG XX_VERSION=1.6.1
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 
 # Docker buildkit multi-arch build requires golang alpine
-FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine as builder
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS builder
 
 # Copy the build utilities.
 COPY --from=xx / /
@@ -25,22 +25,19 @@ RUN go mod download
 
 # copy source code
 COPY main.go main.go
-COPY controllers/ controllers/
 COPY internal/ internal/
 
 # build without specifing the arch
 ENV CGO_ENABLED=0
 RUN xx-go build -trimpath -a -o helm-controller main.go
 
-FROM alpine:3.16
+FROM alpine:3.21
 
-# link repo to the GitHub Container Registry image
-LABEL org.opencontainers.image.source="https://github.com/fluxcd/helm-controller"
-
-RUN apk add --no-cache ca-certificates tini
+RUN apk add --no-cache ca-certificates \
+    && update-ca-certificates
 
 COPY --from=builder /workspace/helm-controller /usr/local/bin/
 
 USER 65534:65534
 
-ENTRYPOINT [ "/sbin/tini", "--", "helm-controller" ]
+ENTRYPOINT [ "helm-controller" ]

Makefile

@@ -27,11 +27,26 @@ BUILD_PLATFORMS ?= linux/amd64
 # Architecture to use envtest with
 ENVTEST_ARCH ?= amd64
 
+# Paths to download the CRD dependency to.
+CRD_DEP_ROOT ?= $(BUILD_DIR)/config/crd/bases
+
+# Keep a record of the version of the downloaded source CRDs. It is used to
+# detect and download new CRDs when the SOURCE_VER changes.
+SOURCE_VER ?= $(shell go list -m all | grep github.com/fluxcd/source-controller/api | awk '{print $$2}')
+SOURCE_CRD_VER = $(CRD_DEP_ROOT)/.src-crd-$(SOURCE_VER)
+
+# HelmChart source CRD.
+HELMCHART_SOURCE_CRD ?= $(CRD_DEP_ROOT)/source.toolkit.fluxcd.io_helmcharts.yaml
+
+# API (doc) generation utilities
+CONTROLLER_GEN_VERSION ?= v0.16.1
+GEN_API_REF_DOCS_VERSION ?= e327d0730470cbd61b06300f81c5fcf91c23c113
+
 all: manager
 
 # Run tests
 KUBEBUILDER_ASSETS?="$(shell $(ENVTEST) --arch=$(ENVTEST_ARCH) use -i $(ENVTEST_KUBERNETES_VERSION) --bin-dir=$(ENVTEST_ASSETS_DIR) -p path)"
-test: tidy generate fmt vet manifests api-docs install-envtest
+test: tidy generate fmt vet manifests api-docs install-envtest download-crd-deps
 	KUBEBUILDER_ASSETS=$(KUBEBUILDER_ASSETS) go test ./... -coverprofile cover.out
 	cd api; go test ./... -coverprofile cover.out
 
@@ -77,12 +92,12 @@ manifests: controller-gen
 
 # Generate API reference documentation
 api-docs: gen-crd-api-reference-docs
-	$(GEN_CRD_API_REFERENCE_DOCS) -api-dir=./api/v2beta1 -config=./hack/api-docs/config.json -template-dir=./hack/api-docs/template -out-file=./docs/api/helmrelease.md
+	$(GEN_CRD_API_REFERENCE_DOCS) -api-dir=./api/v2 -config=./hack/api-docs/config.json -template-dir=./hack/api-docs/template -out-file=./docs/api/v2/helm.md
 
 # Run go mod tidy
 tidy:
-	cd api; rm -f go.sum; go mod tidy -compat=1.19
-	rm -f go.sum; go mod tidy -compat=1.19
+	cd api; rm -f go.sum; go mod tidy -compat=1.23
+	rm -f go.sum; go mod tidy -compat=1.23
 
 # Run go fmt against code
 fmt:
@@ -109,17 +124,35 @@ docker-build:
 docker-push:
 	docker push ${IMG}
 
+# Delete previously downloaded CRDs and record the new version of the source
+# CRDs.
+$(SOURCE_CRD_VER):
+	rm -f $(CRD_DEP_ROOT)/.src-crd*
+	mkdir -p $(CRD_DEP_ROOT)
+	$(MAKE) cleanup-crd-deps
+	touch $(SOURCE_CRD_VER)
+
+$(HELMCHART_SOURCE_CRD):
+	curl -s https://raw.githubusercontent.com/fluxcd/source-controller/${SOURCE_VER}/config/crd/bases/source.toolkit.fluxcd.io_helmcharts.yaml > $(HELMCHART_SOURCE_CRD)
+
+# Download the CRDs the controller depends on
+download-crd-deps: $(SOURCE_CRD_VER) $(HELMCHART_SOURCE_CRD)
+
+# Delete the downloaded CRD dependencies.
+cleanup-crd-deps:
+	rm -f $(HELMCHART_SOURCE_CRD)
+
 # Find or download controller-gen
 CONTROLLER_GEN = $(GOBIN)/controller-gen
 .PHONY: controller-gen
 controller-gen: ## Download controller-gen locally if necessary.
-	$(call go-install-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen@v0.8.0)
+	$(call go-install-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen@$(CONTROLLER_GEN_VERSION))
 
 # Find or download gen-crd-api-reference-docs
 GEN_CRD_API_REFERENCE_DOCS = $(GOBIN)/gen-crd-api-reference-docs
 .PHONY: gen-crd-api-reference-docs
-gen-crd-api-reference-docs:
-	$(call go-install-tool,$(GEN_CRD_API_REFERENCE_DOCS),github.com/ahmetb/gen-crd-api-reference-docs@v0.3.0)
+gen-crd-api-reference-docs: ## Download gen-crd-api-reference-docs locally if necessary
+	$(call go-install-tool,$(GEN_CRD_API_REFERENCE_DOCS),github.com/ahmetb/gen-crd-api-reference-docs@$(GEN_API_REF_DOCS_VERSION))
 
 ENVTEST_ASSETS_DIR=$(BUILD_DIR)/testbin
 ENVTEST_KUBERNETES_VERSION?=latest

PROJECT

@@ -4,4 +4,11 @@ resources:
 - group: helm
   kind: HelmRelease
   version: v2beta1
+- group: helm
+  kind: HelmRelease
+  version: v2beta2
+- group: helm
+  kind: HelmRelease
+  version: v2
+storageVersion: v2
 version: "2"

README.md

@@ -24,7 +24,7 @@ operator.
 * Supports `HelmChart` artifacts produced from `HelmRepository`,
   `GitRepository` and `Bucket` sources
 * Fetches artifacts produced by [source-controller][] from `HelmChart`
-  objects
+  and `OCIRepository` objects
 * Watches `HelmChart` objects for revision changes (including semver
   ranges for charts from `HelmRepository` sources)
 * Performs automated Helm actions, including Helm tests, rollbacks and
@@ -38,16 +38,18 @@ operator.
   [notification-controller][])
 * Built-in Kustomize compatible Helm post renderer, providing support
   for strategic merge, JSON 6902 and images patches
+* Supports detecting and correcting in-cluster changes compared to the desired
+  state of the Helm release
 
 ## Guides
 
-* [Get started with GitOps Toolkit](https://fluxcd.io/flux/get-started/)
+* [Get started with Flux](https://fluxcd.io/flux/get-started/)
 * [Manage Helm Releases](https://fluxcd.io/flux/guides/helmreleases/)
 * [Setup Notifications](https://fluxcd.io/flux/guides/notifications/)
 
 ## Specifications
 
-* [API](docs/spec/v2beta1/README.md)
+* [API](docs/spec/v2/README.md)
 * [Controller](docs/spec/README.md)
 
 [source-controller]: https://github.com/fluxcd/source-controller

api/go.mod

@@ -1,32 +1,33 @@
 module github.com/fluxcd/helm-controller/api
 
-go 1.18
+go 1.24.0
 
 require (
-	github.com/fluxcd/pkg/apis/kustomize v0.7.0
-	github.com/fluxcd/pkg/apis/meta v0.18.0
-	k8s.io/apiextensions-apiserver v0.25.4
-	k8s.io/apimachinery v0.25.4
-	sigs.k8s.io/controller-runtime v0.13.1
+	github.com/fluxcd/pkg/apis/kustomize v1.11.0
+	github.com/fluxcd/pkg/apis/meta v1.18.0
+	k8s.io/apiextensions-apiserver v0.33.2
+	k8s.io/apimachinery v0.33.2
+	sigs.k8s.io/controller-runtime v0.21.0
+	sigs.k8s.io/yaml v1.5.0
 )
 
-// Fix CVE-2022-32149
-replace golang.org/x/text => golang.org/x/text v0.4.0
-
 require (
-	github.com/go-logr/logr v1.2.3 // indirect
+	github.com/fxamacker/cbor/v2 v2.8.0 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
-	golang.org/x/net v0.2.0 // indirect
-	golang.org/x/text v0.4.0 // indirect
-	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
+	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	golang.org/x/net v0.41.0 // indirect
+	golang.org/x/text v0.27.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
-	k8s.io/klog/v2 v2.80.1 // indirect
-	k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2 // indirect
-	sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/utils v0.0.0-20250321185631-1f6e0b77f77e // indirect
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.7.0 // indirect
 )

api/go.sum

@@ -1,81 +1,91 @@
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fluxcd/pkg/apis/kustomize v0.7.0 h1:X2htBmJ91nGYv4d93gin665MFWKNGiNwUiZ08/Zz0hY=
-github.com/fluxcd/pkg/apis/kustomize v0.7.0/go.mod h1:Mu+KdktsEKWA4l/33CZdY5lB4hz51mqfcLzBZSwAqVg=
-github.com/fluxcd/pkg/apis/meta v0.18.0 h1:s0LeulWcQ4DxVX6805vgDTxlA6bAYk+Lq1QHSnNdqLM=
-github.com/fluxcd/pkg/apis/meta v0.18.0/go.mod h1:pYvXRFi1UKNNrGR34jw3uqOnMXw9X6dTkML8j5Z7tis=
-github.com/fsnotify/fsnotify v1.5.4 h1:jRbGcIw6P2Meqdwuo0H1p6JVLbL5DHKAKlYndzMwVZI=
-github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0=
-github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/fluxcd/pkg/apis/kustomize v1.11.0 h1:0IzDgxZkc4v+5SDNCvgZhfwfkdkQLPXCner7TNaJFWE=
+github.com/fluxcd/pkg/apis/kustomize v1.11.0/go.mod h1:j302mJGDww8cn9qvMsRQ0LJ1HPAPs/IlX7CSsoJV7BI=
+github.com/fluxcd/pkg/apis/meta v1.18.0 h1:ACHrMIjlcioE9GKS7NGk62KX4NshqNewr8sBwMcXABs=
+github.com/fluxcd/pkg/apis/meta v1.18.0/go.mod h1:97l3hTwBpJbXBY+wetNbqrUsvES8B1jGioKcBUxmqd8=
+github.com/fxamacker/cbor/v2 v2.8.0 h1:fFtUGXUzXPHTIUdne5+zzMPTfffl3RD5qYnkY40vtxU=
+github.com/fxamacker/cbor/v2 v2.8.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
-github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
-github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
-github.com/onsi/gomega v1.20.1 h1:PA/3qinGoukvymdIDV8pii6tiZgC8kbmJO6Z5+b002Q=
+github.com/onsi/ginkgo/v2 v2.22.0 h1:Yed107/8DjTr0lKCNt7Dn8yQ6ybuDRQoMGrNFKzMfHg=
+github.com/onsi/ginkgo/v2 v2.22.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
+github.com/onsi/gomega v1.36.1 h1:bJDPBO7ibjxcbHMgSCoo4Yj18UWbKDlLwX1x9sybDcw=
+github.com/onsi/gomega v1.36.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.3 h1:bXOww4E/J3f66rav3pX3m8w6jDE4knZjGOw8b5Y6iNE=
+go.yaml.in/yaml/v3 v3.0.3/go.mod h1:tBHosrYAkRZjRAOREWbDnBXUf08JOwYq++0QNwQiWzI=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.2.0 h1:sZfSu1wtKLGlWI4ZZayP0ck9Y73K1ynO6gqzTdBVdPU=
-golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
+golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.2.0 h1:ljd4t30dBnAvMZaQCevtY0xLLD0A+bRZXbgLMLU1F/A=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/text v0.4.0 h1:BrVqGRd7+k1DiOgtnFvAkoQEWQvBc25ouMJM6429SFg=
-golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
+golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
+golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -85,24 +95,27 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntN
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-k8s.io/api v0.25.4 h1:3YO8J4RtmG7elEgaWMb4HgmpS2CfY1QlaOz9nwB+ZSs=
-k8s.io/apiextensions-apiserver v0.25.4 h1:7hu9pF+xikxQuQZ7/30z/qxIPZc2J1lFElPtr7f+B6U=
-k8s.io/apiextensions-apiserver v0.25.4/go.mod h1:bkSGki5YBoZWdn5pWtNIdGvDrrsRWlmnvl9a+tAw5vQ=
-k8s.io/apimachinery v0.25.4 h1:CtXsuaitMESSu339tfhVXhQrPET+EiWnIY1rcurKnAc=
-k8s.io/apimachinery v0.25.4/go.mod h1:jaF9C/iPNM1FuLl7Zuy5b9v+n35HGSh6AQ4HYRkCqwo=
-k8s.io/klog/v2 v2.80.1 h1:atnLQ121W371wYYFawwYx1aEY2eUfs4l3J72wtgAwV4=
-k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
-k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2 h1:GfD9OzL11kvZN5iArC6oTS7RTj7oJOIfnislxYlqTj8=
-k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/controller-runtime v0.13.1 h1:tUsRCSJVM1QQOOeViGeX3GMT3dQF1eePPw6sEE3xSlg=
-sigs.k8s.io/controller-runtime v0.13.1/go.mod h1:Zbz+el8Yg31jubvAEyglRZGdLAjplZl+PgtYNI6WNTI=
-sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 h1:iXTIw73aPyC+oRdyqqvVJuloN1p0AC/kzH07hu3NE+k=
-sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE=
-sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
-sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+k8s.io/api v0.33.2 h1:YgwIS5jKfA+BZg//OQhkJNIfie/kmRsO0BmNaVSimvY=
+k8s.io/api v0.33.2/go.mod h1:fhrbphQJSM2cXzCWgqU29xLDuks4mu7ti9vveEnpSXs=
+k8s.io/apiextensions-apiserver v0.33.2 h1:6gnkIbngnaUflR3XwE1mCefN3YS8yTD631JXQhsU6M8=
+k8s.io/apiextensions-apiserver v0.33.2/go.mod h1:IvVanieYsEHJImTKXGP6XCOjTwv2LUMos0YWc9O+QP8=
+k8s.io/apimachinery v0.33.2 h1:IHFVhqg59mb8PJWTLi8m1mAoepkUNYmptHsV+Z1m5jY=
+k8s.io/apimachinery v0.33.2/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
+k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
+k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/utils v0.0.0-20250321185631-1f6e0b77f77e h1:KqK5c/ghOm8xkHYhlodbp6i6+r+ChV2vuAuVRdFbLro=
+k8s.io/utils v0.0.0-20250321185631-1f6e0b77f77e/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/controller-runtime v0.21.0 h1:CYfjpEuicjUecRk+KAeyYh+ouUBn4llGyDYytIGcJS8=
+sigs.k8s.io/controller-runtime v0.21.0/go.mod h1:OSg14+F65eWqIu4DceX7k/+QRAbTTvxeQSNSOQpukWM=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v4 v4.7.0 h1:qPeWmscJcXP0snki5IYF79Z8xrl8ETFxgMd7wez1XkI=
+sigs.k8s.io/structured-merge-diff/v4 v4.7.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/yaml v1.5.0 h1:M10b2U7aEUY6hRtU870n2VTPgR5RZiL/I6Lcc2F4NUQ=
+sigs.k8s.io/yaml v1.5.0/go.mod h1:wZs27Rbxoai4C0f8/9urLZtZtF3avA3gKvGyPdDqTO4=

api/v2/annotations.go

@@ -0,0 +1,57 @@
+/*
+Copyright 2024 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v2
+
+import "github.com/fluxcd/pkg/apis/meta"
+
+const (
+	// ForceRequestAnnotation is the annotation used for triggering a one-off forced
+	// Helm release, even when there are no new changes in the HelmRelease.
+	// The value is interpreted as a token, and must equal the value of
+	// meta.ReconcileRequestAnnotation in order to trigger a release.
+	ForceRequestAnnotation string = meta.ForceRequestAnnotation
+
+	// ResetRequestAnnotation is the annotation used for resetting the failure counts
+	// of a HelmRelease, so that it can be retried again.
+	// The value is interpreted as a token, and must equal the value of
+	// meta.ReconcileRequestAnnotation in order to reset the failure counts.
+	ResetRequestAnnotation string = "reconcile.fluxcd.io/resetAt"
+)
+
+// ShouldHandleResetRequest returns true if the HelmRelease has a reset request
+// annotation, and the value of the annotation matches the value of the
+// meta.ReconcileRequestAnnotation annotation.
+//
+// To ensure that the reset request is handled only once, the value of
+// HelmReleaseStatus.LastHandledResetAt is updated to match the value of the
+// reset request annotation (even if the reset request is not handled because
+// the value of the meta.ReconcileRequestAnnotation annotation does not match).
+func ShouldHandleResetRequest(obj *HelmRelease) bool {
+	return meta.HandleAnnotationRequest(obj, ResetRequestAnnotation, &obj.Status.LastHandledResetAt)
+}
+
+// ShouldHandleForceRequest returns true if the HelmRelease has a force request
+// annotation, and the value of the annotation matches the value of the
+// meta.ReconcileRequestAnnotation annotation.
+//
+// To ensure that the force request is handled only once, the value of
+// HelmReleaseStatus.LastHandledForceAt is updated to match the value of the
+// force request annotation (even if the force request is not handled because
+// the value of the meta.ReconcileRequestAnnotation annotation does not match).
+func ShouldHandleForceRequest(obj *HelmRelease) bool {
+	return meta.ShouldHandleForceRequest(obj)
+}

api/v2/annotations_test.go

@@ -0,0 +1,50 @@
+/*
+Copyright 2024 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v2
+
+import (
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/fluxcd/pkg/apis/meta"
+)
+
+func TestShouldHandleResetRequest(t *testing.T) {
+	obj := &HelmRelease{
+		ObjectMeta: metav1.ObjectMeta{
+			Annotations: map[string]string{
+				meta.ReconcileRequestAnnotation: "b",
+				ResetRequestAnnotation:          "b",
+			},
+		},
+		Status: HelmReleaseStatus{
+			LastHandledResetAt: "a",
+			ReconcileRequestStatus: meta.ReconcileRequestStatus{
+				LastHandledReconcileAt: "a",
+			},
+		},
+	}
+
+	if !ShouldHandleResetRequest(obj) {
+		t.Error("ShouldHandleResetRequest() = false")
+	}
+
+	if obj.Status.LastHandledResetAt != "b" {
+		t.Error("ShouldHandleResetRequest did not update LastHandledResetAt")
+	}
+}

api/v2/condition_types.go

@@ -0,0 +1,82 @@
+/*
+Copyright 2024 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v2
+
+const (
+	// ReleasedCondition represents the status of the last release attempt
+	// (install/upgrade/test) against the latest desired state.
+	ReleasedCondition string = "Released"
+
+	// TestSuccessCondition represents the status of the last test attempt against
+	// the latest desired state.
+	TestSuccessCondition string = "TestSuccess"
+
+	// RemediatedCondition represents the status of the last remediation attempt
+	// (uninstall/rollback) due to a failure of the last release attempt against the
+	// latest desired state.
+	RemediatedCondition string = "Remediated"
+)
+
+const (
+	// InstallSucceededReason represents the fact that the Helm install for the
+	// HelmRelease succeeded.
+	InstallSucceededReason string = "InstallSucceeded"
+
+	// InstallFailedReason represents the fact that the Helm install for the
+	// HelmRelease failed.
+	InstallFailedReason string = "InstallFailed"
+
+	// UpgradeSucceededReason represents the fact that the Helm upgrade for the
+	// HelmRelease succeeded.
+	UpgradeSucceededReason string = "UpgradeSucceeded"
+
+	// UpgradeFailedReason represents the fact that the Helm upgrade for the
+	// HelmRelease failed.
+	UpgradeFailedReason string = "UpgradeFailed"
+
+	// TestSucceededReason represents the fact that the Helm tests for the
+	// HelmRelease succeeded.
+	TestSucceededReason string = "TestSucceeded"
+
+	// TestFailedReason represents the fact that the Helm tests for the HelmRelease
+	// failed.
+	TestFailedReason string = "TestFailed"
+
+	// RollbackSucceededReason represents the fact that the Helm rollback for the
+	// HelmRelease succeeded.
+	RollbackSucceededReason string = "RollbackSucceeded"
+
+	// RollbackFailedReason represents the fact that the Helm test for the
+	// HelmRelease failed.
+	RollbackFailedReason string = "RollbackFailed"
+
+	// UninstallSucceededReason represents the fact that the Helm uninstall for the
+	// HelmRelease succeeded.
+	UninstallSucceededReason string = "UninstallSucceeded"
+
+	// UninstallFailedReason represents the fact that the Helm uninstall for the
+	// HelmRelease failed.
+	UninstallFailedReason string = "UninstallFailed"
+
+	// ArtifactFailedReason represents the fact that the artifact download for the
+	// HelmRelease failed.
+	ArtifactFailedReason string = "ArtifactFailed"
+
+	// DependencyNotReadyReason represents the fact that
+	// one of the dependencies is not ready.
+	DependencyNotReadyReason string = "DependencyNotReady"
+)

api/v2/doc.go

@@ -0,0 +1,20 @@
+/*
+Copyright 2024 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package v2 contains API Schema definitions for the helm v2 API group
+// +kubebuilder:object:generate=true
+// +groupName=helm.toolkit.fluxcd.io
+package v2

api/v2/groupversion_info.go

@@ -0,0 +1,33 @@
+/*
+Copyright 2024 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v2
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/scheme"
+)
+
+var (
+	// GroupVersion is group version used to register these objects
+	GroupVersion = schema.GroupVersion{Group: "helm.toolkit.fluxcd.io", Version: "v2"}
+
+	// SchemeBuilder is used to add go types to the GroupVersionKind scheme
+	SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
+
+	// AddToScheme adds the types in this group-version to the given scheme.
+	AddToScheme = SchemeBuilder.AddToScheme
+)

api/v2/reference_types.go

@@ -0,0 +1,90 @@
+/*
+Copyright 2024 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v2
+
+// CrossNamespaceObjectReference contains enough information to let you locate
+// the typed referenced object at cluster level.
+type CrossNamespaceObjectReference struct {
+	// APIVersion of the referent.
+	// +optional
+	APIVersion string `json:"apiVersion,omitempty"`
+
+	// Kind of the referent.
+	// +kubebuilder:validation:Enum=HelmRepository;GitRepository;Bucket
+	// +required
+	Kind string `json:"kind,omitempty"`
+
+	// Name of the referent.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	// +required
+	Name string `json:"name"`
+
+	// Namespace of the referent.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=63
+	// +kubebuilder:validation:Optional
+	// +optional
+	Namespace string `json:"namespace,omitempty"`
+}
+
+// CrossNamespaceSourceReference contains enough information to let you locate
+// the typed referenced object at cluster level.
+type CrossNamespaceSourceReference struct {
+	// APIVersion of the referent.
+	// +optional
+	APIVersion string `json:"apiVersion,omitempty"`
+
+	// Kind of the referent.
+	// +kubebuilder:validation:Enum=OCIRepository;HelmChart
+	// +required
+	Kind string `json:"kind"`
+
+	// Name of the referent.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	// +required
+	Name string `json:"name"`
+
+	// Namespace of the referent, defaults to the namespace of the Kubernetes
+	// resource object that contains the reference.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=63
+	// +kubebuilder:validation:Optional
+	// +optional
+	Namespace string `json:"namespace,omitempty"`
+}
+
+// DependencyReference defines a HelmRelease dependency on another HelmRelease resource.
+type DependencyReference struct {
+	// Name of the referent.
+	// +required
+	Name string `json:"name"`
+
+	// Namespace of the referent, defaults to the namespace of the HelmRelease
+	// resource object that contains the reference.
+	// +optional
+	Namespace string `json:"namespace,omitempty"`
+
+	// ReadyExpr is a CEL expression that can be used to assess the readiness
+	// of a dependency. When specified, the built-in readiness check
+	// is replaced by the logic defined in the CEL expression.
+	// To make the CEL expression additive to the built-in readiness check,
+	// the feature gate `AdditiveCELDependencyCheck` must be set to `true`.
+	// +optional
+	ReadyExpr string `json:"readyExpr,omitempty"`
+}

api/v2/snapshot_types.go

@@ -0,0 +1,239 @@
+/*
+Copyright 2024 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v2
+
+import (
+	"fmt"
+	"sort"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+const (
+	// snapshotStatusDeployed indicates that the release the snapshot was taken
+	// from is currently deployed.
+	snapshotStatusDeployed = "deployed"
+	// snapshotStatusSuperseded indicates that the release the snapshot was taken
+	// from has been superseded by a newer release.
+	snapshotStatusSuperseded = "superseded"
+
+	// snapshotTestPhaseFailed indicates that the test of the release the snapshot
+	// was taken from has failed.
+	snapshotTestPhaseFailed = "Failed"
+)
+
+// Snapshots is a list of Snapshot objects.
+type Snapshots []*Snapshot
+
+// Len returns the number of Snapshots.
+func (in Snapshots) Len() int {
+	return len(in)
+}
+
+// SortByVersion sorts the Snapshots by version, in descending order.
+func (in Snapshots) SortByVersion() {
+	sort.Slice(in, func(i, j int) bool {
+		return in[i].Version > in[j].Version
+	})
+}
+
+// Latest returns the most recent Snapshot.
+func (in Snapshots) Latest() *Snapshot {
+	if len(in) == 0 {
+		return nil
+	}
+	in.SortByVersion()
+	return in[0]
+}
+
+// Previous returns the most recent Snapshot before the Latest that has a
+// status of "deployed" or "superseded", or nil if there is no such Snapshot.
+// Unless ignoreTests is true, Snapshots with a test in the "Failed" phase are
+// ignored.
+func (in Snapshots) Previous(ignoreTests bool) *Snapshot {
+	if len(in) < 2 {
+		return nil
+	}
+	in.SortByVersion()
+	for i := range in[1:] {
+		s := in[i+1]
+		if s.Status == snapshotStatusDeployed || s.Status == snapshotStatusSuperseded {
+			if ignoreTests || !s.HasTestInPhase(snapshotTestPhaseFailed) {
+				return s
+			}
+		}
+	}
+	return nil
+}
+
+// Truncate removes all Snapshots up to the Previous deployed Snapshot.
+// If there is no previous-deployed Snapshot, the most recent 5 Snapshots are
+// retained.
+func (in *Snapshots) Truncate(ignoreTests bool) {
+	if in.Len() < 2 {
+		return
+	}
+
+	in.SortByVersion()
+	for i := range (*in)[1:] {
+		s := (*in)[i+1]
+		if s.Status == snapshotStatusDeployed || s.Status == snapshotStatusSuperseded {
+			if ignoreTests || !s.HasTestInPhase(snapshotTestPhaseFailed) {
+				*in = (*in)[:i+2]
+				return
+			}
+		}
+	}
+
+	if in.Len() > defaultMaxHistory {
+		// If none of the Snapshots are deployed or superseded, and there
+		// are more than the defaultMaxHistory, truncate to the most recent
+		// Snapshots.
+		*in = (*in)[:defaultMaxHistory]
+	}
+}
+
+// Snapshot captures a point-in-time copy of the status information for a Helm release,
+// as managed by the controller.
+type Snapshot struct {
+	// APIVersion is the API version of the Snapshot.
+	// Provisional: when the calculation method of the Digest field is changed,
+	// this field will be used to distinguish between the old and new methods.
+	// +optional
+	APIVersion string `json:"apiVersion,omitempty"`
+	// Digest is the checksum of the release object in storage.
+	// It has the format of `<algo>:<checksum>`.
+	// +required
+	Digest string `json:"digest"`
+	// Name is the name of the release.
+	// +required
+	Name string `json:"name"`
+	// Namespace is the namespace the release is deployed to.
+	// +required
+	Namespace string `json:"namespace"`
+	// Version is the version of the release object in storage.
+	// +required
+	Version int `json:"version"`
+	// Status is the current state of the release.
+	// +required
+	Status string `json:"status"`
+	// ChartName is the chart name of the release object in storage.
+	// +required
+	ChartName string `json:"chartName"`
+	// ChartVersion is the chart version of the release object in
+	// storage.
+	// +required
+	ChartVersion string `json:"chartVersion"`
+	// AppVersion is the chart app version of the release object in storage.
+	// +optional
+	AppVersion string `json:"appVersion,omitempty"`
+	// ConfigDigest is the checksum of the config (better known as
+	// "values") of the release object in storage.
+	// It has the format of `<algo>:<checksum>`.
+	// +required
+	ConfigDigest string `json:"configDigest"`
+	// FirstDeployed is when the release was first deployed.
+	// +required
+	FirstDeployed metav1.Time `json:"firstDeployed"`
+	// LastDeployed is when the release was last deployed.
+	// +required
+	LastDeployed metav1.Time `json:"lastDeployed"`
+	// Deleted is when the release was deleted.
+	// +optional
+	Deleted metav1.Time `json:"deleted,omitempty"`
+	// TestHooks is the list of test hooks for the release as observed to be
+	// run by the controller.
+	// +optional
+	TestHooks *map[string]*TestHookStatus `json:"testHooks,omitempty"`
+	// OCIDigest is the digest of the OCI artifact associated with the release.
+	// +optional
+	OCIDigest string `json:"ociDigest,omitempty"`
+}
+
+// FullReleaseName returns the full name of the release in the format
+// of '<namespace>/<name>.<version>
+func (in *Snapshot) FullReleaseName() string {
+	if in == nil {
+		return ""
+	}
+	return fmt.Sprintf("%s/%s.v%d", in.Namespace, in.Name, in.Version)
+}
+
+// VersionedChartName returns the full name of the chart in the format of
+// '<name>@<version>'.
+func (in *Snapshot) VersionedChartName() string {
+	if in == nil {
+		return ""
+	}
+	return fmt.Sprintf("%s@%s", in.ChartName, in.ChartVersion)
+}
+
+// HasBeenTested returns true if TestHooks is not nil. This includes an empty
+// map, which indicates the chart has no tests.
+func (in *Snapshot) HasBeenTested() bool {
+	return in != nil && in.TestHooks != nil
+}
+
+// GetTestHooks returns the TestHooks for the release if not nil.
+func (in *Snapshot) GetTestHooks() map[string]*TestHookStatus {
+	if in == nil || in.TestHooks == nil {
+		return nil
+	}
+	return *in.TestHooks
+}
+
+// HasTestInPhase returns true if any of the TestHooks is in the given phase.
+func (in *Snapshot) HasTestInPhase(phase string) bool {
+	if in != nil {
+		for _, h := range in.GetTestHooks() {
+			if h.Phase == phase {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// SetTestHooks sets the TestHooks for the release.
+func (in *Snapshot) SetTestHooks(hooks map[string]*TestHookStatus) {
+	if in == nil || hooks == nil {
+		return
+	}
+	in.TestHooks = &hooks
+}
+
+// Targets returns true if the Snapshot targets the given release data.
+func (in *Snapshot) Targets(name, namespace string, version int) bool {
+	if in != nil {
+		return in.Name == name && in.Namespace == namespace && in.Version == version
+	}
+	return false
+}
+
+// TestHookStatus holds the status information for a test hook as observed
+// to be run by the controller.
+type TestHookStatus struct {
+	// LastStarted is the time the test hook was last started.
+	// +optional
+	LastStarted metav1.Time `json:"lastStarted,omitempty"`
+	// LastCompleted is the time the test hook last completed.
+	// +optional
+	LastCompleted metav1.Time `json:"lastCompleted,omitempty"`
+	// Phase the test hook was observed to be in.
+	// +optional
+	Phase string `json:"phase,omitempty"`
+}

api/v2/snapshot_types_test.go

@@ -0,0 +1,298 @@
+/*
+Copyright 2024 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v2
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestSnapshots_Sort(t *testing.T) {
+	tests := []struct {
+		name string
+		in   Snapshots
+		want Snapshots
+	}{
+		{
+			name: "sorts by descending version",
+			in: Snapshots{
+				{Version: 1},
+				{Version: 3},
+				{Version: 2},
+			},
+			want: Snapshots{
+				{Version: 3},
+				{Version: 2},
+				{Version: 1},
+			},
+		},
+		{
+			name: "already sorted",
+			in: Snapshots{
+				{Version: 3},
+				{Version: 2},
+				{Version: 1},
+			},
+			want: Snapshots{
+				{Version: 3},
+				{Version: 2},
+				{Version: 1},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tt.in.SortByVersion()
+
+			if !reflect.DeepEqual(tt.in, tt.want) {
+				t.Errorf("SortByVersion() got %v, want %v", tt.in, tt.want)
+			}
+		})
+	}
+}
+
+func TestSnapshots_Latest(t *testing.T) {
+	tests := []struct {
+		name string
+		in   Snapshots
+		want *Snapshot
+	}{
+		{
+			name: "returns most recent snapshot",
+			in: Snapshots{
+				{Version: 1},
+				{Version: 3},
+				{Version: 2},
+			},
+			want: &Snapshot{Version: 3},
+		},
+		{
+			name: "returns nil if empty",
+			in:   Snapshots{},
+			want: nil,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := tt.in.Latest(); !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("Latest() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestSnapshots_Previous(t *testing.T) {
+	tests := []struct {
+		name        string
+		in          Snapshots
+		ignoreTests bool
+		want        *Snapshot
+	}{
+		{
+			name: "returns previous snapshot",
+			in: Snapshots{
+				{Version: 2, Status: "deployed"},
+				{Version: 3, Status: "failed"},
+				{Version: 1, Status: "superseded"},
+			},
+			want: &Snapshot{Version: 2, Status: "deployed"},
+		},
+		{
+			name: "includes snapshots with failed tests",
+			in: Snapshots{
+				{Version: 4, Status: "deployed"},
+				{Version: 1, Status: "superseded"},
+				{Version: 2, Status: "superseded"},
+				{Version: 3, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+					"test": {Phase: "Failed"},
+				}},
+			},
+			ignoreTests: true,
+			want: &Snapshot{Version: 3, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+				"test": {Phase: "Failed"},
+			}},
+		},
+		{
+			name: "ignores snapshots with failed tests",
+			in: Snapshots{
+				{Version: 4, Status: "deployed"},
+				{Version: 1, Status: "superseded"},
+				{Version: 2, Status: "superseded"},
+				{Version: 3, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+					"test": {Phase: "Failed"},
+				}},
+			},
+			ignoreTests: false,
+			want:        &Snapshot{Version: 2, Status: "superseded"},
+		},
+		{
+			name: "returns nil without previous snapshot",
+			in: Snapshots{
+				{Version: 1, Status: "deployed"},
+			},
+			want: nil,
+		},
+		{
+			name: "returns nil without snapshot matching criteria",
+			in: Snapshots{
+				{Version: 4, Status: "deployed"},
+				{Version: 3, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+					"test": {Phase: "Failed"},
+				}},
+			},
+			ignoreTests: false,
+			want:        nil,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := tt.in.Previous(tt.ignoreTests); !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("Previous() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestSnapshots_Truncate(t *testing.T) {
+	tests := []struct {
+		name        string
+		in          Snapshots
+		ignoreTests bool
+		want        Snapshots
+	}{
+		{
+			name: "keeps previous snapshot",
+			in: Snapshots{
+				{Version: 1, Status: "superseded"},
+				{Version: 3, Status: "failed"},
+				{Version: 2, Status: "superseded"},
+				{Version: 4, Status: "deployed"},
+			},
+			want: Snapshots{
+				{Version: 4, Status: "deployed"},
+				{Version: 3, Status: "failed"},
+				{Version: 2, Status: "superseded"},
+			},
+		},
+		{
+			name: "ignores snapshots with failed tests",
+			in: Snapshots{
+				{Version: 4, Status: "deployed"},
+				{Version: 3, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+					"upgrade-test-fail-podinfo-fault-test-tiz9x": {Phase: "Failed"},
+					"upgrade-test-fail-podinfo-grpc-test-gddcw":  {},
+				}},
+				{Version: 2, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+					"upgrade-test-fail-podinfo-grpc-test-h0tc2": {
+						Phase: "Succeeded",
+					},
+					"upgrade-test-fail-podinfo-jwt-test-vzusa": {
+						Phase: "Succeeded",
+					},
+					"upgrade-test-fail-podinfo-service-test-b647e": {
+						Phase: "Succeeded",
+					},
+				}},
+			},
+			ignoreTests: false,
+			want: Snapshots{
+				{Version: 4, Status: "deployed"},
+				{Version: 3, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+					"upgrade-test-fail-podinfo-fault-test-tiz9x": {Phase: "Failed"},
+					"upgrade-test-fail-podinfo-grpc-test-gddcw":  {},
+				}},
+				{Version: 2, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+					"upgrade-test-fail-podinfo-grpc-test-h0tc2": {
+						Phase: "Succeeded",
+					},
+					"upgrade-test-fail-podinfo-jwt-test-vzusa": {
+						Phase: "Succeeded",
+					},
+					"upgrade-test-fail-podinfo-service-test-b647e": {
+						Phase: "Succeeded",
+					},
+				}},
+			},
+		},
+		{
+			name: "keeps previous snapshot with failed tests",
+			in: Snapshots{
+				{Version: 4, Status: "deployed"},
+				{Version: 3, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+					"upgrade-test-fail-podinfo-fault-test-tiz9x": {Phase: "Failed"},
+					"upgrade-test-fail-podinfo-grpc-test-gddcw":  {},
+				}},
+				{Version: 2, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+					"upgrade-test-fail-podinfo-grpc-test-h0tc2": {
+						Phase: "Succeeded",
+					},
+					"upgrade-test-fail-podinfo-jwt-test-vzusa": {
+						Phase: "Succeeded",
+					},
+					"upgrade-test-fail-podinfo-service-test-b647e": {
+						Phase: "Succeeded",
+					},
+				}},
+				{Version: 1, Status: "superseded"},
+			},
+			ignoreTests: true,
+			want: Snapshots{
+				{Version: 4, Status: "deployed"},
+				{Version: 3, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+					"upgrade-test-fail-podinfo-fault-test-tiz9x": {Phase: "Failed"},
+					"upgrade-test-fail-podinfo-grpc-test-gddcw":  {},
+				}},
+			},
+		},
+		{
+			name: "retains most recent snapshots when all have failed",
+			in: Snapshots{
+				{Version: 6, Status: "deployed"},
+				{Version: 5, Status: "failed"},
+				{Version: 4, Status: "failed"},
+				{Version: 3, Status: "failed"},
+				{Version: 2, Status: "failed"},
+				{Version: 1, Status: "failed"},
+			},
+			want: Snapshots{
+				{Version: 6, Status: "deployed"},
+				{Version: 5, Status: "failed"},
+				{Version: 4, Status: "failed"},
+				{Version: 3, Status: "failed"},
+				{Version: 2, Status: "failed"},
+			},
+		},
+		{
+			name: "without previous snapshot",
+			in: Snapshots{
+				{Version: 1, Status: "deployed"},
+			},
+			want: Snapshots{
+				{Version: 1, Status: "deployed"},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tt.in.Truncate(tt.ignoreTests)
+
+			if !reflect.DeepEqual(tt.in, tt.want) {
+				t.Errorf("Truncate() got %v, want %v", tt.in, tt.want)
+			}
+		})
+	}
+}

api/v2/zz_generated.deepcopy.go

@@ -0,0 +1,774 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2024 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package v2
+
+import (
+	"github.com/fluxcd/pkg/apis/kustomize"
+	"github.com/fluxcd/pkg/apis/meta"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CommonMetadata) DeepCopyInto(out *CommonMetadata) {
+	*out = *in
+	if in.Annotations != nil {
+		in, out := &in.Annotations, &out.Annotations
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Labels != nil {
+		in, out := &in.Labels, &out.Labels
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CommonMetadata.
+func (in *CommonMetadata) DeepCopy() *CommonMetadata {
+	if in == nil {
+		return nil
+	}
+	out := new(CommonMetadata)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CrossNamespaceObjectReference) DeepCopyInto(out *CrossNamespaceObjectReference) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CrossNamespaceObjectReference.
+func (in *CrossNamespaceObjectReference) DeepCopy() *CrossNamespaceObjectReference {
+	if in == nil {
+		return nil
+	}
+	out := new(CrossNamespaceObjectReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CrossNamespaceSourceReference) DeepCopyInto(out *CrossNamespaceSourceReference) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CrossNamespaceSourceReference.
+func (in *CrossNamespaceSourceReference) DeepCopy() *CrossNamespaceSourceReference {
+	if in == nil {
+		return nil
+	}
+	out := new(CrossNamespaceSourceReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DependencyReference) DeepCopyInto(out *DependencyReference) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DependencyReference.
+func (in *DependencyReference) DeepCopy() *DependencyReference {
+	if in == nil {
+		return nil
+	}
+	out := new(DependencyReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DriftDetection) DeepCopyInto(out *DriftDetection) {
+	*out = *in
+	if in.Ignore != nil {
+		in, out := &in.Ignore, &out.Ignore
+		*out = make([]IgnoreRule, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DriftDetection.
+func (in *DriftDetection) DeepCopy() *DriftDetection {
+	if in == nil {
+		return nil
+	}
+	out := new(DriftDetection)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Filter) DeepCopyInto(out *Filter) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Filter.
+func (in *Filter) DeepCopy() *Filter {
+	if in == nil {
+		return nil
+	}
+	out := new(Filter)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HelmChartTemplate) DeepCopyInto(out *HelmChartTemplate) {
+	*out = *in
+	if in.ObjectMeta != nil {
+		in, out := &in.ObjectMeta, &out.ObjectMeta
+		*out = new(HelmChartTemplateObjectMeta)
+		(*in).DeepCopyInto(*out)
+	}
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HelmChartTemplate.
+func (in *HelmChartTemplate) DeepCopy() *HelmChartTemplate {
+	if in == nil {
+		return nil
+	}
+	out := new(HelmChartTemplate)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HelmChartTemplateObjectMeta) DeepCopyInto(out *HelmChartTemplateObjectMeta) {
+	*out = *in
+	if in.Labels != nil {
+		in, out := &in.Labels, &out.Labels
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Annotations != nil {
+		in, out := &in.Annotations, &out.Annotations
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HelmChartTemplateObjectMeta.
+func (in *HelmChartTemplateObjectMeta) DeepCopy() *HelmChartTemplateObjectMeta {
+	if in == nil {
+		return nil
+	}
+	out := new(HelmChartTemplateObjectMeta)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HelmChartTemplateSpec) DeepCopyInto(out *HelmChartTemplateSpec) {
+	*out = *in
+	out.SourceRef = in.SourceRef
+	if in.Interval != nil {
+		in, out := &in.Interval, &out.Interval
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.ValuesFiles != nil {
+		in, out := &in.ValuesFiles, &out.ValuesFiles
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Verify != nil {
+		in, out := &in.Verify, &out.Verify
+		*out = new(HelmChartTemplateVerification)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HelmChartTemplateSpec.
+func (in *HelmChartTemplateSpec) DeepCopy() *HelmChartTemplateSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(HelmChartTemplateSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HelmChartTemplateVerification) DeepCopyInto(out *HelmChartTemplateVerification) {
+	*out = *in
+	if in.SecretRef != nil {
+		in, out := &in.SecretRef, &out.SecretRef
+		*out = new(meta.LocalObjectReference)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HelmChartTemplateVerification.
+func (in *HelmChartTemplateVerification) DeepCopy() *HelmChartTemplateVerification {
+	if in == nil {
+		return nil
+	}
+	out := new(HelmChartTemplateVerification)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HelmRelease) DeepCopyInto(out *HelmRelease) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HelmRelease.
+func (in *HelmRelease) DeepCopy() *HelmRelease {
+	if in == nil {
+		return nil
+	}
+	out := new(HelmRelease)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *HelmRelease) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HelmReleaseList) DeepCopyInto(out *HelmReleaseList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]HelmRelease, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HelmReleaseList.
+func (in *HelmReleaseList) DeepCopy() *HelmReleaseList {
+	if in == nil {
+		return nil
+	}
+	out := new(HelmReleaseList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *HelmReleaseList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HelmReleaseSpec) DeepCopyInto(out *HelmReleaseSpec) {
+	*out = *in
+	if in.Chart != nil {
+		in, out := &in.Chart, &out.Chart
+		*out = new(HelmChartTemplate)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ChartRef != nil {
+		in, out := &in.ChartRef, &out.ChartRef
+		*out = new(CrossNamespaceSourceReference)
+		**out = **in
+	}
+	out.Interval = in.Interval
+	if in.KubeConfig != nil {
+		in, out := &in.KubeConfig, &out.KubeConfig
+		*out = new(meta.KubeConfigReference)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.DependsOn != nil {
+		in, out := &in.DependsOn, &out.DependsOn
+		*out = make([]DependencyReference, len(*in))
+		copy(*out, *in)
+	}
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.MaxHistory != nil {
+		in, out := &in.MaxHistory, &out.MaxHistory
+		*out = new(int)
+		**out = **in
+	}
+	if in.PersistentClient != nil {
+		in, out := &in.PersistentClient, &out.PersistentClient
+		*out = new(bool)
+		**out = **in
+	}
+	if in.DriftDetection != nil {
+		in, out := &in.DriftDetection, &out.DriftDetection
+		*out = new(DriftDetection)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Install != nil {
+		in, out := &in.Install, &out.Install
+		*out = new(Install)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Upgrade != nil {
+		in, out := &in.Upgrade, &out.Upgrade
+		*out = new(Upgrade)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Test != nil {
+		in, out := &in.Test, &out.Test
+		*out = new(Test)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Rollback != nil {
+		in, out := &in.Rollback, &out.Rollback
+		*out = new(Rollback)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Uninstall != nil {
+		in, out := &in.Uninstall, &out.Uninstall
+		*out = new(Uninstall)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ValuesFrom != nil {
+		in, out := &in.ValuesFrom, &out.ValuesFrom
+		*out = make([]meta.ValuesReference, len(*in))
+		copy(*out, *in)
+	}
+	if in.Values != nil {
+		in, out := &in.Values, &out.Values
+		*out = new(apiextensionsv1.JSON)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.CommonMetadata != nil {
+		in, out := &in.CommonMetadata, &out.CommonMetadata
+		*out = new(CommonMetadata)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.PostRenderers != nil {
+		in, out := &in.PostRenderers, &out.PostRenderers
+		*out = make([]PostRenderer, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HelmReleaseSpec.
+func (in *HelmReleaseSpec) DeepCopy() *HelmReleaseSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(HelmReleaseSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HelmReleaseStatus) DeepCopyInto(out *HelmReleaseStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]v1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.History != nil {
+		in, out := &in.History, &out.History
+		*out = make(Snapshots, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(Snapshot)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.LastAttemptedReleaseActionDuration != nil {
+		in, out := &in.LastAttemptedReleaseActionDuration, &out.LastAttemptedReleaseActionDuration
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	out.ReconcileRequestStatus = in.ReconcileRequestStatus
+	out.ForceRequestStatus = in.ForceRequestStatus
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HelmReleaseStatus.
+func (in *HelmReleaseStatus) DeepCopy() *HelmReleaseStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(HelmReleaseStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *IgnoreRule) DeepCopyInto(out *IgnoreRule) {
+	*out = *in
+	if in.Paths != nil {
+		in, out := &in.Paths, &out.Paths
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Target != nil {
+		in, out := &in.Target, &out.Target
+		*out = new(kustomize.Selector)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IgnoreRule.
+func (in *IgnoreRule) DeepCopy() *IgnoreRule {
+	if in == nil {
+		return nil
+	}
+	out := new(IgnoreRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Install) DeepCopyInto(out *Install) {
+	*out = *in
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.Remediation != nil {
+		in, out := &in.Remediation, &out.Remediation
+		*out = new(InstallRemediation)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Install.
+func (in *Install) DeepCopy() *Install {
+	if in == nil {
+		return nil
+	}
+	out := new(Install)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *InstallRemediation) DeepCopyInto(out *InstallRemediation) {
+	*out = *in
+	if in.IgnoreTestFailures != nil {
+		in, out := &in.IgnoreTestFailures, &out.IgnoreTestFailures
+		*out = new(bool)
+		**out = **in
+	}
+	if in.RemediateLastFailure != nil {
+		in, out := &in.RemediateLastFailure, &out.RemediateLastFailure
+		*out = new(bool)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InstallRemediation.
+func (in *InstallRemediation) DeepCopy() *InstallRemediation {
+	if in == nil {
+		return nil
+	}
+	out := new(InstallRemediation)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Kustomize) DeepCopyInto(out *Kustomize) {
+	*out = *in
+	if in.Patches != nil {
+		in, out := &in.Patches, &out.Patches
+		*out = make([]kustomize.Patch, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Images != nil {
+		in, out := &in.Images, &out.Images
+		*out = make([]kustomize.Image, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Kustomize.
+func (in *Kustomize) DeepCopy() *Kustomize {
+	if in == nil {
+		return nil
+	}
+	out := new(Kustomize)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PostRenderer) DeepCopyInto(out *PostRenderer) {
+	*out = *in
+	if in.Kustomize != nil {
+		in, out := &in.Kustomize, &out.Kustomize
+		*out = new(Kustomize)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PostRenderer.
+func (in *PostRenderer) DeepCopy() *PostRenderer {
+	if in == nil {
+		return nil
+	}
+	out := new(PostRenderer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Rollback) DeepCopyInto(out *Rollback) {
+	*out = *in
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Rollback.
+func (in *Rollback) DeepCopy() *Rollback {
+	if in == nil {
+		return nil
+	}
+	out := new(Rollback)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Snapshot) DeepCopyInto(out *Snapshot) {
+	*out = *in
+	in.FirstDeployed.DeepCopyInto(&out.FirstDeployed)
+	in.LastDeployed.DeepCopyInto(&out.LastDeployed)
+	in.Deleted.DeepCopyInto(&out.Deleted)
+	if in.TestHooks != nil {
+		in, out := &in.TestHooks, &out.TestHooks
+		*out = new(map[string]*TestHookStatus)
+		if **in != nil {
+			in, out := *in, *out
+			*out = make(map[string]*TestHookStatus, len(*in))
+			for key, val := range *in {
+				var outVal *TestHookStatus
+				if val == nil {
+					(*out)[key] = nil
+				} else {
+					inVal := (*in)[key]
+					in, out := &inVal, &outVal
+					*out = new(TestHookStatus)
+					(*in).DeepCopyInto(*out)
+				}
+				(*out)[key] = outVal
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Snapshot.
+func (in *Snapshot) DeepCopy() *Snapshot {
+	if in == nil {
+		return nil
+	}
+	out := new(Snapshot)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in Snapshots) DeepCopyInto(out *Snapshots) {
+	{
+		in := &in
+		*out = make(Snapshots, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(Snapshot)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Snapshots.
+func (in Snapshots) DeepCopy() Snapshots {
+	if in == nil {
+		return nil
+	}
+	out := new(Snapshots)
+	in.DeepCopyInto(out)
+	return *out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Test) DeepCopyInto(out *Test) {
+	*out = *in
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.Filters != nil {
+		in, out := &in.Filters, &out.Filters
+		*out = new([]Filter)
+		if **in != nil {
+			in, out := *in, *out
+			*out = make([]Filter, len(*in))
+			copy(*out, *in)
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Test.
+func (in *Test) DeepCopy() *Test {
+	if in == nil {
+		return nil
+	}
+	out := new(Test)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestHookStatus) DeepCopyInto(out *TestHookStatus) {
+	*out = *in
+	in.LastStarted.DeepCopyInto(&out.LastStarted)
+	in.LastCompleted.DeepCopyInto(&out.LastCompleted)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestHookStatus.
+func (in *TestHookStatus) DeepCopy() *TestHookStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(TestHookStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Uninstall) DeepCopyInto(out *Uninstall) {
+	*out = *in
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.DeletionPropagation != nil {
+		in, out := &in.DeletionPropagation, &out.DeletionPropagation
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Uninstall.
+func (in *Uninstall) DeepCopy() *Uninstall {
+	if in == nil {
+		return nil
+	}
+	out := new(Uninstall)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Upgrade) DeepCopyInto(out *Upgrade) {
+	*out = *in
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.Remediation != nil {
+		in, out := &in.Remediation, &out.Remediation
+		*out = new(UpgradeRemediation)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Upgrade.
+func (in *Upgrade) DeepCopy() *Upgrade {
+	if in == nil {
+		return nil
+	}
+	out := new(Upgrade)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *UpgradeRemediation) DeepCopyInto(out *UpgradeRemediation) {
+	*out = *in
+	if in.IgnoreTestFailures != nil {
+		in, out := &in.IgnoreTestFailures, &out.IgnoreTestFailures
+		*out = new(bool)
+		**out = **in
+	}
+	if in.RemediateLastFailure != nil {
+		in, out := &in.RemediateLastFailure, &out.RemediateLastFailure
+		*out = new(bool)
+		**out = **in
+	}
+	if in.Strategy != nil {
+		in, out := &in.Strategy, &out.Strategy
+		*out = new(RemediationStrategy)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UpgradeRemediation.
+func (in *UpgradeRemediation) DeepCopy() *UpgradeRemediation {
+	if in == nil {
+		return nil
+	}
+	out := new(UpgradeRemediation)
+	in.DeepCopyInto(out)
+	return out
+}

api/v2beta1/doc.go

@@ -15,6 +15,9 @@ limitations under the License.
 */
 
 // Package v2beta1 contains API Schema definitions for the helm v2beta1 API group
+//
+// Deprecated: v2beta1 is no longer supported, use v2 instead.
+//
 // +kubebuilder:object:generate=true
 // +groupName=helm.toolkit.fluxcd.io
 package v2beta1

api/v2beta1/helmrelease_types.go

@@ -28,6 +28,9 @@ import (
 
 	"github.com/fluxcd/pkg/apis/kustomize"
 	"github.com/fluxcd/pkg/apis/meta"
+
+	v2 "github.com/fluxcd/helm-controller/api/v2"
+	"github.com/fluxcd/helm-controller/api/v2beta2"
 )
 
 const HelmReleaseKind = "HelmRelease"
@@ -67,9 +70,19 @@ type HelmReleaseSpec struct {
 	// Chart defines the template of the v1beta2.HelmChart that should be created
 	// for this HelmRelease.
 	// +required
-	Chart HelmChartTemplate `json:"chart"`
+	Chart *HelmChartTemplate `json:"chart,omitempty"`
+
+	// ChartRef holds a reference to a source controller resource containing the
+	// Helm chart artifact.
+	//
+	// Note: this field is provisional to the v2 API, and not actively used
+	// by v2beta1 HelmReleases.
+	// +optional
+	ChartRef *v2.CrossNamespaceSourceReference `json:"chartRef,omitempty"`
 
 	// Interval at which to reconcile the Helm release.
+	// This interval is approximate and may be subject to jitter to ensure
+	// efficient use of resources.
 	// +kubebuilder:validation:Type=string
 	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
 	// +required
@@ -83,7 +96,7 @@ type HelmReleaseSpec struct {
 	// a controller level fallback for when HelmReleaseSpec.ServiceAccountName
 	// is empty.
 	// +optional
-	KubeConfig *KubeConfig `json:"kubeConfig,omitempty"`
+	KubeConfig *meta.KubeConfigReference `json:"kubeConfig,omitempty"`
 
 	// Suspend tells the controller to suspend reconciliation for this HelmRelease,
 	// it does not apply to already started reconciliations. Defaults to false.
@@ -137,6 +150,30 @@ type HelmReleaseSpec struct {
 	// +optional
 	ServiceAccountName string `json:"serviceAccountName,omitempty"`
 
+	// PersistentClient tells the controller to use a persistent Kubernetes
+	// client for this release. When enabled, the client will be reused for the
+	// duration of the reconciliation, instead of being created and destroyed
+	// for each (step of a) Helm action.
+	//
+	// This can improve performance, but may cause issues with some Helm charts
+	// that for example do create Custom Resource Definitions during installation
+	// outside Helm's CRD lifecycle hooks, which are then not observed to be
+	// available by e.g. post-install hooks.
+	//
+	// If not set, it defaults to true.
+	//
+	// +optional
+	PersistentClient *bool `json:"persistentClient,omitempty"`
+
+	// DriftDetection holds the configuration for detecting and handling
+	// differences between the manifest in the Helm storage and the resources
+	// currently existing in the cluster.
+	//
+	// Note: this field is provisional to the v2beta2 API, and not actively used
+	// by v2beta1 HelmReleases.
+	// +optional
+	DriftDetection *v2beta2.DriftDetection `json:"driftDetection,omitempty"`
+
 	// Install holds the configuration for Helm install actions for this HelmRelease.
 	// +optional
 	Install *Install `json:"install,omitempty"`
@@ -215,30 +252,36 @@ func (in HelmReleaseSpec) GetUninstall() Uninstall {
 	return *in.Uninstall
 }
 
-// KubeConfig references a Kubernetes secret that contains a kubeconfig file.
-type KubeConfig struct {
-	// SecretRef holds the name to a secret that contains a key with
-	// the kubeconfig file as the value. If no key is specified the key will
-	// default to 'value'. The secret must be in the same namespace as
-	// the HelmRelease.
-	// It is recommended that the kubeconfig is self-contained, and the secret
-	// is regularly updated if credentials such as a cloud-access-token expire.
-	// Cloud specific `cmd-path` auth helpers will not function without adding
-	// binaries and credentials to the Pod that is responsible for reconciling
-	// the HelmRelease.
-	// +required
-	SecretRef meta.SecretKeyReference `json:"secretRef,omitempty"`
-}
-
 // HelmChartTemplate defines the template from which the controller will
 // generate a v1beta2.HelmChart object in the same namespace as the referenced
 // v1beta2.Source.
 type HelmChartTemplate struct {
+	// ObjectMeta holds the template for metadata like labels and annotations.
+	// +optional
+	ObjectMeta *HelmChartTemplateObjectMeta `json:"metadata,omitempty"`
+
 	// Spec holds the template for the v1beta2.HelmChartSpec for this HelmRelease.
 	// +required
 	Spec HelmChartTemplateSpec `json:"spec"`
 }
 
+// HelmChartTemplateObjectMeta defines the template for the ObjectMeta of a
+// v1beta2.HelmChart.
+type HelmChartTemplateObjectMeta struct {
+	// Map of string keys and values that can be used to organize and categorize
+	// (scope and select) objects.
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
+	// +optional
+	Labels map[string]string `json:"labels,omitempty"`
+
+	// Annotations is an unstructured key value map stored with a resource that may be
+	// set by external tools to store and retrieve arbitrary metadata. They are not
+	// queryable and should be preserved when modifying objects.
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+	// +optional
+	Annotations map[string]string `json:"annotations,omitempty"`
+}
+
 // HelmChartTemplateSpec defines the template from which the controller will
 // generate a v1beta2.HelmChartSpec object.
 type HelmChartTemplateSpec struct {
@@ -807,6 +850,13 @@ type Uninstall struct {
 	// a Helm uninstall is performed.
 	// +optional
 	DisableWait bool `json:"disableWait,omitempty"`
+
+	// DeletionPropagation specifies the deletion propagation policy when
+	// a Helm uninstall is performed.
+	// +kubebuilder:default=background
+	// +kubebuilder:validation:Enum=background;foreground;orphan
+	// +optional
+	DeletionPropagation *string `json:"deletionPropagation,omitempty"`
 }
 
 // GetTimeout returns the configured timeout for the Helm uninstall action, or
@@ -818,12 +868,26 @@ func (in Uninstall) GetTimeout(defaultTimeout metav1.Duration) metav1.Duration {
 	return *in.Timeout
 }
 
+// GetDeletionPropagation returns the configured deletion propagation policy
+// for the Helm uninstall action, or 'background'.
+func (in Uninstall) GetDeletionPropagation() string {
+	if in.DeletionPropagation == nil {
+		return "background"
+	}
+	return *in.DeletionPropagation
+}
+
 // HelmReleaseStatus defines the observed state of a HelmRelease.
 type HelmReleaseStatus struct {
 	// ObservedGeneration is the last observed generation.
 	// +optional
 	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
 
+	// ObservedPostRenderersDigest is the digest for the post-renderers of
+	// the last successful reconciliation attempt.
+	// +optional
+	ObservedPostRenderersDigest string `json:"observedPostRenderersDigest,omitempty"`
+
 	meta.ReconcileRequestStatus `json:",inline"`
 
 	// Conditions holds the conditions for the HelmRelease.
@@ -866,6 +930,62 @@ type HelmReleaseStatus struct {
 	// state. It is reset after a successful reconciliation.
 	// +optional
 	UpgradeFailures int64 `json:"upgradeFailures,omitempty"`
+
+	// StorageNamespace is the namespace of the Helm release storage for the
+	// current release.
+	//
+	// Note: this field is provisional to the v2beta2 API, and not actively used
+	// by v2beta1 HelmReleases.
+	// +optional
+	StorageNamespace string `json:"storageNamespace,omitempty"`
+
+	// History holds the history of Helm releases performed for this HelmRelease
+	// up to the last successfully completed release.
+	//
+	// Note: this field is provisional to the v2beta2 API, and not actively used
+	// by v2beta1 HelmReleases.
+	// +optional
+	History v2.Snapshots `json:"history,omitempty"`
+
+	// LastAttemptedGeneration is the last generation the controller attempted
+	// to reconcile.
+	//
+	// Note: this field is provisional to the v2beta2 API, and not actively used
+	// by v2beta1 HelmReleases.
+	// +optional
+	LastAttemptedGeneration int64 `json:"lastAttemptedGeneration,omitempty"`
+
+	// LastAttemptedConfigDigest is the digest for the config (better known as
+	// "values") of the last reconciliation attempt.
+	//
+	// Note: this field is provisional to the v2beta2 API, and not actively used
+	// by v2beta1 HelmReleases.
+	// +optional
+	LastAttemptedConfigDigest string `json:"lastAttemptedConfigDigest,omitempty"`
+
+	// LastAttemptedReleaseAction is the last release action performed for this
+	// HelmRelease. It is used to determine the active remediation strategy.
+	//
+	// Note: this field is provisional to the v2beta2 API, and not actively used
+	// by v2beta1 HelmReleases.
+	// +optional
+	LastAttemptedReleaseAction string `json:"lastAttemptedReleaseAction,omitempty"`
+
+	// LastHandledForceAt holds the value of the most recent force request
+	// value, so a change of the annotation value can be detected.
+	//
+	// Note: this field is provisional to the v2beta2 API, and not actively used
+	// by v2beta1 HelmReleases.
+	// +optional
+	LastHandledForceAt string `json:"lastHandledForceAt,omitempty"`
+
+	// LastHandledResetAt holds the value of the most recent reset request
+	// value, so a change of the annotation value can be detected.
+	//
+	// Note: this field is provisional to the v2beta2 API, and not actively used
+	// by v2beta1 HelmReleases.
+	// +optional
+	LastHandledResetAt string `json:"lastHandledResetAt,omitempty"`
 }
 
 // GetHelmChart returns the namespace and name of the HelmChart.
@@ -924,6 +1044,8 @@ func HelmReleaseReady(hr HelmRelease) HelmRelease {
 
 // HelmReleaseAttempted registers an attempt of the given HelmRelease with the given state.
 // and returns the modified HelmRelease and a boolean indicating a state change.
+//
+// Deprecated: in favor of HelmReleaseChanged and HelmReleaseRecordAttempt.
 func HelmReleaseAttempted(hr HelmRelease, revision string, releaseRevision int, valuesChecksum string) (HelmRelease, bool) {
 	changed := hr.Status.LastAttemptedRevision != revision ||
 		hr.Status.LastReleaseRevision != releaseRevision ||
@@ -935,6 +1057,31 @@ func HelmReleaseAttempted(hr HelmRelease, revision string, releaseRevision int,
 	return hr, changed
 }
 
+// HelmReleaseChanged returns if the HelmRelease has changed compared to the
+// provided values.
+func HelmReleaseChanged(hr HelmRelease, revision string, releaseRevision int, valuesChecksums ...string) bool {
+	return hr.Status.LastAttemptedRevision != revision ||
+		hr.Status.LastReleaseRevision != releaseRevision ||
+		!inStringSlice(hr.Status.LastAttemptedValuesChecksum, valuesChecksums)
+}
+
+// HelmReleaseRecordAttempt returns an attempt of the given HelmRelease with the
+// given state in the Status of the provided object.
+func HelmReleaseRecordAttempt(hr *HelmRelease, revision string, releaseRevision int, valuesChecksum string) {
+	hr.Status.LastAttemptedRevision = revision
+	hr.Status.LastReleaseRevision = releaseRevision
+	hr.Status.LastAttemptedValuesChecksum = valuesChecksum
+}
+
+func inStringSlice(str string, s []string) bool {
+	for _, v := range s {
+		if str == v {
+			return true
+		}
+	}
+	return false
+}
+
 func resetFailureCounts(hr *HelmRelease) {
 	hr.Status.Failures = 0
 	hr.Status.InstallFailures = 0
@@ -948,13 +1095,9 @@ const (
 )
 
 // +genclient
-// +genclient:Namespaced
 // +kubebuilder:object:root=true
 // +kubebuilder:resource:shortName=hr
-// +kubebuilder:subresource:status
-// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description=""
-// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].status",description=""
-// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].message",description=""
+// +kubebuilder:skipversion
 
 // HelmRelease is the Schema for the helmreleases API
 type HelmRelease struct {
@@ -1033,6 +1176,15 @@ func (in HelmRelease) GetMaxHistory() int {
 	return *in.Spec.MaxHistory
 }
 
+// UsePersistentClient returns the configured PersistentClient, or the default
+// of true.
+func (in HelmRelease) UsePersistentClient() bool {
+	if in.Spec.PersistentClient == nil {
+		return true
+	}
+	return *in.Spec.PersistentClient
+}
+
 // GetDependsOn returns the list of dependencies across-namespaces.
 func (in HelmRelease) GetDependsOn() []meta.NamespacedObjectReference {
 	return in.Spec.DependsOn
@@ -1049,6 +1201,7 @@ func (in *HelmRelease) SetConditions(conditions []metav1.Condition) {
 }
 
 // GetStatusConditions returns a pointer to the Status.Conditions slice.
+//
 // Deprecated: use GetConditions instead.
 func (in *HelmRelease) GetStatusConditions() *[]metav1.Condition {
 	return &in.Status.Conditions

api/v2beta1/zz_generated.deepcopy.go

@@ -1,8 +1,7 @@
 //go:build !ignore_autogenerated
-// +build !ignore_autogenerated
 
 /*
-Copyright 2021 The Flux authors
+Copyright 2024 The Flux authors
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -22,6 +21,8 @@ limitations under the License.
 package v2beta1
 
 import (
+	"github.com/fluxcd/helm-controller/api/v2"
+	"github.com/fluxcd/helm-controller/api/v2beta2"
 	"github.com/fluxcd/pkg/apis/kustomize"
 	"github.com/fluxcd/pkg/apis/meta"
 	"k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
@@ -47,6 +48,11 @@ func (in *CrossNamespaceObjectReference) DeepCopy() *CrossNamespaceObjectReferen
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *HelmChartTemplate) DeepCopyInto(out *HelmChartTemplate) {
 	*out = *in
+	if in.ObjectMeta != nil {
+		in, out := &in.ObjectMeta, &out.ObjectMeta
+		*out = new(HelmChartTemplateObjectMeta)
+		(*in).DeepCopyInto(*out)
+	}
 	in.Spec.DeepCopyInto(&out.Spec)
 }
 
@@ -60,6 +66,35 @@ func (in *HelmChartTemplate) DeepCopy() *HelmChartTemplate {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HelmChartTemplateObjectMeta) DeepCopyInto(out *HelmChartTemplateObjectMeta) {
+	*out = *in
+	if in.Labels != nil {
+		in, out := &in.Labels, &out.Labels
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Annotations != nil {
+		in, out := &in.Annotations, &out.Annotations
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HelmChartTemplateObjectMeta.
+func (in *HelmChartTemplateObjectMeta) DeepCopy() *HelmChartTemplateObjectMeta {
+	if in == nil {
+		return nil
+	}
+	out := new(HelmChartTemplateObjectMeta)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *HelmChartTemplateSpec) DeepCopyInto(out *HelmChartTemplateSpec) {
 	*out = *in
@@ -173,12 +208,21 @@ func (in *HelmReleaseList) DeepCopyObject() runtime.Object {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *HelmReleaseSpec) DeepCopyInto(out *HelmReleaseSpec) {
 	*out = *in
-	in.Chart.DeepCopyInto(&out.Chart)
+	if in.Chart != nil {
+		in, out := &in.Chart, &out.Chart
+		*out = new(HelmChartTemplate)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ChartRef != nil {
+		in, out := &in.ChartRef, &out.ChartRef
+		*out = new(v2.CrossNamespaceSourceReference)
+		**out = **in
+	}
 	out.Interval = in.Interval
 	if in.KubeConfig != nil {
 		in, out := &in.KubeConfig, &out.KubeConfig
-		*out = new(KubeConfig)
-		**out = **in
+		*out = new(meta.KubeConfigReference)
+		(*in).DeepCopyInto(*out)
 	}
 	if in.DependsOn != nil {
 		in, out := &in.DependsOn, &out.DependsOn
@@ -195,6 +239,16 @@ func (in *HelmReleaseSpec) DeepCopyInto(out *HelmReleaseSpec) {
 		*out = new(int)
 		**out = **in
 	}
+	if in.PersistentClient != nil {
+		in, out := &in.PersistentClient, &out.PersistentClient
+		*out = new(bool)
+		**out = **in
+	}
+	if in.DriftDetection != nil {
+		in, out := &in.DriftDetection, &out.DriftDetection
+		*out = new(v2beta2.DriftDetection)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.Install != nil {
 		in, out := &in.Install, &out.Install
 		*out = new(Install)
@@ -260,6 +314,17 @@ func (in *HelmReleaseStatus) DeepCopyInto(out *HelmReleaseStatus) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	if in.History != nil {
+		in, out := &in.History, &out.History
+		*out = make(v2.Snapshots, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(v2.Snapshot)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HelmReleaseStatus.
@@ -322,29 +387,15 @@ func (in *InstallRemediation) DeepCopy() *InstallRemediation {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *KubeConfig) DeepCopyInto(out *KubeConfig) {
-	*out = *in
-	out.SecretRef = in.SecretRef
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubeConfig.
-func (in *KubeConfig) DeepCopy() *KubeConfig {
-	if in == nil {
-		return nil
-	}
-	out := new(KubeConfig)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Kustomize) DeepCopyInto(out *Kustomize) {
 	*out = *in
 	if in.Patches != nil {
 		in, out := &in.Patches, &out.Patches
 		*out = make([]kustomize.Patch, len(*in))
-		copy(*out, *in)
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
 	}
 	if in.PatchesStrategicMerge != nil {
 		in, out := &in.PatchesStrategicMerge, &out.PatchesStrategicMerge
@@ -445,6 +496,11 @@ func (in *Uninstall) DeepCopyInto(out *Uninstall) {
 		*out = new(metav1.Duration)
 		**out = **in
 	}
+	if in.DeletionPropagation != nil {
+		in, out := &in.DeletionPropagation, &out.DeletionPropagation
+		*out = new(string)
+		**out = **in
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Uninstall.

api/v2beta2/annotations.go

@@ -0,0 +1,84 @@
+/*
+Copyright 2023 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v2beta2
+
+import "github.com/fluxcd/pkg/apis/meta"
+
+const (
+	// ForceRequestAnnotation is the annotation used for triggering a one-off forced
+	// Helm release, even when there are no new changes in the HelmRelease.
+	// The value is interpreted as a token, and must equal the value of
+	// meta.ReconcileRequestAnnotation in order to trigger a release.
+	ForceRequestAnnotation string = "reconcile.fluxcd.io/forceAt"
+
+	// ResetRequestAnnotation is the annotation used for resetting the failure counts
+	// of a HelmRelease, so that it can be retried again.
+	// The value is interpreted as a token, and must equal the value of
+	// meta.ReconcileRequestAnnotation in order to reset the failure counts.
+	ResetRequestAnnotation string = "reconcile.fluxcd.io/resetAt"
+)
+
+// ShouldHandleResetRequest returns true if the HelmRelease has a reset request
+// annotation, and the value of the annotation matches the value of the
+// meta.ReconcileRequestAnnotation annotation.
+//
+// To ensure that the reset request is handled only once, the value of
+// HelmReleaseStatus.LastHandledResetAt is updated to match the value of the
+// reset request annotation (even if the reset request is not handled because
+// the value of the meta.ReconcileRequestAnnotation annotation does not match).
+func ShouldHandleResetRequest(obj *HelmRelease) bool {
+	return handleRequest(obj, ResetRequestAnnotation, &obj.Status.LastHandledResetAt)
+}
+
+// ShouldHandleForceRequest returns true if the HelmRelease has a force request
+// annotation, and the value of the annotation matches the value of the
+// meta.ReconcileRequestAnnotation annotation.
+//
+// To ensure that the force request is handled only once, the value of
+// HelmReleaseStatus.LastHandledForceAt is updated to match the value of the
+// force request annotation (even if the force request is not handled because
+// the value of the meta.ReconcileRequestAnnotation annotation does not match).
+func ShouldHandleForceRequest(obj *HelmRelease) bool {
+	return handleRequest(obj, ForceRequestAnnotation, &obj.Status.LastHandledForceAt)
+}
+
+// handleRequest returns true if the HelmRelease has a request annotation, and
+// the value of the annotation matches the value of the meta.ReconcileRequestAnnotation
+// annotation.
+//
+// The lastHandled argument is used to ensure that the request is handled only
+// once, and is updated to match the value of the request annotation (even if
+// the request is not handled because the value of the meta.ReconcileRequestAnnotation
+// annotation does not match).
+func handleRequest(obj *HelmRelease, annotation string, lastHandled *string) bool {
+	requestAt, requestOk := obj.GetAnnotations()[annotation]
+	reconcileAt, reconcileOk := meta.ReconcileAnnotationValue(obj.GetAnnotations())
+
+	var lastHandledRequest string
+	if requestOk {
+		lastHandledRequest = *lastHandled
+		*lastHandled = requestAt
+	}
+
+	if requestOk && reconcileOk && requestAt == reconcileAt {
+		lastHandledReconcile := obj.Status.GetLastHandledReconcileRequest()
+		if lastHandledReconcile != reconcileAt && lastHandledRequest != requestAt {
+			return true
+		}
+	}
+	return false
+}

api/v2beta2/annotations_test.go

@@ -0,0 +1,165 @@
+/*
+Copyright 2023 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v2beta2
+
+import (
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/fluxcd/pkg/apis/meta"
+)
+
+func TestShouldHandleResetRequest(t *testing.T) {
+	t.Run("should handle reset request", func(t *testing.T) {
+		obj := &HelmRelease{
+			ObjectMeta: metav1.ObjectMeta{
+				Annotations: map[string]string{
+					meta.ReconcileRequestAnnotation: "b",
+					ResetRequestAnnotation:          "b",
+				},
+			},
+			Status: HelmReleaseStatus{
+				LastHandledResetAt: "a",
+				ReconcileRequestStatus: meta.ReconcileRequestStatus{
+					LastHandledReconcileAt: "a",
+				},
+			},
+		}
+
+		if !ShouldHandleResetRequest(obj) {
+			t.Error("ShouldHandleResetRequest() = false")
+		}
+
+		if obj.Status.LastHandledResetAt != "b" {
+			t.Error("ShouldHandleResetRequest did not update LastHandledResetAt")
+		}
+	})
+}
+
+func TestShouldHandleForceRequest(t *testing.T) {
+	t.Run("should handle force request", func(t *testing.T) {
+		obj := &HelmRelease{
+			ObjectMeta: metav1.ObjectMeta{
+				Annotations: map[string]string{
+					meta.ReconcileRequestAnnotation: "b",
+					ForceRequestAnnotation:          "b",
+				},
+			},
+			Status: HelmReleaseStatus{
+				LastHandledForceAt: "a",
+				ReconcileRequestStatus: meta.ReconcileRequestStatus{
+					LastHandledReconcileAt: "a",
+				},
+			},
+		}
+
+		if !ShouldHandleForceRequest(obj) {
+			t.Error("ShouldHandleForceRequest() = false")
+		}
+
+		if obj.Status.LastHandledForceAt != "b" {
+			t.Error("ShouldHandleForceRequest did not update LastHandledForceAt")
+		}
+	})
+}
+
+func Test_handleRequest(t *testing.T) {
+	const requestAnnotation = "requestAnnotation"
+
+	tests := []struct {
+		name                     string
+		annotations              map[string]string
+		lastHandledReconcile     string
+		lastHandledRequest       string
+		want                     bool
+		expectLastHandledRequest string
+	}{
+		{
+			name: "valid request and reconcile annotations",
+			annotations: map[string]string{
+				meta.ReconcileRequestAnnotation: "b",
+				requestAnnotation:               "b",
+			},
+			want:                     true,
+			expectLastHandledRequest: "b",
+		},
+		{
+			name: "mismatched annotations",
+			annotations: map[string]string{
+				meta.ReconcileRequestAnnotation: "b",
+				requestAnnotation:               "c",
+			},
+			want:                     false,
+			expectLastHandledRequest: "c",
+		},
+		{
+			name: "reconcile matches previous request",
+			annotations: map[string]string{
+				meta.ReconcileRequestAnnotation: "b",
+				requestAnnotation:               "b",
+			},
+			lastHandledReconcile:     "a",
+			lastHandledRequest:       "b",
+			want:                     false,
+			expectLastHandledRequest: "b",
+		},
+		{
+			name: "request matches previous reconcile",
+			annotations: map[string]string{
+				meta.ReconcileRequestAnnotation: "b",
+				requestAnnotation:               "b",
+			},
+			lastHandledReconcile:     "b",
+			lastHandledRequest:       "a",
+			want:                     false,
+			expectLastHandledRequest: "b",
+		},
+		{
+			name:                     "missing annotations",
+			annotations:              map[string]string{},
+			lastHandledRequest:       "a",
+			want:                     false,
+			expectLastHandledRequest: "a",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			obj := &HelmRelease{
+				ObjectMeta: metav1.ObjectMeta{
+					Annotations: tt.annotations,
+				},
+				Status: HelmReleaseStatus{
+					ReconcileRequestStatus: meta.ReconcileRequestStatus{
+						LastHandledReconcileAt: tt.lastHandledReconcile,
+					},
+				},
+			}
+
+			lastHandled := tt.lastHandledRequest
+			result := handleRequest(obj, requestAnnotation, &lastHandled)
+
+			if result != tt.want {
+				t.Errorf("handleRequest() = %v, want %v", result, tt.want)
+			}
+			if lastHandled != tt.expectLastHandledRequest {
+				t.Errorf("lastHandledRequest = %v, want %v", lastHandled, tt.expectLastHandledRequest)
+			}
+		})
+	}
+}

api/v2beta2/condition_types.go

@@ -0,0 +1,98 @@
+/*
+Copyright 2022 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v2beta2
+
+const (
+	// ReleasedCondition represents the status of the last release attempt
+	// (install/upgrade/test) against the latest desired state.
+	ReleasedCondition string = "Released"
+
+	// TestSuccessCondition represents the status of the last test attempt against
+	// the latest desired state.
+	TestSuccessCondition string = "TestSuccess"
+
+	// RemediatedCondition represents the status of the last remediation attempt
+	// (uninstall/rollback) due to a failure of the last release attempt against the
+	// latest desired state.
+	RemediatedCondition string = "Remediated"
+)
+
+const (
+	// InstallSucceededReason represents the fact that the Helm install for the
+	// HelmRelease succeeded.
+	InstallSucceededReason string = "InstallSucceeded"
+
+	// InstallFailedReason represents the fact that the Helm install for the
+	// HelmRelease failed.
+	InstallFailedReason string = "InstallFailed"
+
+	// UpgradeSucceededReason represents the fact that the Helm upgrade for the
+	// HelmRelease succeeded.
+	UpgradeSucceededReason string = "UpgradeSucceeded"
+
+	// UpgradeFailedReason represents the fact that the Helm upgrade for the
+	// HelmRelease failed.
+	UpgradeFailedReason string = "UpgradeFailed"
+
+	// TestSucceededReason represents the fact that the Helm tests for the
+	// HelmRelease succeeded.
+	TestSucceededReason string = "TestSucceeded"
+
+	// TestFailedReason represents the fact that the Helm tests for the HelmRelease
+	// failed.
+	TestFailedReason string = "TestFailed"
+
+	// RollbackSucceededReason represents the fact that the Helm rollback for the
+	// HelmRelease succeeded.
+	RollbackSucceededReason string = "RollbackSucceeded"
+
+	// RollbackFailedReason represents the fact that the Helm test for the
+	// HelmRelease failed.
+	RollbackFailedReason string = "RollbackFailed"
+
+	// UninstallSucceededReason represents the fact that the Helm uninstall for the
+	// HelmRelease succeeded.
+	UninstallSucceededReason string = "UninstallSucceeded"
+
+	// UninstallFailedReason represents the fact that the Helm uninstall for the
+	// HelmRelease failed.
+	UninstallFailedReason string = "UninstallFailed"
+
+	// ArtifactFailedReason represents the fact that the artifact download for the
+	// HelmRelease failed.
+	ArtifactFailedReason string = "ArtifactFailed"
+
+	// InitFailedReason represents the fact that the initialization of the Helm
+	// configuration failed.
+	InitFailedReason string = "InitFailed"
+
+	// GetLastReleaseFailedReason represents the fact that observing the last
+	// release failed.
+	GetLastReleaseFailedReason string = "GetLastReleaseFailed"
+
+	// DependencyNotReadyReason represents the fact that
+	// one of the dependencies is not ready.
+	DependencyNotReadyReason string = "DependencyNotReady"
+
+	// ReconciliationSucceededReason represents the fact that
+	// the reconciliation succeeded.
+	ReconciliationSucceededReason string = "ReconciliationSucceeded"
+
+	// ReconciliationFailedReason represents the fact that
+	// the reconciliation failed.
+	ReconciliationFailedReason string = "ReconciliationFailed"
+)

api/v2beta2/doc.go

@@ -0,0 +1,20 @@
+/*
+Copyright 2022 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package v2beta2 contains API Schema definitions for the helm v2beta2 API group
+// +kubebuilder:object:generate=true
+// +groupName=helm.toolkit.fluxcd.io
+package v2beta2

api/v2beta2/groupversion_info.go

@@ -0,0 +1,33 @@
+/*
+Copyright 2022 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v2beta2
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/scheme"
+)
+
+var (
+	// GroupVersion is group version used to register these objects
+	GroupVersion = schema.GroupVersion{Group: "helm.toolkit.fluxcd.io", Version: "v2beta2"}
+
+	// SchemeBuilder is used to add go types to the GroupVersionKind scheme
+	SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
+
+	// AddToScheme adds the types in this group-version to the given scheme.
+	AddToScheme = SchemeBuilder.AddToScheme
+)

api/v2beta2/reference_types.go

@@ -0,0 +1,115 @@
+/*
+Copyright 2022 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v2beta2
+
+// CrossNamespaceObjectReference contains enough information to let you locate
+// the typed referenced object at cluster level.
+type CrossNamespaceObjectReference struct {
+	// APIVersion of the referent.
+	// +optional
+	APIVersion string `json:"apiVersion,omitempty"`
+
+	// Kind of the referent.
+	// +kubebuilder:validation:Enum=HelmRepository;GitRepository;Bucket
+	// +required
+	Kind string `json:"kind,omitempty"`
+
+	// Name of the referent.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	// +required
+	Name string `json:"name"`
+
+	// Namespace of the referent.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=63
+	// +kubebuilder:validation:Optional
+	// +optional
+	Namespace string `json:"namespace,omitempty"`
+}
+
+// CrossNamespaceSourceReference contains enough information to let you locate
+// the typed referenced object at cluster level.
+type CrossNamespaceSourceReference struct {
+	// APIVersion of the referent.
+	// +optional
+	APIVersion string `json:"apiVersion,omitempty"`
+
+	// Kind of the referent.
+	// +kubebuilder:validation:Enum=OCIRepository;HelmChart
+	// +required
+	Kind string `json:"kind"`
+
+	// Name of the referent.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	// +required
+	Name string `json:"name"`
+
+	// Namespace of the referent, defaults to the namespace of the Kubernetes
+	// resource object that contains the reference.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=63
+	// +kubebuilder:validation:Optional
+	// +optional
+	Namespace string `json:"namespace,omitempty"`
+}
+
+// ValuesReference contains a reference to a resource containing Helm values,
+// and optionally the key they can be found at.
+type ValuesReference struct {
+	// Kind of the values referent, valid values are ('Secret', 'ConfigMap').
+	// +kubebuilder:validation:Enum=Secret;ConfigMap
+	// +required
+	Kind string `json:"kind"`
+
+	// Name of the values referent. Should reside in the same namespace as the
+	// referring resource.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	// +required
+	Name string `json:"name"`
+
+	// ValuesKey is the data key where the values.yaml or a specific value can be
+	// found at. Defaults to 'values.yaml'.
+	// +kubebuilder:validation:MaxLength=253
+	// +kubebuilder:validation:Pattern=`^[\-._a-zA-Z0-9]+$`
+	// +optional
+	ValuesKey string `json:"valuesKey,omitempty"`
+
+	// TargetPath is the YAML dot notation path the value should be merged at. When
+	// set, the ValuesKey is expected to be a single flat value. Defaults to 'None',
+	// which results in the values getting merged at the root.
+	// +kubebuilder:validation:MaxLength=250
+	// +kubebuilder:validation:Pattern=`^([a-zA-Z0-9_\-.\\\/]|\[[0-9]{1,5}\])+$`
+	// +optional
+	TargetPath string `json:"targetPath,omitempty"`
+
+	// Optional marks this ValuesReference as optional. When set, a not found error
+	// for the values reference is ignored, but any ValuesKey, TargetPath or
+	// transient error will still result in a reconciliation failure.
+	// +optional
+	Optional bool `json:"optional,omitempty"`
+}
+
+// GetValuesKey returns the defined ValuesKey, or the default ('values.yaml').
+func (in ValuesReference) GetValuesKey() string {
+	if in.ValuesKey == "" {
+		return "values.yaml"
+	}
+	return in.ValuesKey
+}

api/v2beta2/snapshot_types.go

@@ -0,0 +1,236 @@
+/*
+Copyright 2023 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v2beta2
+
+import (
+	"fmt"
+	"sort"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+const (
+	// snapshotStatusDeployed indicates that the release the snapshot was taken
+	// from is currently deployed.
+	snapshotStatusDeployed = "deployed"
+	// snapshotStatusSuperseded indicates that the release the snapshot was taken
+	// from has been superseded by a newer release.
+	snapshotStatusSuperseded = "superseded"
+
+	// snapshotTestPhaseFailed indicates that the test of the release the snapshot
+	// was taken from has failed.
+	snapshotTestPhaseFailed = "Failed"
+)
+
+// Snapshots is a list of Snapshot objects.
+type Snapshots []*Snapshot
+
+// Len returns the number of Snapshots.
+func (in Snapshots) Len() int {
+	return len(in)
+}
+
+// SortByVersion sorts the Snapshots by version, in descending order.
+func (in Snapshots) SortByVersion() {
+	sort.Slice(in, func(i, j int) bool {
+		return in[i].Version > in[j].Version
+	})
+}
+
+// Latest returns the most recent Snapshot.
+func (in Snapshots) Latest() *Snapshot {
+	if len(in) == 0 {
+		return nil
+	}
+	in.SortByVersion()
+	return in[0]
+}
+
+// Previous returns the most recent Snapshot before the Latest that has a
+// status of "deployed" or "superseded", or nil if there is no such Snapshot.
+// Unless ignoreTests is true, Snapshots with a test in the "Failed" phase are
+// ignored.
+func (in Snapshots) Previous(ignoreTests bool) *Snapshot {
+	if len(in) < 2 {
+		return nil
+	}
+	in.SortByVersion()
+	for i := range in[1:] {
+		s := in[i+1]
+		if s.Status == snapshotStatusDeployed || s.Status == snapshotStatusSuperseded {
+			if ignoreTests || !s.HasTestInPhase(snapshotTestPhaseFailed) {
+				return s
+			}
+		}
+	}
+	return nil
+}
+
+// Truncate removes all Snapshots up to the Previous deployed Snapshot.
+// If there is no previous-deployed Snapshot, the most recent 5 Snapshots are
+// retained.
+func (in *Snapshots) Truncate(ignoreTests bool) {
+	if in.Len() < 2 {
+		return
+	}
+
+	in.SortByVersion()
+	for i := range (*in)[1:] {
+		s := (*in)[i+1]
+		if s.Status == snapshotStatusDeployed || s.Status == snapshotStatusSuperseded {
+			if ignoreTests || !s.HasTestInPhase(snapshotTestPhaseFailed) {
+				*in = (*in)[:i+2]
+				return
+			}
+		}
+	}
+
+	if in.Len() > defaultMaxHistory {
+		// If none of the Snapshots are deployed or superseded, and there
+		// are more than the defaultMaxHistory, truncate to the most recent
+		// Snapshots.
+		*in = (*in)[:defaultMaxHistory]
+	}
+}
+
+// Snapshot captures a point-in-time copy of the status information for a Helm release,
+// as managed by the controller.
+type Snapshot struct {
+	// APIVersion is the API version of the Snapshot.
+	// Provisional: when the calculation method of the Digest field is changed,
+	// this field will be used to distinguish between the old and new methods.
+	// +optional
+	APIVersion string `json:"apiVersion,omitempty"`
+	// Digest is the checksum of the release object in storage.
+	// It has the format of `<algo>:<checksum>`.
+	// +required
+	Digest string `json:"digest"`
+	// Name is the name of the release.
+	// +required
+	Name string `json:"name"`
+	// Namespace is the namespace the release is deployed to.
+	// +required
+	Namespace string `json:"namespace"`
+	// Version is the version of the release object in storage.
+	// +required
+	Version int `json:"version"`
+	// Status is the current state of the release.
+	// +required
+	Status string `json:"status"`
+	// ChartName is the chart name of the release object in storage.
+	// +required
+	ChartName string `json:"chartName"`
+	// ChartVersion is the chart version of the release object in
+	// storage.
+	// +required
+	ChartVersion string `json:"chartVersion"`
+	// ConfigDigest is the checksum of the config (better known as
+	// "values") of the release object in storage.
+	// It has the format of `<algo>:<checksum>`.
+	// +required
+	ConfigDigest string `json:"configDigest"`
+	// FirstDeployed is when the release was first deployed.
+	// +required
+	FirstDeployed metav1.Time `json:"firstDeployed"`
+	// LastDeployed is when the release was last deployed.
+	// +required
+	LastDeployed metav1.Time `json:"lastDeployed"`
+	// Deleted is when the release was deleted.
+	// +optional
+	Deleted metav1.Time `json:"deleted,omitempty"`
+	// TestHooks is the list of test hooks for the release as observed to be
+	// run by the controller.
+	// +optional
+	TestHooks *map[string]*TestHookStatus `json:"testHooks,omitempty"`
+	// OCIDigest is the digest of the OCI artifact associated with the release.
+	// +optional
+	OCIDigest string `json:"ociDigest,omitempty"`
+}
+
+// FullReleaseName returns the full name of the release in the format
+// of '<namespace>/<name>.<version>
+func (in *Snapshot) FullReleaseName() string {
+	if in == nil {
+		return ""
+	}
+	return fmt.Sprintf("%s/%s.v%d", in.Namespace, in.Name, in.Version)
+}
+
+// VersionedChartName returns the full name of the chart in the format of
+// '<name>@<version>'.
+func (in *Snapshot) VersionedChartName() string {
+	if in == nil {
+		return ""
+	}
+	return fmt.Sprintf("%s@%s", in.ChartName, in.ChartVersion)
+}
+
+// HasBeenTested returns true if TestHooks is not nil. This includes an empty
+// map, which indicates the chart has no tests.
+func (in *Snapshot) HasBeenTested() bool {
+	return in != nil && in.TestHooks != nil
+}
+
+// GetTestHooks returns the TestHooks for the release if not nil.
+func (in *Snapshot) GetTestHooks() map[string]*TestHookStatus {
+	if in == nil || in.TestHooks == nil {
+		return nil
+	}
+	return *in.TestHooks
+}
+
+// HasTestInPhase returns true if any of the TestHooks is in the given phase.
+func (in *Snapshot) HasTestInPhase(phase string) bool {
+	if in != nil {
+		for _, h := range in.GetTestHooks() {
+			if h.Phase == phase {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// SetTestHooks sets the TestHooks for the release.
+func (in *Snapshot) SetTestHooks(hooks map[string]*TestHookStatus) {
+	if in == nil || hooks == nil {
+		return
+	}
+	in.TestHooks = &hooks
+}
+
+// Targets returns true if the Snapshot targets the given release data.
+func (in *Snapshot) Targets(name, namespace string, version int) bool {
+	if in != nil {
+		return in.Name == name && in.Namespace == namespace && in.Version == version
+	}
+	return false
+}
+
+// TestHookStatus holds the status information for a test hook as observed
+// to be run by the controller.
+type TestHookStatus struct {
+	// LastStarted is the time the test hook was last started.
+	// +optional
+	LastStarted metav1.Time `json:"lastStarted,omitempty"`
+	// LastCompleted is the time the test hook last completed.
+	// +optional
+	LastCompleted metav1.Time `json:"lastCompleted,omitempty"`
+	// Phase the test hook was observed to be in.
+	// +optional
+	Phase string `json:"phase,omitempty"`
+}

api/v2beta2/snapshot_types_test.go

@@ -0,0 +1,298 @@
+/*
+Copyright 2023 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v2beta2
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestSnapshots_Sort(t *testing.T) {
+	tests := []struct {
+		name string
+		in   Snapshots
+		want Snapshots
+	}{
+		{
+			name: "sorts by descending version",
+			in: Snapshots{
+				{Version: 1},
+				{Version: 3},
+				{Version: 2},
+			},
+			want: Snapshots{
+				{Version: 3},
+				{Version: 2},
+				{Version: 1},
+			},
+		},
+		{
+			name: "already sorted",
+			in: Snapshots{
+				{Version: 3},
+				{Version: 2},
+				{Version: 1},
+			},
+			want: Snapshots{
+				{Version: 3},
+				{Version: 2},
+				{Version: 1},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tt.in.SortByVersion()
+
+			if !reflect.DeepEqual(tt.in, tt.want) {
+				t.Errorf("SortByVersion() got %v, want %v", tt.in, tt.want)
+			}
+		})
+	}
+}
+
+func TestSnapshots_Latest(t *testing.T) {
+	tests := []struct {
+		name string
+		in   Snapshots
+		want *Snapshot
+	}{
+		{
+			name: "returns most recent snapshot",
+			in: Snapshots{
+				{Version: 1},
+				{Version: 3},
+				{Version: 2},
+			},
+			want: &Snapshot{Version: 3},
+		},
+		{
+			name: "returns nil if empty",
+			in:   Snapshots{},
+			want: nil,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := tt.in.Latest(); !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("Latest() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestSnapshots_Previous(t *testing.T) {
+	tests := []struct {
+		name        string
+		in          Snapshots
+		ignoreTests bool
+		want        *Snapshot
+	}{
+		{
+			name: "returns previous snapshot",
+			in: Snapshots{
+				{Version: 2, Status: "deployed"},
+				{Version: 3, Status: "failed"},
+				{Version: 1, Status: "superseded"},
+			},
+			want: &Snapshot{Version: 2, Status: "deployed"},
+		},
+		{
+			name: "includes snapshots with failed tests",
+			in: Snapshots{
+				{Version: 4, Status: "deployed"},
+				{Version: 1, Status: "superseded"},
+				{Version: 2, Status: "superseded"},
+				{Version: 3, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+					"test": {Phase: "Failed"},
+				}},
+			},
+			ignoreTests: true,
+			want: &Snapshot{Version: 3, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+				"test": {Phase: "Failed"},
+			}},
+		},
+		{
+			name: "ignores snapshots with failed tests",
+			in: Snapshots{
+				{Version: 4, Status: "deployed"},
+				{Version: 1, Status: "superseded"},
+				{Version: 2, Status: "superseded"},
+				{Version: 3, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+					"test": {Phase: "Failed"},
+				}},
+			},
+			ignoreTests: false,
+			want:        &Snapshot{Version: 2, Status: "superseded"},
+		},
+		{
+			name: "returns nil without previous snapshot",
+			in: Snapshots{
+				{Version: 1, Status: "deployed"},
+			},
+			want: nil,
+		},
+		{
+			name: "returns nil without snapshot matching criteria",
+			in: Snapshots{
+				{Version: 4, Status: "deployed"},
+				{Version: 3, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+					"test": {Phase: "Failed"},
+				}},
+			},
+			ignoreTests: false,
+			want:        nil,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := tt.in.Previous(tt.ignoreTests); !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("Previous() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestSnapshots_Truncate(t *testing.T) {
+	tests := []struct {
+		name        string
+		in          Snapshots
+		ignoreTests bool
+		want        Snapshots
+	}{
+		{
+			name: "keeps previous snapshot",
+			in: Snapshots{
+				{Version: 1, Status: "superseded"},
+				{Version: 3, Status: "failed"},
+				{Version: 2, Status: "superseded"},
+				{Version: 4, Status: "deployed"},
+			},
+			want: Snapshots{
+				{Version: 4, Status: "deployed"},
+				{Version: 3, Status: "failed"},
+				{Version: 2, Status: "superseded"},
+			},
+		},
+		{
+			name: "ignores snapshots with failed tests",
+			in: Snapshots{
+				{Version: 4, Status: "deployed"},
+				{Version: 3, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+					"upgrade-test-fail-podinfo-fault-test-tiz9x": {Phase: "Failed"},
+					"upgrade-test-fail-podinfo-grpc-test-gddcw":  {},
+				}},
+				{Version: 2, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+					"upgrade-test-fail-podinfo-grpc-test-h0tc2": {
+						Phase: "Succeeded",
+					},
+					"upgrade-test-fail-podinfo-jwt-test-vzusa": {
+						Phase: "Succeeded",
+					},
+					"upgrade-test-fail-podinfo-service-test-b647e": {
+						Phase: "Succeeded",
+					},
+				}},
+			},
+			ignoreTests: false,
+			want: Snapshots{
+				{Version: 4, Status: "deployed"},
+				{Version: 3, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+					"upgrade-test-fail-podinfo-fault-test-tiz9x": {Phase: "Failed"},
+					"upgrade-test-fail-podinfo-grpc-test-gddcw":  {},
+				}},
+				{Version: 2, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+					"upgrade-test-fail-podinfo-grpc-test-h0tc2": {
+						Phase: "Succeeded",
+					},
+					"upgrade-test-fail-podinfo-jwt-test-vzusa": {
+						Phase: "Succeeded",
+					},
+					"upgrade-test-fail-podinfo-service-test-b647e": {
+						Phase: "Succeeded",
+					},
+				}},
+			},
+		},
+		{
+			name: "keeps previous snapshot with failed tests",
+			in: Snapshots{
+				{Version: 4, Status: "deployed"},
+				{Version: 3, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+					"upgrade-test-fail-podinfo-fault-test-tiz9x": {Phase: "Failed"},
+					"upgrade-test-fail-podinfo-grpc-test-gddcw":  {},
+				}},
+				{Version: 2, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+					"upgrade-test-fail-podinfo-grpc-test-h0tc2": {
+						Phase: "Succeeded",
+					},
+					"upgrade-test-fail-podinfo-jwt-test-vzusa": {
+						Phase: "Succeeded",
+					},
+					"upgrade-test-fail-podinfo-service-test-b647e": {
+						Phase: "Succeeded",
+					},
+				}},
+				{Version: 1, Status: "superseded"},
+			},
+			ignoreTests: true,
+			want: Snapshots{
+				{Version: 4, Status: "deployed"},
+				{Version: 3, Status: "superseded", TestHooks: &map[string]*TestHookStatus{
+					"upgrade-test-fail-podinfo-fault-test-tiz9x": {Phase: "Failed"},
+					"upgrade-test-fail-podinfo-grpc-test-gddcw":  {},
+				}},
+			},
+		},
+		{
+			name: "retains most recent snapshots when all have failed",
+			in: Snapshots{
+				{Version: 6, Status: "deployed"},
+				{Version: 5, Status: "failed"},
+				{Version: 4, Status: "failed"},
+				{Version: 3, Status: "failed"},
+				{Version: 2, Status: "failed"},
+				{Version: 1, Status: "failed"},
+			},
+			want: Snapshots{
+				{Version: 6, Status: "deployed"},
+				{Version: 5, Status: "failed"},
+				{Version: 4, Status: "failed"},
+				{Version: 3, Status: "failed"},
+				{Version: 2, Status: "failed"},
+			},
+		},
+		{
+			name: "without previous snapshot",
+			in: Snapshots{
+				{Version: 1, Status: "deployed"},
+			},
+			want: Snapshots{
+				{Version: 1, Status: "deployed"},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tt.in.Truncate(tt.ignoreTests)
+
+			if !reflect.DeepEqual(tt.in, tt.want) {
+				t.Errorf("Truncate() got %v, want %v", tt.in, tt.want)
+			}
+		})
+	}
+}

api/v2beta2/zz_generated.deepcopy.go

@@ -0,0 +1,749 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2024 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package v2beta2
+
+import (
+	"github.com/fluxcd/helm-controller/api/v2"
+	"github.com/fluxcd/pkg/apis/kustomize"
+	"github.com/fluxcd/pkg/apis/meta"
+	"k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CrossNamespaceObjectReference) DeepCopyInto(out *CrossNamespaceObjectReference) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CrossNamespaceObjectReference.
+func (in *CrossNamespaceObjectReference) DeepCopy() *CrossNamespaceObjectReference {
+	if in == nil {
+		return nil
+	}
+	out := new(CrossNamespaceObjectReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CrossNamespaceSourceReference) DeepCopyInto(out *CrossNamespaceSourceReference) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CrossNamespaceSourceReference.
+func (in *CrossNamespaceSourceReference) DeepCopy() *CrossNamespaceSourceReference {
+	if in == nil {
+		return nil
+	}
+	out := new(CrossNamespaceSourceReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DriftDetection) DeepCopyInto(out *DriftDetection) {
+	*out = *in
+	if in.Ignore != nil {
+		in, out := &in.Ignore, &out.Ignore
+		*out = make([]IgnoreRule, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DriftDetection.
+func (in *DriftDetection) DeepCopy() *DriftDetection {
+	if in == nil {
+		return nil
+	}
+	out := new(DriftDetection)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Filter) DeepCopyInto(out *Filter) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Filter.
+func (in *Filter) DeepCopy() *Filter {
+	if in == nil {
+		return nil
+	}
+	out := new(Filter)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HelmChartTemplate) DeepCopyInto(out *HelmChartTemplate) {
+	*out = *in
+	if in.ObjectMeta != nil {
+		in, out := &in.ObjectMeta, &out.ObjectMeta
+		*out = new(HelmChartTemplateObjectMeta)
+		(*in).DeepCopyInto(*out)
+	}
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HelmChartTemplate.
+func (in *HelmChartTemplate) DeepCopy() *HelmChartTemplate {
+	if in == nil {
+		return nil
+	}
+	out := new(HelmChartTemplate)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HelmChartTemplateObjectMeta) DeepCopyInto(out *HelmChartTemplateObjectMeta) {
+	*out = *in
+	if in.Labels != nil {
+		in, out := &in.Labels, &out.Labels
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Annotations != nil {
+		in, out := &in.Annotations, &out.Annotations
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HelmChartTemplateObjectMeta.
+func (in *HelmChartTemplateObjectMeta) DeepCopy() *HelmChartTemplateObjectMeta {
+	if in == nil {
+		return nil
+	}
+	out := new(HelmChartTemplateObjectMeta)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HelmChartTemplateSpec) DeepCopyInto(out *HelmChartTemplateSpec) {
+	*out = *in
+	out.SourceRef = in.SourceRef
+	if in.Interval != nil {
+		in, out := &in.Interval, &out.Interval
+		*out = new(metav1.Duration)
+		**out = **in
+	}
+	if in.ValuesFiles != nil {
+		in, out := &in.ValuesFiles, &out.ValuesFiles
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Verify != nil {
+		in, out := &in.Verify, &out.Verify
+		*out = new(HelmChartTemplateVerification)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HelmChartTemplateSpec.
+func (in *HelmChartTemplateSpec) DeepCopy() *HelmChartTemplateSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(HelmChartTemplateSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HelmChartTemplateVerification) DeepCopyInto(out *HelmChartTemplateVerification) {
+	*out = *in
+	if in.SecretRef != nil {
+		in, out := &in.SecretRef, &out.SecretRef
+		*out = new(meta.LocalObjectReference)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HelmChartTemplateVerification.
+func (in *HelmChartTemplateVerification) DeepCopy() *HelmChartTemplateVerification {
+	if in == nil {
+		return nil
+	}
+	out := new(HelmChartTemplateVerification)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HelmRelease) DeepCopyInto(out *HelmRelease) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HelmRelease.
+func (in *HelmRelease) DeepCopy() *HelmRelease {
+	if in == nil {
+		return nil
+	}
+	out := new(HelmRelease)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *HelmRelease) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HelmReleaseList) DeepCopyInto(out *HelmReleaseList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]HelmRelease, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HelmReleaseList.
+func (in *HelmReleaseList) DeepCopy() *HelmReleaseList {
+	if in == nil {
+		return nil
+	}
+	out := new(HelmReleaseList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *HelmReleaseList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HelmReleaseSpec) DeepCopyInto(out *HelmReleaseSpec) {
+	*out = *in
+	if in.Chart != nil {
+		in, out := &in.Chart, &out.Chart
+		*out = new(HelmChartTemplate)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ChartRef != nil {
+		in, out := &in.ChartRef, &out.ChartRef
+		*out = new(CrossNamespaceSourceReference)
+		**out = **in
+	}
+	out.Interval = in.Interval
+	if in.KubeConfig != nil {
+		in, out := &in.KubeConfig, &out.KubeConfig
+		*out = new(meta.KubeConfigReference)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.DependsOn != nil {
+		in, out := &in.DependsOn, &out.DependsOn
+		*out = make([]meta.NamespacedObjectReference, len(*in))
+		copy(*out, *in)
+	}
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(metav1.Duration)
+		**out = **in
+	}
+	if in.MaxHistory != nil {
+		in, out := &in.MaxHistory, &out.MaxHistory
+		*out = new(int)
+		**out = **in
+	}
+	if in.PersistentClient != nil {
+		in, out := &in.PersistentClient, &out.PersistentClient
+		*out = new(bool)
+		**out = **in
+	}
+	if in.DriftDetection != nil {
+		in, out := &in.DriftDetection, &out.DriftDetection
+		*out = new(DriftDetection)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Install != nil {
+		in, out := &in.Install, &out.Install
+		*out = new(Install)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Upgrade != nil {
+		in, out := &in.Upgrade, &out.Upgrade
+		*out = new(Upgrade)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Test != nil {
+		in, out := &in.Test, &out.Test
+		*out = new(Test)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Rollback != nil {
+		in, out := &in.Rollback, &out.Rollback
+		*out = new(Rollback)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Uninstall != nil {
+		in, out := &in.Uninstall, &out.Uninstall
+		*out = new(Uninstall)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ValuesFrom != nil {
+		in, out := &in.ValuesFrom, &out.ValuesFrom
+		*out = make([]ValuesReference, len(*in))
+		copy(*out, *in)
+	}
+	if in.Values != nil {
+		in, out := &in.Values, &out.Values
+		*out = new(v1.JSON)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.PostRenderers != nil {
+		in, out := &in.PostRenderers, &out.PostRenderers
+		*out = make([]PostRenderer, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HelmReleaseSpec.
+func (in *HelmReleaseSpec) DeepCopy() *HelmReleaseSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(HelmReleaseSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HelmReleaseStatus) DeepCopyInto(out *HelmReleaseStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]metav1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.History != nil {
+		in, out := &in.History, &out.History
+		*out = make(v2.Snapshots, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(v2.Snapshot)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	out.ReconcileRequestStatus = in.ReconcileRequestStatus
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HelmReleaseStatus.
+func (in *HelmReleaseStatus) DeepCopy() *HelmReleaseStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(HelmReleaseStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *IgnoreRule) DeepCopyInto(out *IgnoreRule) {
+	*out = *in
+	if in.Paths != nil {
+		in, out := &in.Paths, &out.Paths
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Target != nil {
+		in, out := &in.Target, &out.Target
+		*out = new(kustomize.Selector)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IgnoreRule.
+func (in *IgnoreRule) DeepCopy() *IgnoreRule {
+	if in == nil {
+		return nil
+	}
+	out := new(IgnoreRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Install) DeepCopyInto(out *Install) {
+	*out = *in
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(metav1.Duration)
+		**out = **in
+	}
+	if in.Remediation != nil {
+		in, out := &in.Remediation, &out.Remediation
+		*out = new(InstallRemediation)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Install.
+func (in *Install) DeepCopy() *Install {
+	if in == nil {
+		return nil
+	}
+	out := new(Install)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *InstallRemediation) DeepCopyInto(out *InstallRemediation) {
+	*out = *in
+	if in.IgnoreTestFailures != nil {
+		in, out := &in.IgnoreTestFailures, &out.IgnoreTestFailures
+		*out = new(bool)
+		**out = **in
+	}
+	if in.RemediateLastFailure != nil {
+		in, out := &in.RemediateLastFailure, &out.RemediateLastFailure
+		*out = new(bool)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InstallRemediation.
+func (in *InstallRemediation) DeepCopy() *InstallRemediation {
+	if in == nil {
+		return nil
+	}
+	out := new(InstallRemediation)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Kustomize) DeepCopyInto(out *Kustomize) {
+	*out = *in
+	if in.Patches != nil {
+		in, out := &in.Patches, &out.Patches
+		*out = make([]kustomize.Patch, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.PatchesStrategicMerge != nil {
+		in, out := &in.PatchesStrategicMerge, &out.PatchesStrategicMerge
+		*out = make([]v1.JSON, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.PatchesJSON6902 != nil {
+		in, out := &in.PatchesJSON6902, &out.PatchesJSON6902
+		*out = make([]kustomize.JSON6902Patch, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Images != nil {
+		in, out := &in.Images, &out.Images
+		*out = make([]kustomize.Image, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Kustomize.
+func (in *Kustomize) DeepCopy() *Kustomize {
+	if in == nil {
+		return nil
+	}
+	out := new(Kustomize)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PostRenderer) DeepCopyInto(out *PostRenderer) {
+	*out = *in
+	if in.Kustomize != nil {
+		in, out := &in.Kustomize, &out.Kustomize
+		*out = new(Kustomize)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PostRenderer.
+func (in *PostRenderer) DeepCopy() *PostRenderer {
+	if in == nil {
+		return nil
+	}
+	out := new(PostRenderer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Rollback) DeepCopyInto(out *Rollback) {
+	*out = *in
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(metav1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Rollback.
+func (in *Rollback) DeepCopy() *Rollback {
+	if in == nil {
+		return nil
+	}
+	out := new(Rollback)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Snapshot) DeepCopyInto(out *Snapshot) {
+	*out = *in
+	in.FirstDeployed.DeepCopyInto(&out.FirstDeployed)
+	in.LastDeployed.DeepCopyInto(&out.LastDeployed)
+	in.Deleted.DeepCopyInto(&out.Deleted)
+	if in.TestHooks != nil {
+		in, out := &in.TestHooks, &out.TestHooks
+		*out = new(map[string]*TestHookStatus)
+		if **in != nil {
+			in, out := *in, *out
+			*out = make(map[string]*TestHookStatus, len(*in))
+			for key, val := range *in {
+				var outVal *TestHookStatus
+				if val == nil {
+					(*out)[key] = nil
+				} else {
+					inVal := (*in)[key]
+					in, out := &inVal, &outVal
+					*out = new(TestHookStatus)
+					(*in).DeepCopyInto(*out)
+				}
+				(*out)[key] = outVal
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Snapshot.
+func (in *Snapshot) DeepCopy() *Snapshot {
+	if in == nil {
+		return nil
+	}
+	out := new(Snapshot)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in Snapshots) DeepCopyInto(out *Snapshots) {
+	{
+		in := &in
+		*out = make(Snapshots, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(Snapshot)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Snapshots.
+func (in Snapshots) DeepCopy() Snapshots {
+	if in == nil {
+		return nil
+	}
+	out := new(Snapshots)
+	in.DeepCopyInto(out)
+	return *out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Test) DeepCopyInto(out *Test) {
+	*out = *in
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(metav1.Duration)
+		**out = **in
+	}
+	if in.Filters != nil {
+		in, out := &in.Filters, &out.Filters
+		*out = new([]Filter)
+		if **in != nil {
+			in, out := *in, *out
+			*out = make([]Filter, len(*in))
+			copy(*out, *in)
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Test.
+func (in *Test) DeepCopy() *Test {
+	if in == nil {
+		return nil
+	}
+	out := new(Test)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestHookStatus) DeepCopyInto(out *TestHookStatus) {
+	*out = *in
+	in.LastStarted.DeepCopyInto(&out.LastStarted)
+	in.LastCompleted.DeepCopyInto(&out.LastCompleted)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestHookStatus.
+func (in *TestHookStatus) DeepCopy() *TestHookStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(TestHookStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Uninstall) DeepCopyInto(out *Uninstall) {
+	*out = *in
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(metav1.Duration)
+		**out = **in
+	}
+	if in.DeletionPropagation != nil {
+		in, out := &in.DeletionPropagation, &out.DeletionPropagation
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Uninstall.
+func (in *Uninstall) DeepCopy() *Uninstall {
+	if in == nil {
+		return nil
+	}
+	out := new(Uninstall)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Upgrade) DeepCopyInto(out *Upgrade) {
+	*out = *in
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(metav1.Duration)
+		**out = **in
+	}
+	if in.Remediation != nil {
+		in, out := &in.Remediation, &out.Remediation
+		*out = new(UpgradeRemediation)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Upgrade.
+func (in *Upgrade) DeepCopy() *Upgrade {
+	if in == nil {
+		return nil
+	}
+	out := new(Upgrade)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *UpgradeRemediation) DeepCopyInto(out *UpgradeRemediation) {
+	*out = *in
+	if in.IgnoreTestFailures != nil {
+		in, out := &in.IgnoreTestFailures, &out.IgnoreTestFailures
+		*out = new(bool)
+		**out = **in
+	}
+	if in.RemediateLastFailure != nil {
+		in, out := &in.RemediateLastFailure, &out.RemediateLastFailure
+		*out = new(bool)
+		**out = **in
+	}
+	if in.Strategy != nil {
+		in, out := &in.Strategy, &out.Strategy
+		*out = new(RemediationStrategy)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UpgradeRemediation.
+func (in *UpgradeRemediation) DeepCopy() *UpgradeRemediation {
+	if in == nil {
+		return nil
+	}
+	out := new(UpgradeRemediation)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ValuesReference) DeepCopyInto(out *ValuesReference) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValuesReference.
+func (in *ValuesReference) DeepCopy() *ValuesReference {
+	if in == nil {
+		return nil
+	}
+	out := new(ValuesReference)
+	in.DeepCopyInto(out)
+	return out
+}

config/default/kustomization.yaml

@@ -2,8 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: helm-system
 resources:
-- https://github.com/fluxcd/source-controller/releases/download/v0.31.0/source-controller.crds.yaml
-- https://github.com/fluxcd/source-controller/releases/download/v0.31.0/source-controller.deployment.yaml
+- https://github.com/fluxcd/source-controller/releases/download/v1.6.0/source-controller.crds.yaml
+- https://github.com/fluxcd/source-controller/releases/download/v1.6.0/source-controller.deployment.yaml
 - ../crd
 - ../rbac
 - ../manager

config/manager/kustomization.yaml

@@ -5,4 +5,4 @@ resources:
 images:
   - name: fluxcd/helm-controller
     newName: fluxcd/helm-controller
-    newTag: v0.26.0
+    newTag: v1.3.0

config/rbac/role.yaml

@@ -2,7 +2,6 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  creationTimestamp: null
   name: manager-role
 rules:
 - apiGroups:
@@ -46,6 +45,7 @@ rules:
   - source.toolkit.fluxcd.io
   resources:
   - helmcharts
+  - ocirepositories
   verbs:
   - get
   - list
@@ -54,5 +54,6 @@ rules:
   - source.toolkit.fluxcd.io
   resources:
   - helmcharts/status
+  - ocirepositories/status
   verbs:
   - get

config/samples/helm_v2_helmrelease_gitrepository.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: podinfo-gitrepository
@@ -10,9 +10,3 @@ spec:
       sourceRef:
         kind: GitRepository
         name: podinfo
-      interval: 1m
-  upgrade:
-    remediation:
-      remediateLastFailure: true
-  test:
-    enable: true

config/samples/helm_v2_helmrelease_helmrepository.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: podinfo-helmrepository
@@ -7,13 +7,8 @@ spec:
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo
-      interval: 1m
-  upgrade:
-    remediation:
-      remediateLastFailure: true
-  test:
-    enable: true
+      interval: 10m

config/samples/helm_v2_helmrelease_ocirepository.yaml

@@ -0,0 +1,13 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: podinfo-ocirepository
+spec:
+  interval: 5m
+  chartRef:
+    kind: OCIRepository
+    name: podinfo
+  test:
+    enable: true
+  values:
+    replicaCount: 2

config/samples/source_v1_gitrepository.yaml

@@ -1,4 +1,4 @@
-apiVersion: source.toolkit.fluxcd.io/v1beta2
+apiVersion: source.toolkit.fluxcd.io/v1
 kind: GitRepository
 metadata:
   name: podinfo

config/samples/source_v1_helmrepository.yaml

@@ -1,4 +1,4 @@
-apiVersion: source.toolkit.fluxcd.io/v1beta2
+apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
   name: podinfo

config/samples/source_v1_ocirepository.yaml

@@ -0,0 +1,9 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: podinfo
+spec:
+  interval: 1m
+  url: oci://ghcr.io/stefanprodan/charts/podinfo
+  ref:
+    semver: 6.x

config/testdata/charts/crds/bootstrap/templates/git-repository.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
+apiVersion: source.toolkit.fluxcd.io/v1
 kind: GitRepository
 metadata:
   name: this
@@ -11,6 +11,6 @@ spec:
     {{- if .Values.branch }}
     branch: "{{ .Values.branch }}"
     {{- end}}
-    {{- if .Values.branch }}
+    {{- if .Values.tag }}
     tag: "{{ .Values.tag }}"
     {{- end}}

config/testdata/crds-upgrade/create-replace/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: crds-upgrade-test

config/testdata/crds-upgrade/create/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: crds-upgrade-test

config/testdata/crds-upgrade/init/helmrelease.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: crds-upgrade-test

config/testdata/delete-ns/test.yaml

@@ -0,0 +1,68 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: delete-ns
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: gotk-reconciler
+  namespace: delete-ns
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: gotk-reconciler
+  namespace: delete-ns
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - '*'
+    verbs:
+      - '*'
+  - apiGroups:
+      - apps
+    resources:
+      - '*'
+    verbs:
+      - '*'
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: gotk-reconciler
+  namespace: delete-ns
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: gotk-reconciler
+subjects:
+  - kind: ServiceAccount
+    name: gotk-reconciler
+    namespace: delete-ns
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: podinfo
+  namespace: delete-ns
+spec:
+  interval: 1m
+  url: https://stefanprodan.github.io/podinfo
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  name: podinfo
+  namespace: delete-ns
+spec:
+  serviceAccountName: gotk-reconciler
+  interval: 5m
+  chart:
+    spec:
+      chart: podinfo
+      version: 6.3.5
+      sourceRef:
+        kind: HelmRepository
+        name: podinfo

config/testdata/dependencies/helmrelease-backend.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: backend
@@ -7,7 +7,7 @@ spec:
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo

config/testdata/dependencies/helmrelease-frontend.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: frontend
@@ -7,7 +7,7 @@ spec:
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo

config/testdata/impersonation/test.yaml

@@ -42,7 +42,7 @@ subjects:
     name: gotk-reconciler
     namespace: impersonation
 ---
-apiVersion: source.toolkit.fluxcd.io/v1beta1
+apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
 metadata:
   name: podinfo
@@ -51,7 +51,7 @@ spec:
   interval: 1m
   url: https://stefanprodan.github.io/podinfo
 ---
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: podinfo
@@ -62,12 +62,12 @@ spec:
   chart:
     spec:
       chart: podinfo
-      version: 5.0.3
+      version: 6.3.5
       sourceRef:
         kind: HelmRepository
         name: podinfo
 ---
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: podinfo-fail
@@ -78,7 +78,7 @@ spec:
   chart:
     spec:
       chart: podinfo
-      version: 5.0.3
+      version: 6.3.5
       sourceRef:
         kind: HelmRepository
         name: podinfo

config/testdata/install-create-target-ns/helmrelease.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: install-create-target-ns
@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo

config/testdata/install-fail-remediate/helmrelease.yaml

@@ -1,20 +1,22 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: install-fail-remediate
 spec:
-  interval: 5m
+  interval: 30s
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo
-      interval: 1m
+      interval: 10m
   install:
     remediation:
       remediateLastFailure: true
+  uninstall:
+    keepHistory: true
   values:
     resources:
       requests:

config/testdata/install-fail-retry/helmrelease.yaml

@@ -1,17 +1,17 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: install-fail-retry
 spec:
-  interval: 5m
+  interval: 30s
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo
-      interval: 1m
+      interval: 10m
   install:
     remediation:
       retries: 1

config/testdata/install-fail/helmrelease.yaml

@@ -1,17 +1,17 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: install-fail
 spec:
-  interval: 5m
+  interval: 30s
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo
-      interval: 1m
+      interval: 10m
   values:
     resources:
       requests:

config/testdata/install-from-hc-source/test.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmChart
+metadata:
+  name: podinfo-hc
+spec:
+  chart: podinfo
+  version: '6.2.1'
+  sourceRef:
+    kind: HelmRepository
+    name: podinfo-oci
+  interval: 30s
+  verify:
+    provider: cosign
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  name: podinfo-from-hc
+spec:
+  chartRef:
+    kind: HelmChart
+    name: podinfo-hc
+  interval: 30s
+  values:
+    resources:
+      requests:
+        cpu: 100m
+        memory: 64Mi

config/testdata/install-from-ocirepo-source/test.yaml

@@ -0,0 +1,25 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: podinfo-ocirepo
+spec:
+  interval: 30s
+  url: oci://ghcr.io/stefanprodan/charts/podinfo
+  ref:
+    tag: 6.6.0
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: podinfo-from-ocirepo
+spec:
+  chartRef:
+    kind: OCIRepository
+    name: podinfo-ocirepo
+  interval: 30s
+  values:
+    resources:
+      requests:
+        cpu: 100m
+        memory: 64Mi

config/testdata/install-test-fail-ignore/helmrelease.yaml

@@ -1,17 +1,17 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: install-test-fail-ignore
 spec:
-  interval: 5m
+  interval: 30s
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo
-      interval: 1m
+      interval: 10m
   test:
     enable: true
     ignoreFailures: true

config/testdata/install-test-fail/helmrelease.yaml

@@ -1,17 +1,17 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: install-test-fail
 spec:
-  interval: 5m
+  interval: 30s
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo
-      interval: 1m
+      interval: 10m
   test:
     enable: true
   values:

config/testdata/podinfo/helmrelease-git.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: podinfo-git

config/testdata/podinfo/helmrelease-oci.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: podinfo-oci

config/testdata/podinfo/helmrelease.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: podinfo
@@ -7,7 +7,7 @@ spec:
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo

config/testdata/post-renderer-kustomize/helmrelease.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: post-renderer-kustomize
@@ -7,7 +7,7 @@ spec:
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <6.9.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo
@@ -16,20 +16,20 @@ spec:
     fullnameOverride: mypodinfo
   postRenderers:
   - kustomize: 
-      patchesStrategicMerge:
-      - kind: Deployment
-        apiVersion: apps/v1
-        metadata:
-          name: mypodinfo
-          labels:
-            xxxx: yyyy
-      patchesJson6902:
+      patches:
+      - patch: |
+          kind: Deployment
+          apiVersion: apps/v1
+          metadata:
+            name: mypodinfo
+            labels:
+              xxxx: yyyy
       - target:
           group: apps
           version: v1
           kind: Deployment
           name: mypodinfo
-        patch:
-        - op: add
-          path: /metadata/labels/yyyy
-          value: xxxx
+        patch: |
+          - op: add
+            path: /metadata/labels/yyyy
+            value: xxxx

config/testdata/sources/gitrepository.yaml

@@ -1,4 +1,4 @@
-apiVersion: source.toolkit.fluxcd.io/v1beta2
+apiVersion: source.toolkit.fluxcd.io/v1
 kind: GitRepository
 metadata:
   name: podinfo

config/testdata/status-defaults/helmrelease.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: status-defaults
@@ -7,7 +7,7 @@ spec:
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo

config/testdata/targetnamespace/helmrelease.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: targetnamespace
@@ -7,7 +7,7 @@ spec:
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo

config/testdata/upgrade-fail-remediate-uninstall/install.yaml

@@ -1,17 +1,17 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: upgrade-fail-remediate-uninstall
 spec:
-  interval: 5m
+  interval: 30s
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo
-      interval: 1m
+      interval: 10m
   values:
     resources:
       requests:

config/testdata/upgrade-fail-remediate-uninstall/upgrade.yaml

@@ -1,17 +1,17 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: upgrade-fail-remediate-uninstall
 spec:
-  interval: 5m
+  interval: 30s
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo
-      interval: 1m
+      interval: 10m
   upgrade:
     remediation:
       remediateLastFailure: true

config/testdata/upgrade-fail-remediate/install.yaml

@@ -1,17 +1,17 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: upgrade-fail-remediate
 spec:
-  interval: 5m
+  interval: 30s
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo
-      interval: 1m
+      interval: 10m
   values:
     resources:
       requests:

config/testdata/upgrade-fail-remediate/upgrade.yaml

@@ -1,17 +1,17 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: upgrade-fail-remediate
 spec:
-  interval: 5m
+  interval: 30s
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo
-      interval: 1m
+      interval: 10m
   upgrade:
     remediation:
       remediateLastFailure: true

config/testdata/upgrade-fail-retry/install.yaml

@@ -1,17 +1,17 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: upgrade-fail-retry
 spec:
-  interval: 5m
+  interval: 30s
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo
-      interval: 1m
+      interval: 10m
   values:
     resources:
       requests:

config/testdata/upgrade-fail-retry/upgrade.yaml

@@ -1,17 +1,17 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: upgrade-fail-retry
 spec:
-  interval: 5m
+  interval: 30s
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo
-      interval: 1m
+      interval: 10m
   upgrade:
     remediation:
       retries: 1

config/testdata/upgrade-fail/install.yaml

@@ -1,17 +1,17 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: upgrade-fail
 spec:
-  interval: 5m
+  interval: 30s
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo
-      interval: 1m
+      interval: 10m
   values:
     resources:
       requests:

config/testdata/upgrade-fail/upgrade.yaml

@@ -1,17 +1,17 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: upgrade-fail
 spec:
-  interval: 5m
+  interval: 30s
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo
-      interval: 1m
+      interval: 10m
   values:
     resources:
       requests:

config/testdata/upgrade-from-ocirepo-source/install.yaml

@@ -0,0 +1,25 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: upgrade-from-ocirepo-source
+spec:
+  interval: 30s
+  url: oci://ghcr.io/stefanprodan/charts/podinfo
+  ref:
+    digest: "sha256:cdd538a0167e4b51152b71a477e51eb6737553510ce8797dbcc537e1342311bb"
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: upgrade-from-ocirepo-source
+spec:
+  chartRef:
+    kind: OCIRepository
+    name: upgrade-from-ocirepo-source
+  interval: 30s
+  values:
+    resources:
+      requests:
+        cpu: 100m
+        memory: 64Mi

config/testdata/upgrade-from-ocirepo-source/upgrade.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: upgrade-from-ocirepo-source
+spec:
+  interval: 30s
+  url: oci://ghcr.io/stefanprodan/charts/podinfo
+  ref:
+    digest: "sha256:0cc9a8446c95009ef382f5eade883a67c257f77d50f84e78ecef2aac9428d1e5"

config/testdata/upgrade-test-fail/install.yaml

@@ -1,17 +1,17 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: upgrade-test-fail
 spec:
-  interval: 5m
+  interval: 30s
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo
-      interval: 1m
+      interval: 10m
   values:
     resources:
       requests:

config/testdata/upgrade-test-fail/upgrade.yaml

@@ -1,17 +1,17 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: upgrade-test-fail
 spec:
-  interval: 5m
+  interval: 30s
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo
-      interval: 1m
+      interval: 10m
   test:
     enable: true
   values:

config/testdata/valuesfrom/helmrelease.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
   name: valuesfrom
@@ -7,11 +7,11 @@ spec:
   chart:
     spec:
       chart: podinfo
-      version: '>=4.0.0 <5.0.0'
+      version: '>=6.0.0 <7.0.0'
       sourceRef:
         kind: HelmRepository
         name: podinfo
-      interval: 1m
+      interval: 10m
   valuesFrom:
     - kind: ConfigMap
       name: valuesfrom-config

controllers/helmrelease_controller.go

@@ -1,774 +0,0 @@
-/*
-Copyright 2020 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package controllers
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-	"time"
-
-	"github.com/hashicorp/go-retryablehttp"
-	"helm.sh/helm/v3/pkg/chart"
-	"helm.sh/helm/v3/pkg/chartutil"
-	"helm.sh/helm/v3/pkg/storage/driver"
-	"helm.sh/helm/v3/pkg/strvals"
-	corev1 "k8s.io/api/core/v1"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	apimeta "k8s.io/apimachinery/pkg/api/meta"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/cli-runtime/pkg/genericclioptions"
-	"k8s.io/client-go/rest"
-	kuberecorder "k8s.io/client-go/tools/record"
-	"k8s.io/client-go/tools/reference"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/builder"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/controller"
-	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
-	"sigs.k8s.io/controller-runtime/pkg/handler"
-	"sigs.k8s.io/controller-runtime/pkg/predicate"
-	"sigs.k8s.io/controller-runtime/pkg/ratelimiter"
-	"sigs.k8s.io/controller-runtime/pkg/reconcile"
-	"sigs.k8s.io/controller-runtime/pkg/source"
-
-	apiacl "github.com/fluxcd/pkg/apis/acl"
-	eventv1 "github.com/fluxcd/pkg/apis/event/v1beta1"
-	"github.com/fluxcd/pkg/apis/meta"
-	"github.com/fluxcd/pkg/runtime/acl"
-	fluxClient "github.com/fluxcd/pkg/runtime/client"
-	"github.com/fluxcd/pkg/runtime/metrics"
-	"github.com/fluxcd/pkg/runtime/predicates"
-	"github.com/fluxcd/pkg/runtime/transform"
-	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
-
-	v2 "github.com/fluxcd/helm-controller/api/v2beta1"
-	"github.com/fluxcd/helm-controller/internal/kube"
-	"github.com/fluxcd/helm-controller/internal/runner"
-	"github.com/fluxcd/helm-controller/internal/util"
-)
-
-// +kubebuilder:rbac:groups=helm.toolkit.fluxcd.io,resources=helmreleases,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=helm.toolkit.fluxcd.io,resources=helmreleases/status,verbs=get;update;patch
-// +kubebuilder:rbac:groups=helm.toolkit.fluxcd.io,resources=helmreleases/finalizers,verbs=get;create;update;patch;delete
-// +kubebuilder:rbac:groups=source.toolkit.fluxcd.io,resources=helmcharts,verbs=get;list;watch
-// +kubebuilder:rbac:groups=source.toolkit.fluxcd.io,resources=helmcharts/status,verbs=get
-// +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
-
-// HelmReleaseReconciler reconciles a HelmRelease object
-type HelmReleaseReconciler struct {
-	client.Client
-	httpClient            *retryablehttp.Client
-	Config                *rest.Config
-	Scheme                *runtime.Scheme
-	requeueDependency     time.Duration
-	EventRecorder         kuberecorder.EventRecorder
-	MetricsRecorder       *metrics.Recorder
-	DefaultServiceAccount string
-	NoCrossNamespaceRef   bool
-	ClientOpts            fluxClient.Options
-	KubeConfigOpts        fluxClient.KubeConfigOptions
-}
-
-func (r *HelmReleaseReconciler) SetupWithManager(mgr ctrl.Manager, opts HelmReleaseReconcilerOptions) error {
-	// Index the HelmRelease by the HelmChart references they point at
-	if err := mgr.GetFieldIndexer().IndexField(context.TODO(), &v2.HelmRelease{}, v2.SourceIndexKey,
-		func(o client.Object) []string {
-			hr := o.(*v2.HelmRelease)
-			return []string{
-				fmt.Sprintf("%s/%s", hr.Spec.Chart.GetNamespace(hr.GetNamespace()), hr.GetHelmChartName()),
-			}
-		},
-	); err != nil {
-		return err
-	}
-
-	r.requeueDependency = opts.DependencyRequeueInterval
-
-	// Configure the retryable http client used for fetching artifacts.
-	// By default it retries 10 times within a 3.5 minutes window.
-	httpClient := retryablehttp.NewClient()
-	httpClient.RetryWaitMin = 5 * time.Second
-	httpClient.RetryWaitMax = 30 * time.Second
-	httpClient.RetryMax = opts.HTTPRetry
-	httpClient.Logger = nil
-	r.httpClient = httpClient
-
-	return ctrl.NewControllerManagedBy(mgr).
-		For(&v2.HelmRelease{}, builder.WithPredicates(
-			predicate.Or(predicate.GenerationChangedPredicate{}, predicates.ReconcileRequestedPredicate{}),
-		)).
-		Watches(
-			&source.Kind{Type: &sourcev1.HelmChart{}},
-			handler.EnqueueRequestsFromMapFunc(r.requestsForHelmChartChange),
-			builder.WithPredicates(SourceRevisionChangePredicate{}),
-		).
-		WithOptions(controller.Options{
-			MaxConcurrentReconciles: opts.MaxConcurrentReconciles,
-			RateLimiter:             opts.RateLimiter,
-			RecoverPanic:            true,
-		}).
-		Complete(r)
-}
-
-// ConditionError represents an error with a status condition reason attached.
-type ConditionError struct {
-	Reason string
-	Err    error
-}
-
-func (c ConditionError) Error() string {
-	return c.Err.Error()
-}
-
-func (r *HelmReleaseReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
-	start := time.Now()
-	log := ctrl.LoggerFrom(ctx)
-
-	var hr v2.HelmRelease
-	if err := r.Get(ctx, req.NamespacedName, &hr); err != nil {
-		return ctrl.Result{}, client.IgnoreNotFound(err)
-	}
-
-	// record suspension metrics
-	defer r.recordSuspension(ctx, hr)
-
-	// Add our finalizer if it does not exist
-	if !controllerutil.ContainsFinalizer(&hr, v2.HelmReleaseFinalizer) {
-		patch := client.MergeFrom(hr.DeepCopy())
-		controllerutil.AddFinalizer(&hr, v2.HelmReleaseFinalizer)
-		if err := r.Patch(ctx, &hr, patch); err != nil {
-			log.Error(err, "unable to register finalizer")
-			return ctrl.Result{}, err
-		}
-	}
-
-	// Examine if the object is under deletion
-	if !hr.ObjectMeta.DeletionTimestamp.IsZero() {
-		return r.reconcileDelete(ctx, hr)
-	}
-
-	// Return early if the HelmRelease is suspended.
-	if hr.Spec.Suspend {
-		log.Info("Reconciliation is suspended for this object")
-		return ctrl.Result{}, nil
-	}
-
-	hr, result, err := r.reconcile(ctx, hr)
-
-	// Update status after reconciliation.
-	if updateStatusErr := r.patchStatus(ctx, &hr); updateStatusErr != nil {
-		log.Error(updateStatusErr, "unable to update status after reconciliation")
-		return ctrl.Result{Requeue: true}, updateStatusErr
-	}
-
-	// Record ready status
-	r.recordReadiness(ctx, hr)
-
-	// Log reconciliation duration
-	durationMsg := fmt.Sprintf("reconcilation finished in %s", time.Now().Sub(start).String())
-	if result.RequeueAfter > 0 {
-		durationMsg = fmt.Sprintf("%s, next run in %s", durationMsg, result.RequeueAfter.String())
-	}
-	log.Info(durationMsg)
-
-	return result, err
-}
-
-func (r *HelmReleaseReconciler) reconcile(ctx context.Context, hr v2.HelmRelease) (v2.HelmRelease, ctrl.Result, error) {
-	reconcileStart := time.Now()
-	log := ctrl.LoggerFrom(ctx)
-	// Record the value of the reconciliation request, if any
-	if v, ok := meta.ReconcileAnnotationValue(hr.GetAnnotations()); ok {
-		hr.Status.SetLastHandledReconcileRequest(v)
-	}
-
-	// Observe HelmRelease generation.
-	if hr.Status.ObservedGeneration != hr.Generation {
-		hr.Status.ObservedGeneration = hr.Generation
-		hr = v2.HelmReleaseProgressing(hr)
-		if updateStatusErr := r.patchStatus(ctx, &hr); updateStatusErr != nil {
-			log.Error(updateStatusErr, "unable to update status after generation update")
-			return hr, ctrl.Result{Requeue: true}, updateStatusErr
-		}
-		// Record progressing status
-		r.recordReadiness(ctx, hr)
-	}
-
-	// Record reconciliation duration
-	if r.MetricsRecorder != nil {
-		objRef, err := reference.GetReference(r.Scheme, &hr)
-		if err != nil {
-			return hr, ctrl.Result{Requeue: true}, err
-		}
-		defer r.MetricsRecorder.RecordDuration(*objRef, reconcileStart)
-	}
-
-	// Reconcile chart based on the HelmChartTemplate
-	hc, reconcileErr := r.reconcileChart(ctx, &hr)
-	if reconcileErr != nil {
-		if acl.IsAccessDenied(reconcileErr) {
-			log.Error(reconcileErr, "access denied to cross-namespace source")
-			r.event(ctx, hr, hr.Status.LastAttemptedRevision, eventv1.EventSeverityError, reconcileErr.Error())
-			return v2.HelmReleaseNotReady(hr, apiacl.AccessDeniedReason, reconcileErr.Error()),
-				ctrl.Result{RequeueAfter: hr.Spec.Interval.Duration}, nil
-		}
-
-		msg := fmt.Sprintf("chart reconciliation failed: %s", reconcileErr.Error())
-		r.event(ctx, hr, hr.Status.LastAttemptedRevision, eventv1.EventSeverityError, msg)
-		return v2.HelmReleaseNotReady(hr, v2.ArtifactFailedReason, msg), ctrl.Result{Requeue: true}, reconcileErr
-	}
-
-	// Check chart readiness
-	if hc.Generation != hc.Status.ObservedGeneration || !apimeta.IsStatusConditionTrue(hc.Status.Conditions, meta.ReadyCondition) {
-		msg := fmt.Sprintf("HelmChart '%s/%s' is not ready", hc.GetNamespace(), hc.GetName())
-		r.event(ctx, hr, hr.Status.LastAttemptedRevision, eventv1.EventSeverityInfo, msg)
-		log.Info(msg)
-		// Do not requeue immediately, when the artifact is created
-		// the watcher should trigger a reconciliation.
-		return v2.HelmReleaseNotReady(hr, v2.ArtifactFailedReason, msg), ctrl.Result{RequeueAfter: hc.Spec.Interval.Duration}, nil
-	}
-
-	// Check dependencies
-	if len(hr.Spec.DependsOn) > 0 {
-		if err := r.checkDependencies(hr); err != nil {
-			msg := fmt.Sprintf("dependencies do not meet ready condition (%s), retrying in %s",
-				err.Error(), r.requeueDependency.String())
-			r.event(ctx, hr, hc.GetArtifact().Revision, eventv1.EventSeverityInfo, msg)
-			log.Info(msg)
-
-			// Exponential backoff would cause execution to be prolonged too much,
-			// instead we requeue on a fixed interval.
-			return v2.HelmReleaseNotReady(hr,
-				v2.DependencyNotReadyReason, err.Error()), ctrl.Result{RequeueAfter: r.requeueDependency}, nil
-		}
-		log.Info("all dependencies are ready, proceeding with release")
-	}
-
-	// Compose values
-	values, err := r.composeValues(ctx, hr)
-	if err != nil {
-		r.event(ctx, hr, hr.Status.LastAttemptedRevision, eventv1.EventSeverityError, err.Error())
-		return v2.HelmReleaseNotReady(hr, v2.InitFailedReason, err.Error()), ctrl.Result{Requeue: true}, nil
-	}
-
-	// Load chart from artifact
-	chart, err := r.loadHelmChart(hc)
-	if err != nil {
-		r.event(ctx, hr, hr.Status.LastAttemptedRevision, eventv1.EventSeverityError, err.Error())
-		return v2.HelmReleaseNotReady(hr, v2.ArtifactFailedReason, err.Error()), ctrl.Result{Requeue: true}, nil
-	}
-
-	// Reconcile Helm release
-	reconciledHr, reconcileErr := r.reconcileRelease(ctx, *hr.DeepCopy(), chart, values)
-	if reconcileErr != nil {
-		r.event(ctx, hr, hc.GetArtifact().Revision, eventv1.EventSeverityError,
-			fmt.Sprintf("reconciliation failed: %s", reconcileErr.Error()))
-	}
-	return reconciledHr, ctrl.Result{RequeueAfter: hr.Spec.Interval.Duration}, reconcileErr
-}
-
-type HelmReleaseReconcilerOptions struct {
-	MaxConcurrentReconciles   int
-	HTTPRetry                 int
-	DependencyRequeueInterval time.Duration
-	RateLimiter               ratelimiter.RateLimiter
-}
-
-func (r *HelmReleaseReconciler) reconcileRelease(ctx context.Context,
-	hr v2.HelmRelease, chart *chart.Chart, values chartutil.Values) (v2.HelmRelease, error) {
-	log := ctrl.LoggerFrom(ctx)
-
-	// Initialize Helm action runner
-	getter, err := r.buildRESTClientGetter(ctx, hr)
-	if err != nil {
-		return v2.HelmReleaseNotReady(hr, v2.InitFailedReason, err.Error()), err
-	}
-	run, err := runner.NewRunner(getter, hr.GetStorageNamespace(), log)
-	if err != nil {
-		return v2.HelmReleaseNotReady(hr, v2.InitFailedReason, "failed to initialize Helm action runner"), err
-	}
-
-	// Determine last release revision.
-	rel, observeLastReleaseErr := run.ObserveLastRelease(hr)
-	if observeLastReleaseErr != nil {
-		err = fmt.Errorf("failed to get last release revision: %w", observeLastReleaseErr)
-		return v2.HelmReleaseNotReady(hr, v2.GetLastReleaseFailedReason, "failed to get last release revision"), err
-	}
-
-	// Register the current release attempt.
-	revision := chart.Metadata.Version
-	releaseRevision := util.ReleaseRevision(rel)
-	valuesChecksum := util.ValuesChecksum(values)
-	hr, hasNewState := v2.HelmReleaseAttempted(hr, revision, releaseRevision, valuesChecksum)
-	if hasNewState {
-		hr = v2.HelmReleaseProgressing(hr)
-		if updateStatusErr := r.patchStatus(ctx, &hr); updateStatusErr != nil {
-			log.Error(updateStatusErr, "unable to update status after state update")
-			return hr, updateStatusErr
-		}
-		// Record progressing status
-		r.recordReadiness(ctx, hr)
-	}
-
-	// Check status of any previous release attempt.
-	released := apimeta.FindStatusCondition(hr.Status.Conditions, v2.ReleasedCondition)
-	if released != nil {
-		switch released.Status {
-		// Succeed if the previous release attempt succeeded.
-		case metav1.ConditionTrue:
-			return v2.HelmReleaseReady(hr), nil
-		case metav1.ConditionFalse:
-			// Fail if the previous release attempt remediation failed.
-			remediated := apimeta.FindStatusCondition(hr.Status.Conditions, v2.RemediatedCondition)
-			if remediated != nil && remediated.Status == metav1.ConditionFalse {
-				err = fmt.Errorf("previous release attempt remediation failed")
-				return v2.HelmReleaseNotReady(hr, remediated.Reason, remediated.Message), err
-			}
-		}
-
-		// Fail if install retries are exhausted.
-		if hr.Spec.GetInstall().GetRemediation().RetriesExhausted(hr) {
-			err = fmt.Errorf("install retries exhausted")
-			return v2.HelmReleaseNotReady(hr, released.Reason, err.Error()), err
-		}
-
-		// Fail if there is a release and upgrade retries are exhausted.
-		// This avoids failing after an upgrade uninstall remediation strategy.
-		if rel != nil && hr.Spec.GetUpgrade().GetRemediation().RetriesExhausted(hr) {
-			err = fmt.Errorf("upgrade retries exhausted")
-			return v2.HelmReleaseNotReady(hr, released.Reason, err.Error()), err
-		}
-	}
-
-	// Deploy the release.
-	var deployAction v2.DeploymentAction
-	if rel == nil {
-		r.event(ctx, hr, revision, eventv1.EventSeverityInfo, "Helm install has started")
-		deployAction = hr.Spec.GetInstall()
-		rel, err = run.Install(hr, chart, values)
-		err = r.handleHelmActionResult(ctx, &hr, revision, err, deployAction.GetDescription(),
-			v2.ReleasedCondition, v2.InstallSucceededReason, v2.InstallFailedReason)
-	} else {
-		r.event(ctx, hr, revision, eventv1.EventSeverityInfo, "Helm upgrade has started")
-		deployAction = hr.Spec.GetUpgrade()
-		rel, err = run.Upgrade(hr, chart, values)
-		err = r.handleHelmActionResult(ctx, &hr, revision, err, deployAction.GetDescription(),
-			v2.ReleasedCondition, v2.UpgradeSucceededReason, v2.UpgradeFailedReason)
-	}
-	remediation := deployAction.GetRemediation()
-
-	// If there is a new release revision...
-	if util.ReleaseRevision(rel) > releaseRevision {
-		// Ensure release is not marked remediated.
-		apimeta.RemoveStatusCondition(&hr.Status.Conditions, v2.RemediatedCondition)
-
-		// If new release revision is successful and tests are enabled, run them.
-		if err == nil && hr.Spec.GetTest().Enable {
-			_, testErr := run.Test(hr)
-			testErr = r.handleHelmActionResult(ctx, &hr, revision, testErr, "test",
-				v2.TestSuccessCondition, v2.TestSucceededReason, v2.TestFailedReason)
-
-			// Propagate any test error if not marked ignored.
-			if testErr != nil && !remediation.MustIgnoreTestFailures(hr.Spec.GetTest().IgnoreFailures) {
-				testsPassing := apimeta.FindStatusCondition(hr.Status.Conditions, v2.TestSuccessCondition)
-				newCondition := metav1.Condition{
-					Type:    v2.ReleasedCondition,
-					Status:  metav1.ConditionFalse,
-					Reason:  testsPassing.Reason,
-					Message: testsPassing.Message,
-				}
-				apimeta.SetStatusCondition(hr.GetStatusConditions(), newCondition)
-				err = testErr
-			}
-		}
-	}
-
-	if err != nil {
-		// Increment failure count for deployment action.
-		remediation.IncrementFailureCount(&hr)
-		// Remediate deployment failure if necessary.
-		if !remediation.RetriesExhausted(hr) || remediation.MustRemediateLastFailure() {
-			if util.ReleaseRevision(rel) <= releaseRevision {
-				log.Info(fmt.Sprintf("skipping remediation, no new release revision created"))
-			} else {
-				var remediationErr error
-				switch remediation.GetStrategy() {
-				case v2.RollbackRemediationStrategy:
-					rollbackErr := run.Rollback(hr)
-					remediationErr = r.handleHelmActionResult(ctx, &hr, revision, rollbackErr, "rollback",
-						v2.RemediatedCondition, v2.RollbackSucceededReason, v2.RollbackFailedReason)
-				case v2.UninstallRemediationStrategy:
-					uninstallErr := run.Uninstall(hr)
-					remediationErr = r.handleHelmActionResult(ctx, &hr, revision, uninstallErr, "uninstall",
-						v2.RemediatedCondition, v2.UninstallSucceededReason, v2.UninstallFailedReason)
-				}
-				if remediationErr != nil {
-					err = remediationErr
-				}
-			}
-
-			// Determine release after remediation.
-			rel, observeLastReleaseErr = run.ObserveLastRelease(hr)
-			if observeLastReleaseErr != nil {
-				err = &ConditionError{
-					Reason: v2.GetLastReleaseFailedReason,
-					Err:    errors.New("failed to get last release revision after remediation"),
-				}
-			}
-		}
-	}
-
-	hr.Status.LastReleaseRevision = util.ReleaseRevision(rel)
-
-	if err != nil {
-		reason := v2.ReconciliationFailedReason
-		if condErr := (*ConditionError)(nil); errors.As(err, &condErr) {
-			reason = condErr.Reason
-		}
-		return v2.HelmReleaseNotReady(hr, reason, err.Error()), err
-	}
-	return v2.HelmReleaseReady(hr), nil
-}
-
-func (r *HelmReleaseReconciler) checkDependencies(hr v2.HelmRelease) error {
-	for _, d := range hr.Spec.DependsOn {
-		if d.Namespace == "" {
-			d.Namespace = hr.GetNamespace()
-		}
-		dName := types.NamespacedName{
-			Namespace: d.Namespace,
-			Name:      d.Name,
-		}
-		var dHr v2.HelmRelease
-		err := r.Get(context.Background(), dName, &dHr)
-		if err != nil {
-			return fmt.Errorf("unable to get '%s' dependency: %w", dName, err)
-		}
-
-		if len(dHr.Status.Conditions) == 0 || dHr.Generation != dHr.Status.ObservedGeneration {
-			return fmt.Errorf("dependency '%s' is not ready", dName)
-		}
-
-		if !apimeta.IsStatusConditionTrue(dHr.Status.Conditions, meta.ReadyCondition) {
-			return fmt.Errorf("dependency '%s' is not ready", dName)
-		}
-	}
-	return nil
-}
-
-func (r *HelmReleaseReconciler) buildRESTClientGetter(ctx context.Context, hr v2.HelmRelease) (genericclioptions.RESTClientGetter, error) {
-	opts := []kube.ClientGetterOption{
-		kube.WithClientOptions(r.ClientOpts),
-		// When ServiceAccountName is empty, it will fall back to the configured default.
-		// If this is not configured either, this option will result in a no-op.
-		kube.WithImpersonate(hr.Spec.ServiceAccountName, hr.GetNamespace()),
-	}
-	if hr.Spec.KubeConfig != nil {
-		secretName := types.NamespacedName{
-			Namespace: hr.GetNamespace(),
-			Name:      hr.Spec.KubeConfig.SecretRef.Name,
-		}
-		var secret corev1.Secret
-		if err := r.Get(ctx, secretName, &secret); err != nil {
-			return nil, fmt.Errorf("could not find KubeConfig secret '%s': %w", secretName, err)
-		}
-		kubeConfig, err := kube.ConfigFromSecret(&secret, hr.Spec.KubeConfig.SecretRef.Key)
-		if err != nil {
-			return nil, err
-		}
-		opts = append(opts, kube.WithKubeConfig(kubeConfig, r.KubeConfigOpts))
-	}
-	return kube.BuildClientGetter(hr.GetReleaseNamespace(), opts...)
-}
-
-// composeValues attempts to resolve all v2beta1.ValuesReference resources
-// and merges them as defined. Referenced resources are only retrieved once
-// to ensure a single version is taken into account during the merge.
-func (r *HelmReleaseReconciler) composeValues(ctx context.Context, hr v2.HelmRelease) (chartutil.Values, error) {
-	result := chartutil.Values{}
-
-	configMaps := make(map[string]*corev1.ConfigMap)
-	secrets := make(map[string]*corev1.Secret)
-
-	for _, v := range hr.Spec.ValuesFrom {
-		namespacedName := types.NamespacedName{Namespace: hr.Namespace, Name: v.Name}
-		var valuesData []byte
-
-		switch v.Kind {
-		case "ConfigMap":
-			resource, ok := configMaps[namespacedName.String()]
-			if !ok {
-				// The resource may not exist, but we want to act on a single version
-				// of the resource in case the values reference is marked as optional.
-				configMaps[namespacedName.String()] = nil
-
-				resource = &corev1.ConfigMap{}
-				if err := r.Get(ctx, namespacedName, resource); err != nil {
-					if apierrors.IsNotFound(err) {
-						if v.Optional {
-							(ctrl.LoggerFrom(ctx)).
-								Info(fmt.Sprintf("could not find optional %s '%s'", v.Kind, namespacedName))
-							continue
-						}
-						return nil, fmt.Errorf("could not find %s '%s'", v.Kind, namespacedName)
-					}
-					return nil, err
-				}
-				configMaps[namespacedName.String()] = resource
-			}
-			if resource == nil {
-				if v.Optional {
-					(ctrl.LoggerFrom(ctx)).Info(fmt.Sprintf("could not find optional %s '%s'", v.Kind, namespacedName))
-					continue
-				}
-				return nil, fmt.Errorf("could not find %s '%s'", v.Kind, namespacedName)
-			}
-			if data, ok := resource.Data[v.GetValuesKey()]; !ok {
-				return nil, fmt.Errorf("missing key '%s' in %s '%s'", v.GetValuesKey(), v.Kind, namespacedName)
-			} else {
-				valuesData = []byte(data)
-			}
-		case "Secret":
-			resource, ok := secrets[namespacedName.String()]
-			if !ok {
-				// The resource may not exist, but we want to act on a single version
-				// of the resource in case the values reference is marked as optional.
-				secrets[namespacedName.String()] = nil
-
-				resource = &corev1.Secret{}
-				if err := r.Get(ctx, namespacedName, resource); err != nil {
-					if apierrors.IsNotFound(err) {
-						if v.Optional {
-							(ctrl.LoggerFrom(ctx)).
-								Info(fmt.Sprintf("could not find optional %s '%s'", v.Kind, namespacedName))
-							continue
-						}
-						return nil, fmt.Errorf("could not find %s '%s'", v.Kind, namespacedName)
-					}
-					return nil, err
-				}
-				secrets[namespacedName.String()] = resource
-			}
-			if resource == nil {
-				if v.Optional {
-					(ctrl.LoggerFrom(ctx)).Info(fmt.Sprintf("could not find optional %s '%s'", v.Kind, namespacedName))
-					continue
-				}
-				return nil, fmt.Errorf("could not find %s '%s'", v.Kind, namespacedName)
-			}
-			if data, ok := resource.Data[v.GetValuesKey()]; !ok {
-				return nil, fmt.Errorf("missing key '%s' in %s '%s'", v.GetValuesKey(), v.Kind, namespacedName)
-			} else {
-				valuesData = data
-			}
-		default:
-			return nil, fmt.Errorf("unsupported ValuesReference kind '%s'", v.Kind)
-		}
-		switch v.TargetPath {
-		case "":
-			values, err := chartutil.ReadValues(valuesData)
-			if err != nil {
-				return nil, fmt.Errorf("unable to read values from key '%s' in %s '%s': %w", v.GetValuesKey(), v.Kind, namespacedName, err)
-			}
-			result = transform.MergeMaps(result, values)
-		default:
-			// TODO(hidde): this is a bit of hack, as it mimics the way the option string is passed
-			// 	to Helm from a CLI perspective. Given the parser is however not publicly accessible
-			// 	while it contains all logic around parsing the target path, it is a fair trade-off.
-			stringValuesData := string(valuesData)
-			const singleQuote = "'"
-			const doubleQuote = "\""
-			var err error
-			if (strings.HasPrefix(stringValuesData, singleQuote) && strings.HasSuffix(stringValuesData, singleQuote)) || (strings.HasPrefix(stringValuesData, doubleQuote) && strings.HasSuffix(stringValuesData, doubleQuote)) {
-				stringValuesData = strings.Trim(stringValuesData, singleQuote+doubleQuote)
-				singleValue := v.TargetPath + "=" + stringValuesData
-				err = strvals.ParseIntoString(singleValue, result)
-			} else {
-				singleValue := v.TargetPath + "=" + stringValuesData
-				err = strvals.ParseInto(singleValue, result)
-			}
-			if err != nil {
-				return nil, fmt.Errorf("unable to merge value from key '%s' in %s '%s' into target path '%s': %w", v.GetValuesKey(), v.Kind, namespacedName, v.TargetPath, err)
-			}
-		}
-	}
-	return transform.MergeMaps(result, hr.GetValues()), nil
-}
-
-// reconcileDelete deletes the v1beta2.HelmChart of the v2beta1.HelmRelease,
-// and uninstalls the Helm release if the resource has not been suspended.
-func (r *HelmReleaseReconciler) reconcileDelete(ctx context.Context, hr v2.HelmRelease) (ctrl.Result, error) {
-	r.recordReadiness(ctx, hr)
-
-	// Delete the HelmChart that belongs to this resource.
-	if err := r.deleteHelmChart(ctx, &hr); err != nil {
-		return ctrl.Result{}, err
-	}
-
-	// Only uninstall the Helm Release if the resource is not suspended.
-	if !hr.Spec.Suspend {
-		getter, err := r.buildRESTClientGetter(ctx, hr)
-		if err != nil {
-			return ctrl.Result{}, err
-		}
-		run, err := runner.NewRunner(getter, hr.GetStorageNamespace(), ctrl.LoggerFrom(ctx))
-		if err != nil {
-			return ctrl.Result{}, err
-		}
-		if err := run.Uninstall(hr); err != nil && !errors.Is(err, driver.ErrReleaseNotFound) {
-			return ctrl.Result{}, err
-		}
-		ctrl.LoggerFrom(ctx).Info("uninstalled Helm release for deleted resource")
-
-	} else {
-		ctrl.LoggerFrom(ctx).Info("skipping Helm uninstall for suspended resource")
-	}
-
-	// Remove our finalizer from the list and update it.
-	controllerutil.RemoveFinalizer(&hr, v2.HelmReleaseFinalizer)
-	if err := r.Update(ctx, &hr); err != nil {
-		return ctrl.Result{}, err
-	}
-
-	return ctrl.Result{}, nil
-}
-
-func (r *HelmReleaseReconciler) handleHelmActionResult(ctx context.Context,
-	hr *v2.HelmRelease, revision string, err error, action string, condition string, succeededReason string, failedReason string) error {
-	if err != nil {
-		err = fmt.Errorf("Helm %s failed: %w", action, err)
-		msg := err.Error()
-		if actionErr := (*runner.ActionError)(nil); errors.As(err, &actionErr) {
-			msg = msg + "\n\nLast Helm logs:\n\n" + actionErr.CapturedLogs
-		}
-		newCondition := metav1.Condition{
-			Type:    condition,
-			Status:  metav1.ConditionFalse,
-			Reason:  failedReason,
-			Message: msg,
-		}
-		apimeta.SetStatusCondition(hr.GetStatusConditions(), newCondition)
-		r.event(ctx, *hr, revision, eventv1.EventSeverityError, msg)
-		return &ConditionError{Reason: failedReason, Err: err}
-	} else {
-		msg := fmt.Sprintf("Helm %s succeeded", action)
-		newCondition := metav1.Condition{
-			Type:    condition,
-			Status:  metav1.ConditionTrue,
-			Reason:  succeededReason,
-			Message: msg,
-		}
-		apimeta.SetStatusCondition(hr.GetStatusConditions(), newCondition)
-		r.event(ctx, *hr, revision, eventv1.EventSeverityInfo, msg)
-		return nil
-	}
-}
-
-func (r *HelmReleaseReconciler) patchStatus(ctx context.Context, hr *v2.HelmRelease) error {
-	key := client.ObjectKeyFromObject(hr)
-	latest := &v2.HelmRelease{}
-	if err := r.Client.Get(ctx, key, latest); err != nil {
-		return err
-	}
-	return r.Client.Status().Patch(ctx, hr, client.MergeFrom(latest))
-}
-
-func (r *HelmReleaseReconciler) requestsForHelmChartChange(o client.Object) []reconcile.Request {
-	hc, ok := o.(*sourcev1.HelmChart)
-	if !ok {
-		panic(fmt.Sprintf("Expected a HelmChart, got %T", o))
-	}
-	// If we do not have an artifact, we have no requests to make
-	if hc.GetArtifact() == nil {
-		return nil
-	}
-
-	ctx := context.Background()
-	var list v2.HelmReleaseList
-	if err := r.List(ctx, &list, client.MatchingFields{
-		v2.SourceIndexKey: client.ObjectKeyFromObject(hc).String(),
-	}); err != nil {
-		return nil
-	}
-
-	var reqs []reconcile.Request
-	for _, i := range list.Items {
-		// If the revision of the artifact equals to the last attempted revision,
-		// we should not make a request for this HelmRelease
-		if hc.GetArtifact().Revision == i.Status.LastAttemptedRevision {
-			continue
-		}
-		reqs = append(reqs, reconcile.Request{NamespacedName: client.ObjectKeyFromObject(&i)})
-	}
-	return reqs
-}
-
-// event emits a Kubernetes event and forwards the event to notification controller if configured.
-func (r *HelmReleaseReconciler) event(_ context.Context, hr v2.HelmRelease, revision, severity, msg string) {
-	var meta map[string]string
-	if revision != "" {
-		meta = map[string]string{v2.GroupVersion.Group + "/revision": revision}
-	}
-	eventtype := "Normal"
-	if severity == eventv1.EventSeverityError {
-		eventtype = "Warning"
-	}
-	r.EventRecorder.AnnotatedEventf(&hr, meta, eventtype, severity, msg)
-}
-
-func (r *HelmReleaseReconciler) recordSuspension(ctx context.Context, hr v2.HelmRelease) {
-	if r.MetricsRecorder == nil {
-		return
-	}
-	log := ctrl.LoggerFrom(ctx)
-
-	objRef, err := reference.GetReference(r.Scheme, &hr)
-	if err != nil {
-		log.Error(err, "unable to record suspended metric")
-		return
-	}
-
-	if !hr.DeletionTimestamp.IsZero() {
-		r.MetricsRecorder.RecordSuspend(*objRef, false)
-	} else {
-		r.MetricsRecorder.RecordSuspend(*objRef, hr.Spec.Suspend)
-	}
-}
-
-func (r *HelmReleaseReconciler) recordReadiness(ctx context.Context, hr v2.HelmRelease) {
-	if r.MetricsRecorder == nil {
-		return
-	}
-
-	objRef, err := reference.GetReference(r.Scheme, &hr)
-	if err != nil {
-		ctrl.LoggerFrom(ctx).Error(err, "unable to record readiness metric")
-		return
-	}
-	if rc := apimeta.FindStatusCondition(hr.Status.Conditions, meta.ReadyCondition); rc != nil {
-		r.MetricsRecorder.RecordCondition(*objRef, *rc, !hr.DeletionTimestamp.IsZero())
-	} else {
-		r.MetricsRecorder.RecordCondition(*objRef, metav1.Condition{
-			Type:   meta.ReadyCondition,
-			Status: metav1.ConditionUnknown,
-		}, !hr.DeletionTimestamp.IsZero())
-	}
-}

controllers/helmrelease_controller_chart.go

@@ -1,260 +0,0 @@
-/*
-Copyright 2020 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package controllers
-
-import (
-	"context"
-	"crypto/sha1"
-	"crypto/sha256"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"os"
-	"reflect"
-	"strings"
-
-	"github.com/fluxcd/pkg/runtime/acl"
-	"github.com/hashicorp/go-retryablehttp"
-	"helm.sh/helm/v3/pkg/chart"
-	"helm.sh/helm/v3/pkg/chart/loader"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/types"
-	ctrl "sigs.k8s.io/controller-runtime"
-
-	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
-
-	v2 "github.com/fluxcd/helm-controller/api/v2beta1"
-)
-
-func (r *HelmReleaseReconciler) reconcileChart(ctx context.Context, hr *v2.HelmRelease) (*sourcev1.HelmChart, error) {
-	chartName := types.NamespacedName{
-		Namespace: hr.Spec.Chart.GetNamespace(hr.Namespace),
-		Name:      hr.GetHelmChartName(),
-	}
-
-	if r.NoCrossNamespaceRef && chartName.Namespace != hr.Namespace {
-		return nil, acl.AccessDeniedError(fmt.Sprintf("can't access '%s/%s', cross-namespace references have been blocked",
-			hr.Spec.Chart.Spec.SourceRef.Kind, types.NamespacedName{
-				Namespace: hr.Spec.Chart.Spec.SourceRef.Namespace,
-				Name:      hr.Spec.Chart.Spec.SourceRef.Name,
-			}))
-	}
-
-	// Garbage collect the previous HelmChart if the namespace named changed.
-	if hr.Status.HelmChart != "" && hr.Status.HelmChart != chartName.String() {
-		if err := r.deleteHelmChart(ctx, hr); err != nil {
-			return nil, err
-		}
-	}
-
-	// Continue with the reconciliation of the current template.
-	var helmChart sourcev1.HelmChart
-	err := r.Client.Get(ctx, chartName, &helmChart)
-	if err != nil && !apierrors.IsNotFound(err) {
-		return nil, err
-	}
-	hc := buildHelmChartFromTemplate(hr)
-	switch {
-	case apierrors.IsNotFound(err):
-		if err = r.Client.Create(ctx, hc); err != nil {
-			return nil, err
-		}
-		hr.Status.HelmChart = chartName.String()
-		return hc, nil
-	case helmChartRequiresUpdate(hr, &helmChart):
-		ctrl.LoggerFrom(ctx).Info("chart diverged from template", strings.ToLower(sourcev1.HelmChartKind), chartName.String())
-		helmChart.Spec = hc.Spec
-		if err = r.Client.Update(ctx, &helmChart); err != nil {
-			return nil, err
-		}
-		hr.Status.HelmChart = chartName.String()
-	}
-	return &helmChart, nil
-}
-
-// getHelmChart retrieves the v1beta2.HelmChart for the given
-// v2beta1.HelmRelease using the name that is advertised in the status
-// object. It returns the v1beta2.HelmChart, or an error.
-func (r *HelmReleaseReconciler) getHelmChart(ctx context.Context, hr *v2.HelmRelease) (*sourcev1.HelmChart, error) {
-	namespace, name := hr.Status.GetHelmChart()
-	hc := &sourcev1.HelmChart{}
-	if err := r.Client.Get(ctx, types.NamespacedName{Namespace: namespace, Name: name}, hc); err != nil {
-		return nil, err
-	}
-	return hc, nil
-}
-
-// loadHelmChart attempts to download the artifact from the provided source,
-// loads it into a chart.Chart, and removes the downloaded artifact.
-// It returns the loaded chart.Chart on success, or an error.
-func (r *HelmReleaseReconciler) loadHelmChart(source *sourcev1.HelmChart) (*chart.Chart, error) {
-	f, err := os.CreateTemp("", fmt.Sprintf("%s-%s-*.tgz", source.GetNamespace(), source.GetName()))
-	if err != nil {
-		return nil, err
-	}
-	defer f.Close()
-	defer os.Remove(f.Name())
-
-	artifactURL := source.GetArtifact().URL
-	if hostname := os.Getenv("SOURCE_CONTROLLER_LOCALHOST"); hostname != "" {
-		u, err := url.Parse(artifactURL)
-		if err != nil {
-			return nil, err
-		}
-		u.Host = hostname
-		artifactURL = u.String()
-	}
-
-	req, err := retryablehttp.NewRequest(http.MethodGet, artifactURL, nil)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create a new request: %w", err)
-	}
-
-	resp, err := r.httpClient.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("failed to download artifact, error: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("artifact '%s' download failed (status code: %s)", source.GetArtifact().URL, resp.Status)
-	}
-
-	// verify checksum matches origin
-	if err := r.copyAndVerifyArtifact(source.GetArtifact(), resp.Body, f); err != nil {
-		return nil, err
-	}
-
-	return loader.Load(f.Name())
-}
-
-func (r *HelmReleaseReconciler) copyAndVerifyArtifact(artifact *sourcev1.Artifact, reader io.Reader, writer io.Writer) error {
-	hasher := sha256.New()
-
-	// for backwards compatibility with source-controller v0.17.2 and older
-	if len(artifact.Checksum) == 40 {
-		hasher = sha1.New()
-	}
-
-	// compute checksum
-	mw := io.MultiWriter(hasher, writer)
-	if _, err := io.Copy(mw, reader); err != nil {
-		return err
-	}
-
-	if checksum := fmt.Sprintf("%x", hasher.Sum(nil)); checksum != artifact.Checksum {
-		return fmt.Errorf("failed to verify artifact: computed checksum '%s' doesn't match advertised '%s'",
-			checksum, artifact.Checksum)
-	}
-
-	return nil
-}
-
-// deleteHelmChart deletes the v1beta2.HelmChart of the v2beta1.HelmRelease.
-func (r *HelmReleaseReconciler) deleteHelmChart(ctx context.Context, hr *v2.HelmRelease) error {
-	if hr.Status.HelmChart == "" {
-		return nil
-	}
-	var hc sourcev1.HelmChart
-	chartNS, chartName := hr.Status.GetHelmChart()
-	err := r.Client.Get(ctx, types.NamespacedName{Namespace: chartNS, Name: chartName}, &hc)
-	if err != nil {
-		if apierrors.IsNotFound(err) {
-			hr.Status.HelmChart = ""
-			return nil
-		}
-		err = fmt.Errorf("failed to delete HelmChart '%s': %w", hr.Status.HelmChart, err)
-		return err
-	}
-	if err = r.Client.Delete(ctx, &hc); err != nil {
-		err = fmt.Errorf("failed to delete HelmChart '%s': %w", hr.Status.HelmChart, err)
-		return err
-	}
-	// Truncate the chart reference in the status object.
-	hr.Status.HelmChart = ""
-	return nil
-}
-
-// buildHelmChartFromTemplate builds a v1beta2.HelmChart from the
-// v2beta1.HelmChartTemplate of the given v2beta1.HelmRelease.
-func buildHelmChartFromTemplate(hr *v2.HelmRelease) *sourcev1.HelmChart {
-	template := hr.Spec.Chart
-	return &sourcev1.HelmChart{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      hr.GetHelmChartName(),
-			Namespace: hr.Spec.Chart.GetNamespace(hr.Namespace),
-		},
-		Spec: sourcev1.HelmChartSpec{
-			Chart:   template.Spec.Chart,
-			Version: template.Spec.Version,
-			SourceRef: sourcev1.LocalHelmChartSourceReference{
-				Name: template.Spec.SourceRef.Name,
-				Kind: template.Spec.SourceRef.Kind,
-			},
-			Interval:          template.GetInterval(hr.Spec.Interval),
-			ReconcileStrategy: template.Spec.ReconcileStrategy,
-			ValuesFiles:       template.Spec.ValuesFiles,
-			ValuesFile:        template.Spec.ValuesFile,
-			Verify:            templateVerificationToSourceVerification(template.Spec.Verify),
-		},
-	}
-}
-
-// helmChartRequiresUpdate compares the v2beta1.HelmChartTemplate of the
-// v2beta1.HelmRelease to the given v1beta2.HelmChart to determine if an
-// update is required.
-func helmChartRequiresUpdate(hr *v2.HelmRelease, chart *sourcev1.HelmChart) bool {
-	template := hr.Spec.Chart
-	switch {
-	case template.Spec.Chart != chart.Spec.Chart:
-		return true
-	// TODO(hidde): remove emptiness checks on next MINOR version
-	case template.Spec.Version == "" && chart.Spec.Version != "*",
-		template.Spec.Version != "" && template.Spec.Version != chart.Spec.Version:
-		return true
-	case template.Spec.SourceRef.Name != chart.Spec.SourceRef.Name:
-		return true
-	case template.Spec.SourceRef.Kind != chart.Spec.SourceRef.Kind:
-		return true
-	case template.GetInterval(hr.Spec.Interval) != chart.Spec.Interval:
-		return true
-	case template.Spec.ReconcileStrategy != chart.Spec.ReconcileStrategy:
-		return true
-	case !reflect.DeepEqual(template.Spec.ValuesFiles, chart.Spec.ValuesFiles):
-		return true
-	case template.Spec.ValuesFile != chart.Spec.ValuesFile:
-		return true
-	case !reflect.DeepEqual(templateVerificationToSourceVerification(template.Spec.Verify), chart.Spec.Verify):
-		return true
-	default:
-		return false
-	}
-}
-
-// templateVerificationToSourceVerification converts the HelmChartTemplateVerification to the OCIRepositoryVerification.
-func templateVerificationToSourceVerification(template *v2.HelmChartTemplateVerification) *sourcev1.OCIRepositoryVerification {
-	if template == nil {
-		return nil
-	}
-
-	return &sourcev1.OCIRepositoryVerification{
-		Provider:  template.Provider,
-		SecretRef: template.SecretRef,
-	}
-}

controllers/helmrelease_controller_chart_test.go

@@ -1,533 +0,0 @@
-/*
-Copyright 2020 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package controllers
-
-import (
-	"context"
-	"fmt"
-	"testing"
-	"time"
-
-	"github.com/fluxcd/pkg/apis/meta"
-	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
-	"github.com/go-logr/logr"
-	. "github.com/onsi/gomega"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/client-go/kubernetes/scheme"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/client/fake"
-
-	v2 "github.com/fluxcd/helm-controller/api/v2beta1"
-)
-
-func TestHelmReleaseReconciler_reconcileChart(t *testing.T) {
-	tests := []struct {
-		name                  string
-		hr                    *v2.HelmRelease
-		hc                    *sourcev1.HelmChart
-		expectHelmChartStatus string
-		expectGC              bool
-		expectErr             bool
-		noCrossNamspaceRef    bool
-	}{
-		{
-			name: "new HelmChart",
-			hr: &v2.HelmRelease{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-release",
-					Namespace: "default",
-				},
-				Spec: v2.HelmReleaseSpec{
-					Interval: metav1.Duration{Duration: time.Minute},
-					Chart: v2.HelmChartTemplate{
-						Spec: v2.HelmChartTemplateSpec{
-							Chart: "chart",
-							SourceRef: v2.CrossNamespaceObjectReference{
-								Name: "test-repository",
-								Kind: "HelmRepository",
-							},
-						},
-					},
-				},
-			},
-			hc:                    nil,
-			expectHelmChartStatus: "default/default-test-release",
-		},
-		{
-			name: "existing HelmChart",
-			hr: &v2.HelmRelease{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-release",
-					Namespace: "default",
-				},
-				Spec: v2.HelmReleaseSpec{
-					Interval: metav1.Duration{Duration: time.Minute},
-					Chart: v2.HelmChartTemplate{
-						Spec: v2.HelmChartTemplateSpec{
-							Chart: "chart",
-							SourceRef: v2.CrossNamespaceObjectReference{
-								Name: "test-repository",
-								Kind: "HelmRepository",
-							},
-						},
-					},
-				},
-			},
-			hc: &sourcev1.HelmChart{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "default-test-release",
-					Namespace: "default",
-				},
-				Spec: sourcev1.HelmChartSpec{
-					Chart: "chart",
-					SourceRef: sourcev1.LocalHelmChartSourceReference{
-						Name: "test-repository",
-						Kind: "HelmRepository",
-					},
-				},
-			},
-			expectHelmChartStatus: "default/default-test-release",
-		},
-		{
-			name: "modified HelmChart",
-			hr: &v2.HelmRelease{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-release",
-					Namespace: "default",
-				},
-				Spec: v2.HelmReleaseSpec{
-					Interval: metav1.Duration{Duration: time.Minute},
-					Chart: v2.HelmChartTemplate{
-						Spec: v2.HelmChartTemplateSpec{
-							Chart: "chart",
-							SourceRef: v2.CrossNamespaceObjectReference{
-								Name:      "test-repository",
-								Kind:      "HelmRepository",
-								Namespace: "cross",
-							},
-						},
-					},
-				},
-				Status: v2.HelmReleaseStatus{
-					HelmChart: "default/default-test-release",
-				},
-			},
-			hc: &sourcev1.HelmChart{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "default-test-release",
-					Namespace: "default",
-				},
-				Spec: sourcev1.HelmChartSpec{
-					Chart: "chart",
-					SourceRef: sourcev1.LocalHelmChartSourceReference{
-						Name: "test-repository",
-						Kind: "HelmRepository",
-					},
-				},
-			},
-			expectHelmChartStatus: "cross/default-test-release",
-			expectGC:              true,
-		},
-		{
-			name: "block cross namespace access when flag is set",
-			hr: &v2.HelmRelease{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-release",
-					Namespace: "default",
-				},
-				Spec: v2.HelmReleaseSpec{
-					Interval: metav1.Duration{Duration: time.Minute},
-					Chart: v2.HelmChartTemplate{
-						Spec: v2.HelmChartTemplateSpec{
-							Chart: "chart",
-							SourceRef: v2.CrossNamespaceObjectReference{
-								Name:      "test-repository",
-								Kind:      "HelmRepository",
-								Namespace: "cross",
-							},
-						},
-					},
-				},
-				Status: v2.HelmReleaseStatus{
-					HelmChart: "",
-				},
-			},
-			noCrossNamspaceRef: true,
-			expectErr:          true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			g := NewWithT(t)
-
-			g.Expect(v2.AddToScheme(scheme.Scheme)).To(Succeed())
-			g.Expect(sourcev1.AddToScheme(scheme.Scheme)).To(Succeed())
-
-			var c client.Client
-			if tt.hc != nil {
-				c = fake.NewFakeClientWithScheme(scheme.Scheme, tt.hc)
-			} else {
-				c = fake.NewFakeClientWithScheme(scheme.Scheme)
-			}
-
-			r := &HelmReleaseReconciler{
-				Client:              c,
-				NoCrossNamespaceRef: tt.noCrossNamspaceRef,
-			}
-
-			hc, err := r.reconcileChart(logr.NewContext(context.TODO(), logr.Discard()), tt.hr)
-			if tt.expectErr {
-				g.Expect(err).To(HaveOccurred())
-				g.Expect(hc).To(BeNil())
-			} else {
-				g.Expect(err).NotTo(HaveOccurred())
-				g.Expect(hc).NotTo(BeNil())
-			}
-
-			g.Expect(tt.hr.Status.HelmChart).To(Equal(tt.expectHelmChartStatus))
-
-			if tt.expectGC {
-				objKey := client.ObjectKeyFromObject(tt.hc)
-				err = c.Get(context.TODO(), objKey, tt.hc.DeepCopy())
-				g.Expect(apierrors.IsNotFound(err)).To(BeTrue())
-			}
-		})
-	}
-}
-
-func TestHelmReleaseReconciler_deleteHelmChart(t *testing.T) {
-	tests := []struct {
-		name                  string
-		hc                    *sourcev1.HelmChart
-		hr                    *v2.HelmRelease
-		expectHelmChartStatus string
-		expectErr             bool
-	}{
-		{
-			name: "delete existing HelmChart",
-			hc: &sourcev1.HelmChart{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test-chart",
-					Namespace: "default",
-				},
-			},
-			hr: &v2.HelmRelease{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-release",
-				},
-				Status: v2.HelmReleaseStatus{
-					HelmChart: "default/test-chart",
-				},
-			},
-			expectHelmChartStatus: "",
-			expectErr:             false,
-		},
-		{
-			name: "delete already removed HelmChart",
-			hc:   nil,
-			hr: &v2.HelmRelease{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-release",
-				},
-				Status: v2.HelmReleaseStatus{
-					HelmChart: "default/test-chart",
-				},
-			},
-			expectHelmChartStatus: "",
-			expectErr:             false,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			g := NewWithT(t)
-
-			g.Expect(v2.AddToScheme(scheme.Scheme)).To(Succeed())
-			g.Expect(sourcev1.AddToScheme(scheme.Scheme)).To(Succeed())
-
-			var c client.Client
-			if tt.hc != nil {
-				c = fake.NewFakeClientWithScheme(scheme.Scheme, tt.hc)
-			} else {
-				c = fake.NewFakeClientWithScheme(scheme.Scheme)
-			}
-
-			r := &HelmReleaseReconciler{
-				Client: c,
-			}
-
-			err := r.deleteHelmChart(context.TODO(), tt.hr)
-			if tt.expectErr {
-				g.Expect(err).To(HaveOccurred())
-			} else {
-				g.Expect(err).NotTo(HaveOccurred())
-			}
-			g.Expect(tt.hr.Status.HelmChart).To(Equal(tt.expectHelmChartStatus))
-		})
-	}
-}
-
-func Test_buildHelmChartFromTemplate(t *testing.T) {
-	hrWithChartTemplate := v2.HelmRelease{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "test-release",
-			Namespace: "default",
-		},
-		Spec: v2.HelmReleaseSpec{
-			Interval: metav1.Duration{Duration: time.Minute},
-			Chart: v2.HelmChartTemplate{
-				Spec: v2.HelmChartTemplateSpec{
-					Chart:   "chart",
-					Version: "1.0.0",
-					SourceRef: v2.CrossNamespaceObjectReference{
-						Name: "test-repository",
-						Kind: "HelmRepository",
-					},
-					Interval:    &metav1.Duration{Duration: 2 * time.Minute},
-					ValuesFiles: []string{"values.yaml"},
-				},
-			},
-		},
-	}
-
-	tests := []struct {
-		name   string
-		modify func(release *v2.HelmRelease)
-		want   *sourcev1.HelmChart
-	}{
-		{
-			name:   "builds HelmChart from HelmChartTemplate",
-			modify: func(*v2.HelmRelease) {},
-			want: &sourcev1.HelmChart{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "default-test-release",
-					Namespace: "default",
-				},
-				Spec: sourcev1.HelmChartSpec{
-					Chart:   "chart",
-					Version: "1.0.0",
-					SourceRef: sourcev1.LocalHelmChartSourceReference{
-						Name: "test-repository",
-						Kind: "HelmRepository",
-					},
-					Interval:    metav1.Duration{Duration: 2 * time.Minute},
-					ValuesFiles: []string{"values.yaml"},
-				},
-			},
-		},
-		{
-			name: "takes SourceRef namespace into account",
-			modify: func(hr *v2.HelmRelease) {
-				hr.Spec.Chart.Spec.SourceRef.Namespace = "cross"
-			},
-			want: &sourcev1.HelmChart{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "default-test-release",
-					Namespace: "cross",
-				},
-				Spec: sourcev1.HelmChartSpec{
-					Chart:   "chart",
-					Version: "1.0.0",
-					SourceRef: sourcev1.LocalHelmChartSourceReference{
-						Name: "test-repository",
-						Kind: "HelmRepository",
-					},
-					Interval:    metav1.Duration{Duration: 2 * time.Minute},
-					ValuesFiles: []string{"values.yaml"},
-				},
-			},
-		},
-		{
-			name: "falls back to HelmRelease interval",
-			modify: func(hr *v2.HelmRelease) {
-				hr.Spec.Chart.Spec.Interval = nil
-			},
-			want: &sourcev1.HelmChart{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "default-test-release",
-					Namespace: "default",
-				},
-				Spec: sourcev1.HelmChartSpec{
-					Chart:   "chart",
-					Version: "1.0.0",
-					SourceRef: sourcev1.LocalHelmChartSourceReference{
-						Name: "test-repository",
-						Kind: "HelmRepository",
-					},
-					Interval:    metav1.Duration{Duration: time.Minute},
-					ValuesFiles: []string{"values.yaml"},
-				},
-			},
-		},
-		{
-			name: "take cosign verification into account",
-			modify: func(hr *v2.HelmRelease) {
-				hr.Spec.Chart.Spec.Verify = &v2.HelmChartTemplateVerification{
-					Provider: "cosign",
-					SecretRef: &meta.LocalObjectReference{
-						Name: "cosign-key",
-					},
-				}
-			},
-			want: &sourcev1.HelmChart{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "default-test-release",
-					Namespace: "default",
-				},
-				Spec: sourcev1.HelmChartSpec{
-					Chart:   "chart",
-					Version: "1.0.0",
-					SourceRef: sourcev1.LocalHelmChartSourceReference{
-						Name: "test-repository",
-						Kind: "HelmRepository",
-					},
-					Interval:    metav1.Duration{Duration: 2 * time.Minute},
-					ValuesFiles: []string{"values.yaml"},
-					Verify: &sourcev1.OCIRepositoryVerification{
-						Provider: "cosign",
-						SecretRef: &meta.LocalObjectReference{
-							Name: "cosign-key",
-						},
-					},
-				},
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			g := NewWithT(t)
-			hr := hrWithChartTemplate.DeepCopy()
-			tt.modify(hr)
-			g.Expect(buildHelmChartFromTemplate(hr)).To(Equal(tt.want))
-		})
-	}
-}
-
-func Test_helmChartRequiresUpdate(t *testing.T) {
-	hrWithChartTemplate := v2.HelmRelease{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: "test-release",
-		},
-		Spec: v2.HelmReleaseSpec{
-			Interval: metav1.Duration{Duration: time.Minute},
-			Chart: v2.HelmChartTemplate{
-				Spec: v2.HelmChartTemplateSpec{
-					Chart:   "chart",
-					Version: "1.0.0",
-					SourceRef: v2.CrossNamespaceObjectReference{
-						Name: "test-repository",
-						Kind: "HelmRepository",
-					},
-					Interval: &metav1.Duration{Duration: 2 * time.Minute},
-					Verify: &v2.HelmChartTemplateVerification{
-						Provider: "cosign",
-					},
-				},
-			},
-		},
-	}
-
-	tests := []struct {
-		name   string
-		modify func(*v2.HelmRelease, *sourcev1.HelmChart)
-		want   bool
-	}{
-		{
-			name:   "detects no change",
-			modify: func(*v2.HelmRelease, *sourcev1.HelmChart) {},
-			want:   false,
-		},
-		{
-			name: "detects chart change",
-			modify: func(hr *v2.HelmRelease, hc *sourcev1.HelmChart) {
-				hr.Spec.Chart.Spec.Chart = "new"
-			},
-			want: true,
-		},
-		{
-			name: "detects version change",
-			modify: func(hr *v2.HelmRelease, hc *sourcev1.HelmChart) {
-				hr.Spec.Chart.Spec.Version = "2.0.0"
-			},
-			want: true,
-		},
-		{
-			name: "detects chart source name change",
-			modify: func(hr *v2.HelmRelease, hc *sourcev1.HelmChart) {
-				hr.Spec.Chart.Spec.SourceRef.Name = "new"
-			},
-			want: true,
-		},
-		{
-			name: "detects chart source kind change",
-			modify: func(hr *v2.HelmRelease, hc *sourcev1.HelmChart) {
-				hr.Spec.Chart.Spec.SourceRef.Kind = "GitRepository"
-			},
-			want: true,
-		},
-		{
-			name: "detects interval change",
-			modify: func(hr *v2.HelmRelease, hc *sourcev1.HelmChart) {
-				hr.Spec.Chart.Spec.Interval = nil
-			},
-			want: true,
-		},
-		{
-			name: "detects reconcile strategy change",
-			modify: func(hr *v2.HelmRelease, hc *sourcev1.HelmChart) {
-				hr.Spec.Chart.Spec.ReconcileStrategy = "Revision"
-			},
-			want: true,
-		},
-		{
-			name: "detects values files change",
-			modify: func(hr *v2.HelmRelease, hc *sourcev1.HelmChart) {
-				hr.Spec.Chart.Spec.ValuesFiles = []string{"values-prod.yaml"}
-			},
-			want: true,
-		},
-		{
-			name: "detects values file change",
-			modify: func(hr *v2.HelmRelease, hc *sourcev1.HelmChart) {
-				hr.Spec.Chart.Spec.ValuesFile = "values-prod.yaml"
-			},
-			want: true,
-		},
-		{
-			name: "detects verify change",
-			modify: func(hr *v2.HelmRelease, hc *sourcev1.HelmChart) {
-				hr.Spec.Chart.Spec.Verify.Provider = "foo-bar"
-			},
-			want: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			g := NewWithT(t)
-
-			hr := hrWithChartTemplate.DeepCopy()
-			hc := buildHelmChartFromTemplate(hr)
-			// second copy to avoid modifying the original
-			hr = hrWithChartTemplate.DeepCopy()
-			g.Expect(helmChartRequiresUpdate(hr, hc)).To(Equal(false))
-
-			tt.modify(hr, hc)
-			fmt.Println("verify", hr.Spec.Chart.Spec.Verify.Provider, hc.Spec.Verify.Provider)
-			g.Expect(helmChartRequiresUpdate(hr, hc)).To(Equal(tt.want))
-		})
-	}
-}

controllers/helmrelease_controller_test.go

@@ -1,685 +0,0 @@
-/*
-Copyright 2020 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package controllers
-
-import (
-	"context"
-	"reflect"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/go-logr/logr"
-	"helm.sh/helm/v3/pkg/chartutil"
-	corev1 "k8s.io/api/core/v1"
-	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/client/fake"
-	"sigs.k8s.io/yaml"
-
-	v2 "github.com/fluxcd/helm-controller/api/v2beta1"
-	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
-)
-
-func TestHelmReleaseReconciler_composeValues(t *testing.T) {
-	scheme := runtime.NewScheme()
-	_ = corev1.AddToScheme(scheme)
-	_ = v2.AddToScheme(scheme)
-
-	tests := []struct {
-		name       string
-		resources  []runtime.Object
-		references []v2.ValuesReference
-		values     string
-		want       chartutil.Values
-		wantErr    bool
-	}{
-		{
-			name: "merges",
-			resources: []runtime.Object{
-				valuesConfigMap("values", map[string]string{
-					"values.yaml": `flat: value
-nested:
-  configuration: value
-`,
-				}),
-				valuesSecret("values", map[string][]byte{
-					"values.yaml": []byte(`flat:
-  nested: value
-nested: value
-`),
-				}),
-			},
-			references: []v2.ValuesReference{
-				{
-					Kind: "ConfigMap",
-					Name: "values",
-				},
-				{
-					Kind: "Secret",
-					Name: "values",
-				},
-			},
-			values: `
-other: values
-`,
-			want: chartutil.Values{
-				"flat": map[string]interface{}{
-					"nested": "value",
-				},
-				"nested": "value",
-				"other":  "values",
-			},
-		},
-		{
-			name: "target path",
-			resources: []runtime.Object{
-				valuesSecret("values", map[string][]byte{"single": []byte("value")}),
-			},
-			references: []v2.ValuesReference{
-				{
-					Kind:       "Secret",
-					Name:       "values",
-					ValuesKey:  "single",
-					TargetPath: "merge.at.specific.path",
-				},
-			},
-			want: chartutil.Values{
-				"merge": map[string]interface{}{
-					"at": map[string]interface{}{
-						"specific": map[string]interface{}{
-							"path": "value",
-						},
-					},
-				},
-			},
-		},
-		{
-			name: "target path with boolean value",
-			resources: []runtime.Object{
-				valuesSecret("values", map[string][]byte{"single": []byte("true")}),
-			},
-			references: []v2.ValuesReference{
-				{
-					Kind:       "Secret",
-					Name:       "values",
-					ValuesKey:  "single",
-					TargetPath: "merge.at.specific.path",
-				},
-			},
-			want: chartutil.Values{
-				"merge": map[string]interface{}{
-					"at": map[string]interface{}{
-						"specific": map[string]interface{}{
-							"path": true,
-						},
-					},
-				},
-			},
-		},
-		{
-			name: "target path with set-string behavior",
-			resources: []runtime.Object{
-				valuesSecret("values", map[string][]byte{"single": []byte("\"true\"")}),
-			},
-			references: []v2.ValuesReference{
-				{
-					Kind:       "Secret",
-					Name:       "values",
-					ValuesKey:  "single",
-					TargetPath: "merge.at.specific.path",
-				},
-			},
-			want: chartutil.Values{
-				"merge": map[string]interface{}{
-					"at": map[string]interface{}{
-						"specific": map[string]interface{}{
-							"path": "true",
-						},
-					},
-				},
-			},
-		},
-		{
-			name: "values reference to non existing secret",
-			references: []v2.ValuesReference{
-				{
-					Kind: "Secret",
-					Name: "missing",
-				},
-			},
-			wantErr: true,
-		},
-		{
-			name: "optional values reference to non existing secret",
-			references: []v2.ValuesReference{
-				{
-					Kind:     "Secret",
-					Name:     "missing",
-					Optional: true,
-				},
-			},
-			want:    chartutil.Values{},
-			wantErr: false,
-		},
-		{
-			name: "values reference to non existing config map",
-			references: []v2.ValuesReference{
-				{
-					Kind: "ConfigMap",
-					Name: "missing",
-				},
-			},
-			wantErr: true,
-		},
-		{
-			name: "optional values reference to non existing config map",
-			references: []v2.ValuesReference{
-				{
-					Kind:     "ConfigMap",
-					Name:     "missing",
-					Optional: true,
-				},
-			},
-			want:    chartutil.Values{},
-			wantErr: false,
-		},
-		{
-			name: "missing secret key",
-			resources: []runtime.Object{
-				valuesSecret("values", nil),
-			},
-			references: []v2.ValuesReference{
-				{
-					Kind:      "Secret",
-					Name:      "values",
-					ValuesKey: "nonexisting",
-				},
-			},
-			wantErr: true,
-		},
-		{
-			name: "missing config map key",
-			resources: []runtime.Object{
-				valuesConfigMap("values", nil),
-			},
-			references: []v2.ValuesReference{
-				{
-					Kind:      "ConfigMap",
-					Name:      "values",
-					ValuesKey: "nonexisting",
-				},
-			},
-			wantErr: true,
-		},
-		{
-			name: "unsupported values reference kind",
-			references: []v2.ValuesReference{
-				{
-					Kind: "Unsupported",
-				},
-			},
-			wantErr: true,
-		},
-		{
-			name: "invalid values",
-			resources: []runtime.Object{
-				valuesConfigMap("values", map[string]string{
-					"values.yaml": `
-invalid`,
-				}),
-			},
-			references: []v2.ValuesReference{
-				{
-					Kind: "ConfigMap",
-					Name: "values",
-				},
-			},
-			wantErr: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			c := fake.NewFakeClientWithScheme(scheme, tt.resources...)
-			r := &HelmReleaseReconciler{Client: c}
-			var values *apiextensionsv1.JSON
-			if tt.values != "" {
-				v, _ := yaml.YAMLToJSON([]byte(tt.values))
-				values = &apiextensionsv1.JSON{Raw: v}
-			}
-			hr := v2.HelmRelease{
-				Spec: v2.HelmReleaseSpec{
-					ValuesFrom: tt.references,
-					Values:     values,
-				},
-			}
-			got, err := r.composeValues(logr.NewContext(context.TODO(), logr.Discard()), hr)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("composeValues() error = %v, wantErr %v", err, tt.wantErr)
-				return
-			}
-			if !reflect.DeepEqual(got, tt.want) {
-				t.Errorf("composeValues() got = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestValuesReferenceValidation(t *testing.T) {
-	tests := []struct {
-		name       string
-		references []v2.ValuesReference
-		wantErr    bool
-	}{
-		{
-			name: "valid ValuesKey",
-			references: []v2.ValuesReference{
-				{
-					Kind:      "Secret",
-					Name:      "values",
-					ValuesKey: "any-key_na.me",
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "valid ValuesKey: empty",
-			references: []v2.ValuesReference{
-				{
-					Kind:      "Secret",
-					Name:      "values",
-					ValuesKey: "",
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "valid ValuesKey: long",
-			references: []v2.ValuesReference{
-				{
-					Kind:      "Secret",
-					Name:      "values",
-					ValuesKey: strings.Repeat("a", 253),
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "invalid ValuesKey",
-			references: []v2.ValuesReference{
-				{
-					Kind:      "Secret",
-					Name:      "values",
-					ValuesKey: "a($&^%b",
-				},
-			},
-			wantErr: true,
-		},
-		{
-			name: "invalid ValuesKey: too long",
-			references: []v2.ValuesReference{
-				{
-					Kind:      "Secret",
-					Name:      "values",
-					ValuesKey: strings.Repeat("a", 254),
-				},
-			},
-			wantErr: true,
-		},
-		{
-			name: "valid target path: empty",
-			references: []v2.ValuesReference{
-				{
-					Kind:       "Secret",
-					Name:       "values",
-					TargetPath: "",
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "valid target path",
-			references: []v2.ValuesReference{
-				{
-					Kind:       "Secret",
-					Name:       "values",
-					TargetPath: "list_with.nested-values.and.index[0]",
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "valid target path: long",
-			references: []v2.ValuesReference{
-				{
-					Kind:       "Secret",
-					Name:       "values",
-					TargetPath: strings.Repeat("a", 250),
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "invalid target path: too long",
-			references: []v2.ValuesReference{
-				{
-					Kind:       "Secret",
-					Name:       "values",
-					TargetPath: strings.Repeat("a", 251),
-				},
-			},
-			wantErr: true,
-		},
-		{
-			name: "invalid target path: opened index",
-			references: []v2.ValuesReference{
-				{
-					Kind:       "Secret",
-					Name:       "values",
-					ValuesKey:  "single",
-					TargetPath: "a[",
-				},
-			},
-			wantErr: true,
-		},
-		{
-			name: "invalid target path: incorrect index syntax",
-			references: []v2.ValuesReference{
-				{
-					Kind:       "Secret",
-					Name:       "values",
-					ValuesKey:  "single",
-					TargetPath: "a]0[",
-				},
-			},
-			wantErr: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			var values *apiextensionsv1.JSON
-			v, _ := yaml.YAMLToJSON([]byte("values"))
-			values = &apiextensionsv1.JSON{Raw: v}
-
-			hr := v2.HelmRelease{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "test",
-					Namespace: "default",
-				},
-				Spec: v2.HelmReleaseSpec{
-					Interval: metav1.Duration{Duration: 5 * time.Minute},
-					Chart: v2.HelmChartTemplate{
-						Spec: v2.HelmChartTemplateSpec{
-							SourceRef: v2.CrossNamespaceObjectReference{
-								Name: "something",
-							},
-						},
-					},
-					ValuesFrom: tt.references,
-					Values:     values,
-				},
-			}
-
-			err := k8sClient.Create(context.TODO(), &hr, client.DryRunAll)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("composeValues() error = %v, wantErr %v", err, tt.wantErr)
-				return
-			}
-		})
-	}
-}
-
-func FuzzHelmReleaseReconciler_composeValues(f *testing.F) {
-	scheme := testScheme()
-
-	tests := []struct {
-		targetPath   string
-		valuesKey    string
-		hrValues     string
-		createObject bool
-		secretData   []byte
-		configData   string
-	}{
-		{
-			targetPath: "flat",
-			valuesKey:  "custom-values.yaml",
-			secretData: []byte(`flat:
-  nested: value
-nested: value
-`),
-			configData: `flat: value
-nested:
-  configuration: value
-`,
-			hrValues: `
-other: values
-`,
-			createObject: true,
-		},
-		{
-			targetPath: "'flat'",
-			valuesKey:  "custom-values.yaml",
-			secretData: []byte(`flat:
-  nested: value
-nested: value
-`),
-			configData: `flat: value
-nested:
-  configuration: value
-`,
-			hrValues: `
-other: values
-`,
-			createObject: true,
-		},
-		{
-			targetPath: "flat[0]",
-			secretData: []byte(``),
-			configData: `flat: value`,
-			hrValues: `
-other: values
-`,
-			createObject: true,
-		},
-		{
-			secretData: []byte(`flat:
-  nested: value
-nested: value
-`),
-			configData: `flat: value
-nested:
-  configuration: value
-`,
-			hrValues: `
-other: values
-`,
-			createObject: true,
-		},
-		{
-			targetPath: "some-value",
-			hrValues: `
-other: values
-`,
-			createObject: false,
-		},
-	}
-
-	for _, tt := range tests {
-		f.Add(tt.targetPath, tt.valuesKey, tt.hrValues, tt.createObject, tt.secretData, tt.configData)
-	}
-
-	f.Fuzz(func(t *testing.T,
-		targetPath, valuesKey, hrValues string, createObject bool, secretData []byte, configData string) {
-
-		// objectName represents a core Kubernetes name (Secret/ConfigMap) which is validated
-		// upstream, and also validated by us in the OpenAPI-based validation set in
-		// v2.ValuesReference. Therefore a static value here suffices, and instead we just
-		// play with the objects presence/absence.
-		objectName := "values"
-		resources := []runtime.Object{}
-
-		if createObject {
-			resources = append(resources,
-				valuesConfigMap(objectName, map[string]string{valuesKey: configData}),
-				valuesSecret(objectName, map[string][]byte{valuesKey: secretData}),
-			)
-		}
-
-		references := []v2.ValuesReference{
-			{
-				Kind:       "ConfigMap",
-				Name:       objectName,
-				ValuesKey:  valuesKey,
-				TargetPath: targetPath,
-			},
-			{
-				Kind:       "Secret",
-				Name:       objectName,
-				ValuesKey:  valuesKey,
-				TargetPath: targetPath,
-			},
-		}
-
-		c := fake.NewFakeClientWithScheme(scheme, resources...)
-		r := &HelmReleaseReconciler{Client: c}
-		var values *apiextensionsv1.JSON
-		if hrValues != "" {
-			v, _ := yaml.YAMLToJSON([]byte(hrValues))
-			values = &apiextensionsv1.JSON{Raw: v}
-		}
-
-		hr := v2.HelmRelease{
-			Spec: v2.HelmReleaseSpec{
-				ValuesFrom: references,
-				Values:     values,
-			},
-		}
-
-		// OpenAPI-based validation on schema is not verified here.
-		// Therefore some false positives may be arise, as the apiserver
-		// would not allow such values to make their way into the control plane.
-		//
-		// Testenv could be used so the fuzzing covers the entire E2E.
-		// The downsize being the resource and time cost per test would be a lot higher.
-		//
-		// Another approach could be to add validation to reject invalid inputs before
-		// the r.composeValues call.
-		_, _ = r.composeValues(logr.NewContext(context.TODO(), logr.Discard()), hr)
-	})
-}
-
-func FuzzHelmReleaseReconciler_reconcile(f *testing.F) {
-	scheme := testScheme()
-	tests := []struct {
-		valuesKey  string
-		hrValues   string
-		secretData []byte
-		configData string
-	}{
-		{
-			valuesKey: "custom-values.yaml",
-			secretData: []byte(`flat:
-  nested: value
-nested: value
-`),
-			configData: `flat: value
-nested:
-  configuration: value
-`,
-			hrValues: `
-other: values
-`,
-		},
-	}
-
-	for _, tt := range tests {
-		f.Add(tt.valuesKey, tt.hrValues, tt.secretData, tt.configData)
-	}
-
-	f.Fuzz(func(t *testing.T,
-		valuesKey, hrValues string, secretData []byte, configData string) {
-
-		var values *apiextensionsv1.JSON
-		if hrValues != "" {
-			v, _ := yaml.YAMLToJSON([]byte(hrValues))
-			values = &apiextensionsv1.JSON{Raw: v}
-		}
-
-		hr := v2.HelmRelease{
-			Spec: v2.HelmReleaseSpec{
-				Values: values,
-			},
-		}
-
-		hc := sourcev1.HelmChart{}
-		hc.ObjectMeta.Name = hr.GetHelmChartName()
-		hc.ObjectMeta.Namespace = hr.Spec.Chart.GetNamespace(hr.Namespace)
-
-		resources := []runtime.Object{
-			valuesConfigMap("values", map[string]string{valuesKey: configData}),
-			valuesSecret("values", map[string][]byte{valuesKey: secretData}),
-			&hc,
-		}
-
-		c := fake.NewFakeClientWithScheme(scheme, resources...)
-		r := &HelmReleaseReconciler{
-			Client:        c,
-			EventRecorder: &DummyRecorder{},
-		}
-
-		_, _, _ = r.reconcile(logr.NewContext(context.TODO(), logr.Discard()), hr)
-	})
-}
-
-func valuesSecret(name string, data map[string][]byte) *corev1.Secret {
-	return &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: name},
-		Data:       data,
-	}
-}
-
-func valuesConfigMap(name string, data map[string]string) *corev1.ConfigMap {
-	return &corev1.ConfigMap{
-		ObjectMeta: metav1.ObjectMeta{Name: name},
-		Data:       data,
-	}
-}
-
-func testScheme() *runtime.Scheme {
-	scheme := runtime.NewScheme()
-	_ = corev1.AddToScheme(scheme)
-	_ = v2.AddToScheme(scheme)
-	_ = sourcev1.AddToScheme(scheme)
-	return scheme
-}
-
-// DummyRecorder serves as a dummy for kuberecorder.EventRecorder.
-type DummyRecorder struct{}
-
-func (r *DummyRecorder) Event(object runtime.Object, eventtype, reason, message string) {
-}
-
-func (r *DummyRecorder) Eventf(object runtime.Object, eventtype, reason, messageFmt string, args ...interface{}) {
-}
-
-func (r *DummyRecorder) AnnotatedEventf(object runtime.Object, annotations map[string]string,
-	eventtype, reason string, messageFmt string, args ...interface{}) {
-}

controllers/suite_test.go

@@ -1,64 +0,0 @@
-/*
-Copyright 2020 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package controllers
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"testing"
-
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	"k8s.io/client-go/kubernetes/scheme"
-	"k8s.io/client-go/rest"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/envtest"
-
-	"github.com/fluxcd/helm-controller/api/v2beta1"
-	// +kubebuilder:scaffold:imports
-)
-
-var cfg *rest.Config
-var k8sClient client.Client
-var testEnv *envtest.Environment
-
-func TestMain(m *testing.M) {
-	testEnv = &envtest.Environment{
-		CRDDirectoryPaths: []string{filepath.Join("..", "config", "crd", "bases")},
-	}
-
-	var err error
-	cfg, err = testEnv.Start()
-	if err != nil {
-		panic(fmt.Errorf("failed to start testenv: %v", err))
-	}
-
-	utilruntime.Must(v2beta1.AddToScheme(scheme.Scheme))
-	k8sClient, err = client.New(cfg, client.Options{Scheme: scheme.Scheme})
-	if err != nil {
-		panic(fmt.Errorf("failed to create k8s client: %v", err))
-	}
-
-	code := m.Run()
-
-	err = testEnv.Stop()
-	if err != nil {
-		panic(fmt.Errorf("failed to stop testenv: %v", err))
-	}
-
-	os.Exit(code)
-}

docs/api/v2beta1/helm.md

@@ -1,4 +1,4 @@
-<h1>HelmRelease API reference</h1>
+<h1>Helm API reference v2beta1</h1>
 <p>Packages:</p>
 <ul class="simple">
 <li>
@@ -92,15 +92,17 @@ Kubernetes meta/v1.Duration
 </em>
 </td>
 <td>
-<p>Interval at which to reconcile the Helm release.</p>
+<p>Interval at which to reconcile the Helm release.
+This interval is approximate and may be subject to jitter to ensure
+efficient use of resources.</p>
 </td>
 </tr>
 <tr>
 <td>
 <code>kubeConfig</code><br>
 <em>
-<a href="#helm.toolkit.fluxcd.io/v2beta1.KubeConfig">
-KubeConfig
+<a href="https://godoc.org/github.com/fluxcd/pkg/apis/meta#KubeConfigReference">
+github.com/fluxcd/pkg/apis/meta.KubeConfigReference
 </a>
 </em>
 </td>
@@ -226,6 +228,26 @@ when reconciling this HelmRelease.</p>
 </tr>
 <tr>
 <td>
+<code>persistentClient</code><br>
+<em>
+bool
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>PersistentClient tells the controller to use a persistent Kubernetes
+client for this release. When enabled, the client will be reused for the
+duration of the reconciliation, instead of being created and destroyed
+for each (step of a) Helm action.</p>
+<p>This can improve performance, but may cause issues with some Helm charts
+that for example do create Custom Resource Definitions during installation
+outside Helm&rsquo;s CRD lifecycle hooks, which are then not observed to be
+available by e.g. post-install hooks.</p>
+<p>If not set, it defaults to true.</p>
+</td>
+</tr>
+<tr>
+<td>
 <code>install</code><br>
 <em>
 <a href="#helm.toolkit.fluxcd.io/v2beta1.Install">
@@ -457,6 +479,20 @@ v1beta2.Source.</p>
 <tbody>
 <tr>
 <td>
+<code>metadata</code><br>
+<em>
+<a href="#helm.toolkit.fluxcd.io/v2beta1.HelmChartTemplateObjectMeta">
+HelmChartTemplateObjectMeta
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>ObjectMeta holds the template for metadata like labels and annotations.</p>
+</td>
+</tr>
+<tr>
+<td>
 <code>spec</code><br>
 <em>
 <a href="#helm.toolkit.fluxcd.io/v2beta1.HelmChartTemplateSpec">
@@ -591,6 +627,57 @@ Chart dependencies, which are not bundled in the umbrella chart artifact, are no
 </table>
 </div>
 </div>
+<h3 id="helm.toolkit.fluxcd.io/v2beta1.HelmChartTemplateObjectMeta">HelmChartTemplateObjectMeta
+</h3>
+<p>
+(<em>Appears on:</em>
+<a href="#helm.toolkit.fluxcd.io/v2beta1.HelmChartTemplate">HelmChartTemplate</a>)
+</p>
+<p>HelmChartTemplateObjectMeta defines the template for the ObjectMeta of a
+v1beta2.HelmChart.</p>
+<div class="md-typeset__scrollwrap">
+<div class="md-typeset__table">
+<table>
+<thead>
+<tr>
+<th>Field</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>
+<code>labels</code><br>
+<em>
+map[string]string
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>Map of string keys and values that can be used to organize and categorize
+(scope and select) objects.
+More info: <a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/">https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/</a></p>
+</td>
+</tr>
+<tr>
+<td>
+<code>annotations</code><br>
+<em>
+map[string]string
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>Annotations is an unstructured key value map stored with a resource that may be
+set by external tools to store and retrieve arbitrary metadata. They are not
+queryable and should be preserved when modifying objects.
+More info: <a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/">https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/</a></p>
+</td>
+</tr>
+</tbody>
+</table>
+</div>
+</div>
 <h3 id="helm.toolkit.fluxcd.io/v2beta1.HelmChartTemplateSpec">HelmChartTemplateSpec
 </h3>
 <p>
@@ -816,15 +903,17 @@ Kubernetes meta/v1.Duration
 </em>
 </td>
 <td>
-<p>Interval at which to reconcile the Helm release.</p>
+<p>Interval at which to reconcile the Helm release.
+This interval is approximate and may be subject to jitter to ensure
+efficient use of resources.</p>
 </td>
 </tr>
 <tr>
 <td>
 <code>kubeConfig</code><br>
 <em>
-<a href="#helm.toolkit.fluxcd.io/v2beta1.KubeConfig">
-KubeConfig
+<a href="https://godoc.org/github.com/fluxcd/pkg/apis/meta#KubeConfigReference">
+github.com/fluxcd/pkg/apis/meta.KubeConfigReference
 </a>
 </em>
 </td>
@@ -950,6 +1039,26 @@ when reconciling this HelmRelease.</p>
 </tr>
 <tr>
 <td>
+<code>persistentClient</code><br>
+<em>
+bool
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>PersistentClient tells the controller to use a persistent Kubernetes
+client for this release. When enabled, the client will be reused for the
+duration of the reconciliation, instead of being created and destroyed
+for each (step of a) Helm action.</p>
+<p>This can improve performance, but may cause issues with some Helm charts
+that for example do create Custom Resource Definitions during installation
+outside Helm&rsquo;s CRD lifecycle hooks, which are then not observed to be
+available by e.g. post-install hooks.</p>
+<p>If not set, it defaults to true.</p>
+</td>
+</tr>
+<tr>
+<td>
 <code>install</code><br>
 <em>
 <a href="#helm.toolkit.fluxcd.io/v2beta1.Install">
@@ -1460,48 +1569,6 @@ no retries remain. Defaults to &lsquo;false&rsquo;.</p>
 </table>
 </div>
 </div>
-<h3 id="helm.toolkit.fluxcd.io/v2beta1.KubeConfig">KubeConfig
-</h3>
-<p>
-(<em>Appears on:</em>
-<a href="#helm.toolkit.fluxcd.io/v2beta1.HelmReleaseSpec">HelmReleaseSpec</a>)
-</p>
-<p>KubeConfig references a Kubernetes secret that contains a kubeconfig file.</p>
-<div class="md-typeset__scrollwrap">
-<div class="md-typeset__table">
-<table>
-<thead>
-<tr>
-<th>Field</th>
-<th>Description</th>
-</tr>
-</thead>
-<tbody>
-<tr>
-<td>
-<code>secretRef</code><br>
-<em>
-<a href="https://godoc.org/github.com/fluxcd/pkg/apis/meta#SecretKeyReference">
-github.com/fluxcd/pkg/apis/meta.SecretKeyReference
-</a>
-</em>
-</td>
-<td>
-<p>SecretRef holds the name to a secret that contains a key with
-the kubeconfig file as the value. If no key is specified the key will
-default to &lsquo;value&rsquo;. The secret must be in the same namespace as
-the HelmRelease.
-It is recommended that the kubeconfig is self-contained, and the secret
-is regularly updated if credentials such as a cloud-access-token expire.
-Cloud specific <code>cmd-path</code> auth helpers will not function without adding
-binaries and credentials to the Pod that is responsible for reconciling
-the HelmRelease.</p>
-</td>
-</tr>
-</tbody>
-</table>
-</div>
-</div>
 <h3 id="helm.toolkit.fluxcd.io/v2beta1.Kustomize">Kustomize
 </h3>
 <p>
@@ -1877,6 +1944,19 @@ bool
 a Helm uninstall is performed.</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>deletionPropagation</code><br>
+<em>
+string
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>DeletionPropagation specifies the deletion propagation policy when
+a Helm uninstall is performed.</p>
+</td>
+</tr>
 </tbody>
 </table>
 </div>

docs/spec/README.md

@@ -35,6 +35,7 @@ actions that should be (conditionally) executed. Based on this the reconciler:
 - performs a Helm install or upgrade action if needed
 - performs a Helm test action if enabled
 - performs a reconciliation strategy (rollback, uninstall) and retries as configured if any Helm action failed
+- performs in cluster drift detection and correction if enabled
 
 The controller that runs these Helm actions relies on [source-controller](https://github.com/fluxcd/source-controller)
 for providing the Helm charts from Helm repositories or any other source that source-controller
@@ -50,7 +51,7 @@ trigger a Helm uninstall.
 Alerting can be configured with a Kubernetes custom resource that specifies a webhook address, and a
 group of `HelmRelease` resources to be monitored using the [notification-controller](https://github.com/fluxcd/notification-controller).
 
-The API design of the controller can be found at [helm.toolkit.fluxcd.io/v2beta1](./v2beta1/helmreleases.md).
+The API design of the controller can be found at [helm.toolkit.fluxcd.io/v2](./v2/helmreleases.md).
 
 ## Backward compatibility
 

docs/spec/v2/README.md

@@ -0,0 +1,16 @@
+# helm.toolkit.fluxcd.io/v2
+
+This is the v2 API specification for declaratively managing Helm chart
+releases with Kubernetes manifests.
+
+## Specification
+
+- [HelmRelease CRD](helmreleases.md)
+  + [Example](helmreleases.md#example)
+  + [Writing a HelmRelease spec](helmreleases.md#writing-a-helmrelease-spec)
+  + [Working with HelmReleases](helmreleases.md#working-with-helmreleases)
+  + [HelmRelease Status](helmreleases.md#helmrelease-status)
+
+## Implementation
+
+* [helm-controller](https://github.com/fluxcd/helm-controller/)

docs/spec/v2alpha1/helmreleases.md

@@ -809,7 +809,7 @@ spec:
 
 When the controller completes a reconciliation, it reports the result in the status sub-resource.
 
-The following `status.condtions` types are advertised. Here, "desired state" is as detailed in
+The following `status.conditions` types are advertised. Here, "desired state" is as detailed in
 [reconciliation](#reconciliation):
 
 * `Ready` - status of the last reconciliation attempt

docs/spec/v2beta1/helmreleases.md

@@ -1,5 +1,7 @@
 # Helm Releases
 
+<!-- menuweight:20 -->
+
 The `HelmRelease` API defines a resource for automated controller driven Helm releases.
 
 ## Specification
@@ -18,6 +20,8 @@ type HelmReleaseSpec struct {
 	Chart HelmChartTemplate `json:"chart"`
 
 	// Interval at which to reconcile the Helm release.
+	// This interval is approximate and may be subject to jitter to ensure
+	// efficient use of resources.
 	// +required
 	Interval metav1.Duration `json:"interval"`
 
@@ -66,6 +70,21 @@ type HelmReleaseSpec struct {
 	// +optional
 	MaxHistory *int `json:"maxHistory,omitempty"`
 
+	// PersistentClient tells the controller to use a persistent Kubernetes
+	// client for this release. When enabled, the client will be reused for the
+	// duration of the reconciliation, instead of being created and destroyed
+	// for each (step of a) Helm action.
+	//
+	// This can improve performance, but may cause issues with some Helm charts
+	// that for example do create Custom Resource Definitions during installation
+	// outside Helm's CRD lifecycle hooks, which are then not observed to be
+	// available by e.g. post-install hooks.
+	//
+	// If not set, it defaults to true.
+	//
+	// +optional
+	PersistentClient *bool `json:"persistentClient,omitempty"`
+
 	// Install holds the configuration for Helm install actions for this HelmRelease.
 	// +optional
 	Install *Install `json:"install,omitempty"`
@@ -134,11 +153,32 @@ type KubeConfig struct {
 // generate a v1beta1.HelmChart object in the same namespace as the referenced
 // v1beta1.Source.
 type HelmChartTemplate struct {
+	// ObjectMeta holds the template for metadata like labels and annotations.
+	// +optional
+	ObjectMeta *HelmChartTemplateObjectMeta `json:"metadata,omitempty"`
+
 	// Spec holds the template for the v1beta1.HelmChartSpec for this HelmRelease.
 	// +required
 	Spec HelmChartTemplateSpec `json:"spec"`
 }
 
+// HelmChartTemplateObjectMeta defines the template for the ObjectMeta of a
+// v1beta2.HelmChart.
+type HelmChartTemplateObjectMeta struct {
+	// Map of string keys and values that can be used to organize and categorize
+	// (scope and select) objects.
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
+	// +optional
+	Labels map[string]string `json:"labels,omitempty"`
+
+	// Annotations is an unstructured key value map stored with a resource that may be
+	// set by external tools to store and retrieve arbitrary metadata. They are not
+	// queryable and should be preserved when modifying objects.
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+	// +optional
+	Annotations map[string]string `json:"annotations,omitempty"`
+}
+
 // HelmChartTemplateSpec defines the template from which the controller will
 // generate a v1beta1.HelmChartSpec object.
 type HelmChartTemplateSpec struct {
@@ -444,6 +484,13 @@ type Uninstall struct {
 	// a Helm uninstall is performed.
 	// +optional
 	DisableWait bool `json:"disableWait,omitempty"`
+
+	// DeletionPropagation specifies the deletion propagation policy when
+	// a Helm uninstall is performed.
+	// +kubebuilder:default=background
+	// +kubebuilder:validation:Enum=background;foreground;orphan
+	// +optional
+	DeletionPropagation *string `json:"deletionPropagation,omitempty"`
 }
 
 // Kustomize Helm PostRenderer specification.
@@ -681,7 +728,7 @@ of the `HelmRelease`. These can be overridden respectively via `spec.targetNames
 
 ## Helm chart template
 
-The `spec.chart.spec` values are used by the helm-controller as a template
+The `spec.chart` values are used by the helm-controller as a template
 to create a new `HelmChart` resource with the given spec.
 
 The `spec.chart.spec.sourceRef` is a reference to an object managed by
@@ -699,8 +746,8 @@ The `HelmChart` is created in the same namespace as the `sourceRef`,
 with a name matching the `HelmRelease` `<metadata.namespace>-<metadata.name>`.
 
 > **Note** that on multi-tenant clusters,  platform admins can disable cross-namespace references
-> with the `--no-cross-namespace-refs=true` flag. When this flag is set, the helmrelease can only
-> refer to sources in the same  namespace as the helmrelease object.
+> with the `--no-cross-namespace-refs=true` flag. When this flag is set, the HelmRelease can only
+> refer to sources in the same  namespace as the HelmRelease object.
 
 The `chart.spec.chart` can either contain:
 
@@ -713,6 +760,9 @@ The `chart.spec.version` can be a fixed semver, or any semver range
 (i.e. `>=4.0.0 <5.0.0`). It is ignored for `HelmRelease` resources
 that reference a `GitRepository` or `Bucket` source.
 
+Annotations and labels can be added by configuring the respective `.spec.chart.metadata`
+fields.
+
 ## Values overrides
 
 The simplest way to define values overrides is inline via `spec.values`.
@@ -774,6 +824,11 @@ desired state, so an upgrade is made in this case as well.
 The `spec.interval` tells the reconciler at which interval to reconcile the release. The
 interval time units are `s`, `m` and `h` e.g. `interval: 5m`, the minimum value should be 60 seconds.
 
+**Note:** The controller can be configured to apply a jitter to the interval in
+order to distribute the load more evenly when multiple HelmRelease objects are
+set up with the same interval. For more information, please refer to the
+[helm-controller configuration options](https://fluxcd.io/flux/components/helm/options/).
+
 The reconciler can be told to reconcile the `HelmRelease` outside of the specified interval
 by annotating the object with a `reconcile.fluxcd.io/requestedAt` annotation. For example:
 
@@ -972,7 +1027,7 @@ spec:
 ## Role-based access control
 
 By default, a `HelmRelease` runs under the cluster admin account and can create, modify, delete cluster level objects
-(cluster roles, cluster role binding, CRDs, etc) and namespeced objects (deployments, ingresses, etc).
+(cluster roles, cluster role binding, CRDs, etc) and namespaced objects (deployments, ingresses, etc).
 For certain `HelmReleases` a cluster admin may wish to control what types of Kubernetes objects can
 be reconciled and under which namespace.
 To restrict a `HelmRelease`, one can assign a service account under which the reconciliation is performed.
@@ -1270,11 +1325,104 @@ spec:
     crds: CreateReplace
 ```
 
+## Drift detection
+
+**Note:** This feature is experimental and can be enabled by setting `--feature-gates=DetectDrift=true`.
+
+When a HelmRelease is in-sync with the Helm release object in the storage, the controller will
+compare the manifests from the Helm storage with the current state of the cluster using a
+[server-side dry-run apply](https://kubernetes.io/docs/reference/using-api/server-side-apply/).
+If this comparison detects a drift (either due resource being created or modified during the
+dry-run), the controller will perform an upgrade for the release, restoring the desired state.
+
+To help aid transition to this new feature, it is possible to enable drift detection without it
+correcting drift. This can be done by adding `CorrectDrift=false` to the `--feature-gates` flag,
+i.e. `--feature-gates=DetectDrift=true,CorrectDrift=false`. This will allow you to see what drift
+is detected in the controller logs (with `--log-level=debug`), to potentially add the appropriate
+[exclusions annotations or labels](#excluding-resources-from-drift-detection), before enabling the
+feature full.
+
+### Excluding resources from drift detection
+
+The drift detection feature can be configured to exclude certain resources from the comparison
+by labeling or annotating them with `helm.toolkit.fluxcd.io/driftDetection: disabled`. Using
+[post-renderers](#post-renderers), this can be applied to any resource rendered by Helm.
+
+```yaml
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: app
+  namespace: webapp
+spec:
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              version: v1
+              kind: Deployment
+              name: my-app
+            patch: |
+              - op: add
+                path: /metadata/annotations/helm.toolkit.fluxcd.io~1driftDetection
+                value: disabled
+```
+
+**Note:** For some charts, we have observed the drift detection feature can detect spurious
+changes due to Helm not properly patching an object, which seems to be related to
+[Helm#5915](https://github.com/helm/helm/issues/5915) and issues alike. In this case (and
+when possible for your workload), configuring `.spec.upgrade.force` to `true` might be a
+more fitting solution than ignoring the object in full.
+
+#### Drift exclusion example Prometheus Stack
+
+```yaml
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: kube-prometheus-stack
+spec:
+  interval: 5m
+  chart:
+    spec:
+      version: "45.x"
+      chart: kube-prometheus-stack
+      sourceRef:
+        kind: HelmRepository
+        name: prometheus-community
+      interval: 60m
+  upgrade:
+    crds: CreateReplace
+    # Force recreation due to Helm not properly patching Deployment with e.g. added port,
+    # causing spurious drift detection
+    force: true
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              # Ignore these objects from Flux diff as they are mutated from chart hooks
+              kind: (ValidatingWebhookConfiguration|MutatingWebhookConfiguration)
+              name: kube-prometheus-stack-admission
+            patch: |
+              - op: add
+                path: /metadata/annotations/helm.toolkit.fluxcd.io~1driftDetection
+                value: disabled
+          - target:
+              # Ignore these objects from Flux diff as they are mutated at apply time but not
+              # at dry-run time
+              kind: PrometheusRule
+            patch: |
+              - op: add
+                path: /metadata/annotations/helm.toolkit.fluxcd.io~1driftDetection
+                value: disabled
+```
+
 ## Status
 
 When the controller completes a reconciliation, it reports the result in the status sub-resource.
 
-The following `status.condtions` types are advertised. Here, "desired state" is as detailed in
+The following `status.conditions` types are advertised. Here, "desired state" is as detailed in
 [reconciliation](#reconciliation):
 
 - `Ready` - status of the last reconciliation attempt