feat!: bump default Helm version v3.8.2 → v4.2.0 (PIE-6)#90
Open
mangyau wants to merge 3 commits into
Open
Conversation
v3.8.2 was released in April 2022. v4.2.0 is the latest Helm stable release as of the date of this commit. BREAKING CHANGE: users relying on the v3.8.2 default must now pin an explicit version.
mangyau
force-pushed
the
pie-6/update-default-versions
branch
from
9a8a08b to
3c9b114
Compare
mangyau
changed the title
- Add skip_verify param (default false) to pass --verify=false for plugins without GPG-signed provenance files - Add gpg_key_url param to import a signing key before installation, enabling verified installs for plugins that provide .prov files - Refactor install script to build args array cleanly - Update helm-secrets test to v4.7.6 tarball URL with GPG key import (v4.7.0+ ships .prov files; repo URL installs cannot be verified in Helm 4) - Set skip_verify: true for helm-env (unmaintained, no provenance support)
- Export imported GPG key to ~/.gnupg/pubring.gpg after gpg --import, as GPG 2.1+ uses the .kbx keybox format by default but Helm requires the legacy pubring.gpg format for plugin verification
mangyau
force-pushed
the
pie-6/update-default-versions
branch
from
3e42526 to
3b25517
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
versionparameter default incommands/install_helm_client.ymlfromv3.8.2tov4.2.0install_helm_plugin:skip_verifyparam (defaultfalse) — passes--verify=falsefor plugins without GPG-signed provenance filesgpg_key_urlparam — imports a GPG public key before installation, enabling fully verified installs for plugins that ship.provfileshelm-secretstest to v4.7.6 via direct tarball URL with GPG key import (Helm 4 can only verify tarball-URL installs, not GitHub repo URLs)skip_verify: trueforhelm-env(unmaintained plugin with no provenance support)Breaking change
Users who relied on the
v3.8.2default without pinning an explicit `version` will now get Helm v4.2.0.Migration guide (v→v+1)
Closes PIE-6