Skip to content

feat: add HELM_S3_DYNAMIC_REGION flag to disable dynamic region discovery#599

Merged
hypnoglow merged 7 commits into
hypnoglow:masterfrom
sasanyasari:feature/helm-s3-dynamic-region-flag
May 29, 2026
Merged

feat: add HELM_S3_DYNAMIC_REGION flag to disable dynamic region discovery#599
hypnoglow merged 7 commits into
hypnoglow:masterfrom
sasanyasari:feature/helm-s3-dynamic-region-flag

Conversation

@sasanyasari
Copy link
Copy Markdown
Contributor

Overview

Add support for disabling dynamic bucket region detection via the HELM_S3_DYNAMIC_REGION environment variable.

Problem

The current implementation of DynamicBucketRegion always performs automatic bucket region detection by making HEAD requests to Amazon S3, which causes several issues:

  1. Breaks plugin in restricted environments: Environments with limited internet access or strict egress filtering cannot make the required HEAD requests to s3.amazonaws.com
  2. Security/privacy concerns: Internal bucket names are leaked to Amazon S3 even when using alternative S3-compatible storage solutions
  3. Ignores user configuration: The HEAD requests always go to Amazon S3 (s3.amazonaws.com) regardless of custom endpoints configured via AWS_ENDPOINT or AWS profiles

Solution

Introduce HELM_S3_DYNAMIC_REGION environment variable:

  • Default: true (enabled) - maintains backward compatibility
  • Set to false: Disables dynamic region detection, relies on standard AWS region configuration

Usage

To disable dynamic bucket region detection:

export HELM_S3_DYNAMIC_REGION=false

This is particularly useful for:

  • Environments with restricted internet access
  • Alternative S3-compatible storage (MinIO, Ceph, etc.)
  • Security-sensitive environments where bucket names should not be exposed to AWS
  • CI/CD pipelines requiring predictable region behavior

Testing

All existing tests pass, and new tests verify.

Backward Compatibility

✅ Fully backward compatible - existing users will see no change in behavior unless they explicitly set HELM_S3_DYNAMIC_REGION=false.

Fixes #220

…very

Add HELM_S3_DYNAMIC_REGION environment variable that can be set to 'false'
to disable dynamic bucket region discovery. This is useful when using
custom S3-compatible endpoints or in air-gapped environments where the
plugin would otherwise wait for a timeout trying to reach s3.amazonaws.com.

- Add awsDynamicRegion constant in session.go
- Check the flag in DynamicBucketRegion function
- Add test for disabled dynamic region
- Document the flag in README.md and website docs
@sasanyasari sasanyasari force-pushed the feature/helm-s3-dynamic-region-flag branch 4 times, most recently from 4b4fc97 to 38311ce Compare May 3, 2026 09:19
@sasanyasari sasanyasari force-pushed the feature/helm-s3-dynamic-region-flag branch from 38311ce to ebd0fcb Compare May 3, 2026 09:21
@sasanyasari sasanyasari force-pushed the feature/helm-s3-dynamic-region-flag branch from 5611ad8 to 90de58f Compare May 3, 2026 09:43
Copy link
Copy Markdown

@zibarev zibarev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR — this addresses a real pain point.

Comment thread internal/awsutil/session.go Outdated
Comment thread internal/awsutil/session.go Outdated
Comment thread internal/awsutil/session_test.go
…EGION_ENABLED

- Rename env var so its boolean nature is obvious (unset → enabled, =false → disabled)
- Parse with strconv.ParseBool to accept all standard truthy/falsy spellings
- Assert no HTTP requests are made when disabled, via httptest.Server + rewriting RoundTripper
- Update README and docs
Copy link
Copy Markdown
Owner

@hypnoglow hypnoglow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

@hypnoglow hypnoglow enabled auto-merge (squash) May 29, 2026 09:46
@hypnoglow hypnoglow disabled auto-merge May 29, 2026 09:46
@codecov
Copy link
Copy Markdown

codecov Bot commented May 29, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.16%. Comparing base (8bd4713) to head (676378f).

Additional details and impacted files
@@            Coverage Diff             @@
##           master     #599      +/-   ##
==========================================
+ Coverage   69.11%   69.16%   +0.05%     
==========================================
  Files          32       32              
  Lines        1185     1187       +2     
==========================================
+ Hits          819      821       +2     
  Misses        366      366              
Flag Coverage Δ
e2e 67.56% <50.00%> (-0.03%) ⬇️
unit 14.99% <100.00%> (+0.14%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@hypnoglow hypnoglow merged commit 00fbcae into hypnoglow:master May 29, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Plugin cannot connect, dispite AWS CLI connecting without issue

3 participants