H4HIP: Server Side Apply support #312

gjenkins8 · 2023-08-10T04:59:07Z

HIP for Helm to support SSA (chart object/resources)

gjenkins8 · 2023-08-10T17:16:41Z

hips/hip-00XX.md

+
+#### Special
+
+- `--dry-run=client` doesn't work with SSA enabled


@mattfarina points out that this will make it difficult for user's to preview changes

gjenkins8 · 2023-08-10T17:32:51Z

hips/hip-00XX.md

+
+#### Conflicts and forcing
+
+It is possible when Helm upgrades a chart, that there will be a field conflict with another field manager. In this case, Helm should report the error to the user.


TODO: verify we can abort atomically across multiple objects (Ian Z points this out)

hips/hip-00XX.md

morremeyer · 2023-09-25T17:20:46Z

@gjenkins8 I think this HIP as written would apply to the release secret itself, too. Am I correct with this understanding?

We're running into the issue that the release secret is > 1MB in https://github.com/community-tooling/charts because of the kubectl.kubernetes.io/last-applied-configuration containing the whole config again. Using SSA, that would/could be avoided as far as I'm aware.

Signed-off-by: George Jenkins <[email protected]>

gjenkins8 · 2024-12-28T18:17:59Z

hips/hip-00XX.md

+Allowing Helm to update objects which have been modified by other processes.
+Kubernetes now offers a similar server-side process that has several advantages over the client-side apply (CSA) methods that Helm and `kubectl` (for example) have traditionally utilized.
+
+## Motivation


Perhaps also include that client-side validation is now largely unsupported (need to read up on the details):

kubernetes/kubectl#1625

joejulian · 2025-02-20T23:50:02Z

hips/hip-00XX.md

+
+- `--dry-run=client` won't work with SSA enabled
+- If the user attempts to use SSA with a cluster which does not support it (unlikely: SSA [went GA](https://kubernetes.io/blog/2021/08/06/server-side-apply-ga/) in Kubernetes v1.22), Helm should error
+- Client-side API object validation isn't applicable when SSA enabled (`helm install|upgrade --disable-openapi-validation`)


Could we still do this using the SSA with a dry-run?

joejulian · 2025-02-20T23:52:23Z

hips/hip-00XX.md

+### Implementation
+
+Helm will send object's manifests to the Kubernetes API server via SSA patches. Similar to `kubectl apply`.
+Utilizing the field manager name `"helm"`:


Should this be configurable? I'm thinking of a case where "Sam" and "Alex" might be managing the same namespace and want to be sure that they're not stepping on each other's toes.

This HIP is only going as far as Helm supporting a single field manager. For the goal of switching from client-side to server-side apply.

I do think in the future, Helm supporting multiple field managers in the same chart with similar control on conflict resolution, should be done. But that ends up being a can of worm (stuff to design) I think we should defer for the moment.

I should mention, see Rejected Ideas for some discussion

joejulian · 2025-02-20T23:53:25Z

hips/hip-00XX.md

+   - Arrays will be merged
+   - Removal of unset fields
+   - Default values


Which side of the "vs" has which behavior?

The handling of removing previously set values in the 3-way merge by setting a null was recently fixed. Do we know how/if SSA will affect that behavior?

Which side of the "vs" has which behavior?

oops, right. these are benefits of SSA. Fixed language.

The handling of removing previously set values in the 3-way merge by setting a null was recently fixed. Do we know how/if SSA will affect that behavior?

This was the input values merge, and dropping fields set to null from input values. This (I guess is kinda the same) but for object manifests applied to the Kubernetes API

joejulian · 2025-02-20T23:54:09Z

hips/hip-00XX.md

+
+For 1., chart-operators may opt-out out of SSA.
+For 2., the user can control by ensuring SSA is consistently used within their environment.
+For 3., the it is generally considered a limitation of Helm not updating custom resources, for which SSA is expected to be an improvement.


Suggested change

For 3., the it is generally considered a limitation of Helm not updating custom resources, for which SSA is expected to be an improvement.

For 3., the it is generally considered a limitation of Helm not updating custom resource definitions, for which SSA is expected to be an improvement.

language here is correct. CRDs are the objects which create new Kubernetes API resources. Custom resources are the objects created from those resource.

I'll amend to "custom resource objects" to be clear

joejulian · 2025-02-20T23:54:54Z

hips/hip-00XX.md

+For 3., the it is generally considered a limitation of Helm not updating custom resources, for which SSA is expected to be an improvement.
+For 4., the `--force-conflicts` flag exists.
+
+Additionally as noted, SSA isn't compatible with very old Kubernetes versions (Kubernetes v1.17 and prior)


You said 1.22, earlier. 🤷

GA in 1.22

Iirc, SSA will work via beta release from 1.17. At this point, 1.17 vs 1.22 is probably water under the bridge now. Will improve this slightly.

joejulian · 2025-02-20T23:56:33Z

hips/hip-00XX.md

+Helm won't support ownership transfer of fields.
+Similar to the `kubectl` example: <https://kubernetes.io/docs/reference/using-api/server-side-apply/#transferring-ownership>.
+
+Dissimilar to `kubectl`, is Helm's distinguishes between chart developers and chart operators.


Suggested change

Dissimilar to `kubectl`, is Helm's distinguishes between chart developers and chart operators.

Dissimilar to `kubectl`, is Helm distinguishes between chart developers and chart operators.

ugh, terrible grammar here

joejulian · 2025-02-20T23:56:59Z

hips/hip-00XX.md

+### Chart field manager support
+
+This HIP defers including field manager support in charts.
+Helm could enabling apply objects with a distinct field manager names.


Suggested change

Helm could enabling apply objects with a distinct field manager names.

Helm could enable applying objects with a distinct field manager names.

ugh, thanks. fixed

Signed-off-by: George Jenkins <[email protected]>

pull-request-size bot added the size/L label Aug 10, 2023

gjenkins8 force-pushed the server_side_apply_hip branch from 95e4e59 to 3c11723 Compare August 10, 2023 05:00

gjenkins8 changed the title ~~HIP: Server side apply support~~ HIP: Server Side Apply support Aug 10, 2023

gjenkins8 commented Aug 10, 2023

View reviewed changes

hips/hip-00XX.md Outdated Show resolved Hide resolved

z4ce mentioned this pull request Aug 28, 2023

Will helm 3.13.0 support server side dry runs? helm/helm#12342

Closed

gjenkins8 force-pushed the server_side_apply_hip branch 4 times, most recently from e1e4d73 to 9048d85 Compare October 10, 2023 22:45

gjenkins8 marked this pull request as ready for review October 10, 2023 22:51

gjenkins8 mentioned this pull request Oct 13, 2023

Helm scales deployment to replicas 1 when specific conditions are met helm/helm#12486

Closed

gjenkins8 mentioned this pull request Dec 18, 2023

Can helm support Kubernetes server side apply feature helm/helm#12652

Closed

jnoordsij mentioned this pull request Jan 4, 2024

Helm updates can lose dual HTTP3 port traefik/traefik-helm-chart#982

Open

2 tasks

umialpha mentioned this pull request Jan 16, 2024

Feature request: ignore part of a resource in upgrade helm/helm#7971

Closed

eumel8 mentioned this pull request Mar 24, 2024

[kube-prometheus-stack] data: Too long: must have at most 1048576 bytes prometheus-community/helm-charts#3617

Closed

gjenkins8 mentioned this pull request Apr 27, 2024

Helm's ports merging logic differs from Kubernetes helm/helm#12974

Closed

gjenkins8 mentioned this pull request Sep 26, 2024

Helm does not handle duplicate volume mount names; only the last defined volume mount is used helm/helm#13311

Closed

HIP: Server-Side Apply

82b28b6

Signed-off-by: George Jenkins <[email protected]>

gjenkins8 force-pushed the server_side_apply_hip branch from 028f45f to 82b28b6 Compare November 14, 2024 22:10

Helm 4 updates

296269b

Signed-off-by: George Jenkins <[email protected]>

gjenkins8 changed the title ~~HIP: Server Side Apply support~~ H4HIP: Server Side Apply support Dec 27, 2024

gjenkins8 added 2 commits December 26, 2024 18:14

more tidyup

6759f82

Signed-off-by: George Jenkins <[email protected]>

more tidyup

64a36d1

Signed-off-by: George Jenkins <[email protected]>

gjenkins8 commented Dec 28, 2024

View reviewed changes

joejulian reviewed Feb 20, 2025

View reviewed changes

gjenkins8 added 2 commits February 22, 2025 21:04

code review + updates

b889af7

Signed-off-by: George Jenkins <[email protected]>

fix

f7b87a1

Signed-off-by: George Jenkins <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

H4HIP: Server Side Apply support #312

H4HIP: Server Side Apply support #312

gjenkins8 commented Aug 10, 2023 •

edited

Loading

gjenkins8 Aug 10, 2023

gjenkins8 Aug 10, 2023

morremeyer commented Sep 25, 2023

gjenkins8 Dec 28, 2024 •

edited

Loading

joejulian Feb 20, 2025

joejulian Feb 20, 2025

gjenkins8 Feb 23, 2025

gjenkins8 Feb 23, 2025

joejulian Feb 20, 2025

joejulian Feb 21, 2025

gjenkins8 Feb 23, 2025

joejulian Feb 20, 2025

gjenkins8 Feb 23, 2025

joejulian Feb 20, 2025

gjenkins8 Feb 23, 2025

joejulian Feb 20, 2025

gjenkins8 Feb 23, 2025

joejulian Feb 20, 2025

gjenkins8 Feb 23, 2025


		#### Special

		- `--dry-run=client` doesn't work with SSA enabled


		#### Conflicts and forcing

		It is possible when Helm upgrades a chart, that there will be a field conflict with another field manager. In this case, Helm should report the error to the user.

	For 3., the it is generally considered a limitation of Helm not updating custom resources, for which SSA is expected to be an improvement.
	For 3., the it is generally considered a limitation of Helm not updating custom resource definitions, for which SSA is expected to be an improvement.

	Dissimilar to `kubectl`, is Helm's distinguishes between chart developers and chart operators.
	Dissimilar to `kubectl`, is Helm distinguishes between chart developers and chart operators.

	Helm could enabling apply objects with a distinct field manager names.
	Helm could enable applying objects with a distinct field manager names.

H4HIP: Server Side Apply support #312

Are you sure you want to change the base?

H4HIP: Server Side Apply support #312

Conversation

gjenkins8 commented Aug 10, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

morremeyer commented Sep 25, 2023

gjenkins8 Dec 28, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gjenkins8 commented Aug 10, 2023 •

edited

Loading

gjenkins8 Dec 28, 2024 •

edited

Loading