Add check for expected revision on upgrade and uninstall

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Author: brandond

Dockerfile

@@ -6,7 +6,7 @@ RUN if [ "${TARGETARCH}" = "arm/v7" ]; then \
     else \
         ARCH="${TARGETARCH}" ; \
     fi && \
-    curl -sL https://get.helm.sh/helm-v3.19.5-linux-${ARCH}.tar.gz | tar xvzf - --strip-components=1 -C /usr/bin
+    curl -sL https://get.helm.sh/helm-v3.20.1-linux-${ARCH}.tar.gz | tar xvzf - --strip-components=1 -C /usr/bin
 COPY entry /usr/bin/
 
 FROM golang:1.25-alpine3.23 AS plugins
@@ -17,13 +17,13 @@ RUN go version
 RUN mkdir -p /go/src/github.com/k3s-io/helm-set-status && \
     curl -sL https://github.com/k3s-io/helm-set-status/archive/refs/tags/v0.3.0.tar.gz | tar xvzf - --strip-components=1 -C /go/src/github.com/k3s-io/helm-set-status && \
     cd /go/src/github.com/k3s-io/helm-set-status && \
-    go mod edit --replace helm.sh/helm/v3=helm.sh/helm/v3@v3.19.5 && \
+    go mod edit --replace helm.sh/helm/v3=helm.sh/helm/v3@v3.20.1 && \
     go mod tidy && \
     make install
 RUN mkdir -p /go/src/github.com/helm/helm-mapkubeapis && \
     curl -sL https://github.com/helm/helm-mapkubeapis/archive/refs/tags/v0.6.1.tar.gz | tar xvzf - --strip-components=1 -C /go/src/github.com/helm/helm-mapkubeapis && \
     cd /go/src/github.com/helm/helm-mapkubeapis && \
-    go mod edit --replace helm.sh/helm/v3=helm.sh/helm/v3@v3.19.5 && \
+    go mod edit --replace helm.sh/helm/v3=helm.sh/helm/v3@v3.20.1 && \
     go mod tidy && \
     make && \
     mkdir -p /root/.local/share/helm/plugins/helm-mapkubeapis && \

entry

@@ -2,7 +2,7 @@
 
 helm_update() {
 	LINE="$(${HELM} ls --all -f "^${NAME}\$" --namespace ${TARGET_NAMESPACE} --output json | jq -r "${JQ_CMD}" | tr '[:upper:]' '[:lower:]')"
-	IFS=, read -r INSTALLED_VERSION STATUS _ <<<${LINE}
+	IFS=, read -r INSTALLED_VERSION STATUS REVISION _ <<<${LINE}
 	VALUES=""
 
 	for VALUES_FILE in /config/*.yaml; do
@@ -15,6 +15,9 @@ helm_update() {
 			echo "No ${HELM} chart installed; nothing to delete" >> ${TERM_LOG}
 			exit
 		fi
+
+    check_revision ${REVISION}
+
 		echo "Uninstalling ${HELM} chart" >> ${TERM_LOG}
 		${HELM} uninstall ${NAME} --namespace ${TARGET_NAMESPACE} --wait || true
 		exit
@@ -27,6 +30,8 @@ helm_update() {
 		exit
 	fi
 
+  check_revision ${REVISION}
+
 	# If a previous helm operation was interrupted unexpectedly or release state is corrupted, set it to failed.
 	if [[ "${STATUS}" =~ ^(pending-install|pending-upgrade|pending-rollback|superseded|uninstalling)$ ]]; then
 		echo Previous helm job was interrupted, updating status from ${STATUS} to failed
@@ -124,6 +129,15 @@ helm_content_decode() {
 	set +e
 }
 
+check_revision() {
+  REVISION="$1"
+  if [[ -n "${EXPECTED_RELEASE_REVISION}" ]] && [[ "${EXPECTED_RELEASE_REVISION}" != "${REVISION}" ]]; then
+    echo "Current release revision ${REVISION} does not match expected revision ${EXPECTED_RELEASE_REVISION}" >> ${TERM_LOG}
+    echo "Current release revision ${REVISION} does not match expected revision ${EXPECTED_RELEASE_REVISION}"
+    exit 64
+  fi
+}
+
 export CA_FILE=/config/ca-file.pem
 export CA_DIR=/ca-files
 export AUTH_DIR=/auth
@@ -138,7 +152,7 @@ INSECURE_TLS_ARG=""
 PLAIN_HTTP_ARG=""
 TIMEOUT_ARG=""
 PASS_CREDENTIALS_ARG=""
-JQ_CMD='"\(.[0].chart),\(.[0].status)"'
+JQ_CMD='"\(.[0].chart),\(.[0].status),\(.[0].revision)"'
 
 set -e -v
 if [[ ${KUBERNETES_SERVICE_HOST} =~ .*:.* ]]; then