Normalize YAML flow-style docs in post-renderer

Helm v4's kyaml round-trips rendered manifests through its YAML parser,
converting JSON output from toJson template functions into YAML flow-style
with unquoted keys, e.g. {apiVersion: v1, kind: ConfigMap, ...}.

k8s.io/apimachinery's IsJSONBuffer detects the leading '{' and returns
such documents unchanged assuming they are already valid JSON. Passing
them to json.Unmarshal then fails with 'invalid character' because the
keys are unquoted.

Add normalizeFlowStyleDocs to the post-renderer: before handing the
rendered buffer to yaml.ToObjects, each document starting with '{' is
checked with json.Valid; documents that fail are round-tripped through
sigs.k8s.io/yaml to produce block-style YAML that the existing decode
path handles correctly.

Add hasFlowStyleCandidate as a zero-allocation fast-path: on every render
call, a raw byte scan checks whether any document boundary starts with '{'.
When none does (the common case), normalizeFlowStyleDocs returns the
original slice immediately without any allocation or buffer rebuild.

Author: thardeck

internal/helmdeployer/install_test.go

@@ -16,6 +16,7 @@ import (
 	"os"
 
 	"github.com/rancher/fleet/internal/experimental"
+	"github.com/rancher/fleet/internal/manifest"
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -751,3 +752,36 @@ func TestInstallActionCorrectDriftForce(t *testing.T) {
 		})
 	}
 }
+
+// TestTemplate_ToJsonFlowStyle is a regression test for the Helm v4 + kyaml
+// issue where JSON output from a toJson template function is round-tripped
+// through kyaml (annotateAndMerge), which converts it into YAML flow-style
+// with unquoted keys, e.g. {apiVersion: v1, kind: ConfigMap}.
+// k8s.io/apimachinery then mistakes the leading '{' for JSON and passes the
+// document through unchanged, causing json.Unmarshal to fail.
+// See the Fleet issue tracker (issue.txt) for the user-visible error:
+//
+//	error while running post render on files: invalid character 'a'
+func TestTemplate_ToJsonFlowStyle(t *testing.T) {
+	m := &manifest.Manifest{
+		Resources: []fleet.BundleResource{
+			{
+				Name:    "test-chart/Chart.yaml",
+				Content: "apiVersion: v2\nname: test-chart\nversion: 0.1.0\ntype: application\n",
+			},
+			{
+				// Template that outputs a raw JSON document via toJson.
+				// Helm v4's kyaml converts this to flow-style YAML with unquoted
+				// keys before Fleet's post-renderer sees it.
+				Name:    "test-chart/templates/configmap.yaml",
+				Content: "{{- toJson (dict \"apiVersion\" \"v1\" \"kind\" \"ConfigMap\" \"metadata\" (dict \"name\" \"json-output\") \"data\" (dict \"key\" \"value\")) }}\n",
+			},
+		},
+	}
+	opts := fleet.BundleDeploymentOptions{
+		DefaultNamespace: "default",
+		Helm:             &fleet.HelmOptions{Chart: "test-chart"},
+	}
+	_, err := Template(context.Background(), "test-bundle", m, opts, "v1.25.0")
+	require.NoError(t, err)
+}

internal/helmdeployer/postrender.go

@@ -1,8 +1,12 @@
 package helmdeployer
 
 import (
+	"bufio"
 	"bytes"
+	"encoding/json"
+	"errors"
 	"fmt"
+	"io"
 	"strings"
 
 	"helm.sh/helm/v4/pkg/kube"
@@ -18,10 +22,85 @@ import (
 	"github.com/rancher/wrangler/v3/pkg/yaml"
 
 	"k8s.io/apimachinery/pkg/api/meta"
+	utilyaml "k8s.io/apimachinery/pkg/util/yaml"
+	sigsyaml "sigs.k8s.io/yaml"
 )
 
 const CRDKind = "CustomResourceDefinition"
 
+// normalizeFlowStyleDocs converts YAML documents that start with '{' but are
+// not valid JSON (i.e. YAML flow-style with unquoted keys, as emitted by
+// Helm v4's kyaml when templates use the toJson function) into block-style
+// YAML. k8s.io/apimachinery's ToJSON treats any '{'-prefixed document as
+// already-valid JSON and returns it unchanged, so a flow-style document with
+// unquoted keys causes json.Unmarshal to fail with "invalid character".
+//
+// If no document boundary in data starts with '{', data is returned unchanged
+// with no allocations.
+func normalizeFlowStyleDocs(data []byte) ([]byte, error) {
+	if !hasFlowStyleCandidate(data) {
+		return data, nil
+	}
+	reader := utilyaml.NewYAMLReader(bufio.NewReader(bytes.NewReader(data)))
+	var out bytes.Buffer
+	for {
+		doc, err := reader.Read()
+		if err != nil {
+			if errors.Is(err, io.EOF) {
+				break
+			}
+			return nil, err
+		}
+		trimmed := bytes.TrimSpace(doc)
+		if len(trimmed) == 0 {
+			continue
+		}
+		if trimmed[0] == '{' && !json.Valid(trimmed) {
+			var obj any
+			if err := sigsyaml.Unmarshal(trimmed, &obj); err != nil {
+				return nil, err
+			}
+			doc, err = sigsyaml.Marshal(obj)
+			if err != nil {
+				return nil, err
+			}
+		}
+		out.WriteString("---\n")
+		out.Write(doc)
+	}
+	return out.Bytes(), nil
+}
+
+// hasFlowStyleCandidate reports whether data contains at least one YAML
+// document whose first non-whitespace byte is '{'. It is a fast, zero-
+// allocation scan used as a pre-check before the more expensive processing
+// in normalizeFlowStyleDocs.
+func hasFlowStyleCandidate(data []byte) bool {
+	firstNonSpace := func(b []byte) byte {
+		for _, c := range b {
+			if c != ' ' && c != '\t' && c != '\r' && c != '\n' {
+				return c
+			}
+		}
+		return 0
+	}
+	if firstNonSpace(data) == '{' {
+		return true
+	}
+	sep := []byte("\n---")
+	rest := data
+	for {
+		i := bytes.Index(rest, sep)
+		if i < 0 {
+			return false
+		}
+		rest = rest[i+len(sep):]
+		if firstNonSpace(rest) == '{' {
+			return true
+		}
+	}
+}
+
 type postRender struct {
 	labelPrefix string
 	labelSuffix string
@@ -35,6 +114,11 @@ type postRender struct {
 func (p *postRender) Run(renderedManifests *bytes.Buffer) (modifiedManifests *bytes.Buffer, err error) {
 	data := renderedManifests.Bytes()
 
+	data, err = normalizeFlowStyleDocs(data)
+	if err != nil {
+		return nil, err
+	}
+
 	objs, err := yaml.ToObjects(bytes.NewBuffer(data))
 	if err != nil {
 		return nil, err

internal/helmdeployer/postrender_test.go

@@ -177,3 +177,34 @@ func TestPostRenderer_Run_DeleteCRDs(t *testing.T) {
 	})
 
 }
+
+func TestPostRenderer_Run_FlowStyleYAML(t *testing.T) {
+	// Helm v4's kyaml converts JSON output from toJson template functions into
+	// YAML flow-style with unquoted keys, e.g. {apiVersion: v1, kind: ConfigMap}.
+	// k8s.io/apimachinery ToJSON sees the leading '{' and treats it as JSON,
+	// returning it unchanged; json.Unmarshal then fails on the unquoted keys.
+	flowStyleDoc := `{apiVersion: v1, kind: ConfigMap, metadata: {name: test-cm}, data: {key: value}}`
+
+	pr := postRender{
+		manifest: &manifest.Manifest{Resources: []v1alpha1.BundleResource{}},
+		chart:    &chartv2.Chart{},
+		opts:     v1alpha1.BundleDeploymentOptions{},
+	}
+
+	out, err := pr.Run(bytes.NewBufferString(flowStyleDoc))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	objs, err := yaml.ToObjects(bytes.NewBuffer(out.Bytes()))
+	if err != nil {
+		t.Fatalf("unexpected error parsing output: %v", err)
+	}
+	if len(objs) != 1 {
+		t.Fatalf("expected 1 object, got %d", len(objs))
+	}
+	gvk := objs[0].GetObjectKind().GroupVersionKind()
+	if gvk.Kind != "ConfigMap" {
+		t.Errorf("expected ConfigMap, got %s", gvk.Kind)
+	}
+}