Crossplane Provider Helm

To run the provider-helm controller against your local Kubernetes cluster for development, follow these steps:

1. Run the controller: Execute make run to start the controller outside the cluster.
2. Expose the API server: In a separate terminal, run sudo kubectl proxy --port=8081 to make the API server accessible to the local controller.
3. Prepare ProviderConfig: If using kind, generate a kubeconfig that points to the local proxy, store it in a Secret, and apply a ProviderConfig that uses that Secret.
4. Test with a Release: Create a Release resource to verify the local setup.

# 1. Run controller
make run

# 2. Proxy API (separate terminal)
sudo kubectl proxy --port=8081

# 3. Setup ProviderConfig for local cluster (e.g. kind)
KUBECONFIG=$(kind get kubeconfig | sed -e 's|server:\s*.*$|server: http://localhost:8081|g') 
kubectl -n crossplane-system create secret generic cluster-config --from-literal=kubeconfig="${KUBECONFIG}" 
kubectl apply -f examples/cluster/provider-config/provider-config-with-secret.yaml

# 4. Create a Release
kubectl create -f examples/cluster/sample/release.yaml

The NewClient function uses the ArgsApplier pattern for configuration. An ArgsApplier is a function with the signature func(*Args). You can pass multiple appliers to NewClient to set various parameters.

While the exact fields of Args are internal to the client implementation, they control critical behaviors such as:

• Namespace: The Kubernetes namespace for the release.
• CABundle: Custom CA certificates for TLS trust (applied to both OCI and classic repos).
• InsecureSkipTLSVerify: Whether to skip TLS verification.
• PlainHTTP: Whether to use unencrypted HTTP.
• Wait: Whether to wait for resources to be ready (uses kube.StatusWatcherStrategy if true).
• Timeout: The timeout for Helm actions.
• SkipCRDs: Whether to skip installing CRDs.
• TakeOwnership: Whether to take ownership of resources.
• SSAForceConflicts: Whether to use Server-Side Apply to force conflicts.

The Client interface provides the primary programmatic way to interact with Helm releases. It supports standard Helm operations like installing, upgrading, rolling back, and uninstalling releases, as well as retrieving the last known release state and pulling/loading charts from repositories.

Methods available on the Client interface:

• GetLastRelease(release string) (*release.Release, error): Retrieves the most recent release information for the specified name.
• Install(release string, chart *chart.Chart, vals map[string]interface{}, patches []ktype.Patch) (*release.Release, error): Installs a new Helm release using the provided chart, values, and optional Kustomize patches.
• Upgrade(release string, chart *chart.Chart, vals map[string]interface{}, patches []ktype.Patch) (*release.Release, error): Upgrades an existing release. Note that Upgrade resets values so the CR remains the source of truth.
• Rollback(release string) error: Rolls back the specified release to its previous state.
• Uninstall(release string) error: Uninstalls the specified release.
• PullAndLoadChart(mg resource.Managed, creds *RepoCreds) (*chart.Chart, error): Pulls a chart from a repository (supporting both classic HTTP/S and OCI registries) and loads it into a *chart.Chart object.

type Client interface {
	GetLastRelease(release string) (*release.Release, error)
	Install(release string, chart *chart.Chart, vals map[string]interface{}, patches []ktype.Patch) (*release.Release, error)
	Upgrade(release string, chart *chart.Chart, vals map[string]interface{}, patches []ktype.Patch) (*release.Release, error)
	Rollback(release string) error
	Uninstall(release string) error
	PullAndLoadChart(mg resource.Managed, creds *RepoCreds) (*chart.Chart, error)
}

The following flags and environment variables are available for configuring the provider-helm binary.

--debug, -d             Run with debug logging.
--leader-election, -l   Use leader election for the controller manager. (Env: LEADER_ELECTION)
--timeout               Controls how long helm commands may run before they are killed. (Default: 10m)
--sync, -s               How often all resources will be double-checked for drift from the desired state. (Default: 1h)
--poll                  How often individual resources will be checked for drift from the desired state. (Default: 10m)
--poll-state-metric     State metric recording interval. (Default: 5s)
--max-reconcile-rate    The global maximum rate per second at which resources may checked for drift from the desired state. (Default: 100)
--webhook-port           The port the webhook server listens on. (Env: WEBHOOK_PORT, Default: 9443)
--metrics-bind-address   The address the metrics server listens on. (Env: METRICS_BIND_ADDRESS, Default: :8080)
--health-probe-bind-addr The address the health/readiness probe server listens on. (Env: HEALTH_PROBE_BIND_ADDRESS, Default: :8081)
--enable-management-policies Enable support for Management Policies. (Env: ENABLE_MANAGEMENT_POLICIES, Default: true)
--enable-changelogs      Enable support for capturing change logs during reconciliation. (Env: ENABLE_CHANGE_LOGS, Default: false)
--changelogs-socket-path Path for changelogs socket (if enabled). (Env: CHANGELOGS_SOCKET_PATH, Default: /var/run/changelogs/changelogs.sock)
--enable-secret-cache   Enable caching of Secret objects. When true, Secrets are served from the informer cache instead of direct API calls. (Env: ENABLE_SECRET_CACHE, Default: true)