From 410c2a832163ad598ecefdb8718dbc2b2bba4de0 Mon Sep 17 00:00:00 2001 From: Anasawara Suresh M K <116827111+Anaswara-Suresh@users.noreply.github.com> Date: Tue, 28 Jul 2026 20:45:44 +0530 Subject: [PATCH] Chore: avoid Helm <3.9 template crash in cluster-gateway caBundle guard GWCP-106309 (#7256) * fix: avoid Helm <3.9 template crash in cluster-gateway caBundle guard Signed-off-by: anaswara-suresh * fix: pin Helm installation to specific version to catch template regressions Signed-off-by: Vishal Kumar * formatting Signed-off-by: Vishal Kumar --------- Signed-off-by: anaswara-suresh Signed-off-by: Vishal Kumar --- .github/actions/env-setup/action.yaml | 4 +++- .../templates/cluster-gateway/cluster-gateway.yaml | 12 +++++++++--- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/.github/actions/env-setup/action.yaml b/.github/actions/env-setup/action.yaml index 462d8fa4c..4ce02ee3a 100644 --- a/.github/actions/env-setup/action.yaml +++ b/.github/actions/env-setup/action.yaml @@ -57,8 +57,10 @@ runs: chmod +x kubectl sudo mv kubectl /usr/local/bin/ - # Install helm using the official script + # Install helm using the official script, pinned so CI catches + # Helm-version-specific template regressions echo "Installing Helm using official script..." + export DESIRED_VERSION=v3.6.3 curl -fsSL --retry 3 -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 chmod 700 get_helm.sh ./get_helm.sh diff --git a/charts/vela-core/templates/cluster-gateway/cluster-gateway.yaml b/charts/vela-core/templates/cluster-gateway/cluster-gateway.yaml index e9836baa3..cfa17f023 100644 --- a/charts/vela-core/templates/cluster-gateway/cluster-gateway.yaml +++ b/charts/vela-core/templates/cluster-gateway/cluster-gateway.yaml @@ -162,13 +162,19 @@ spec: versionPriority: 10 insecureSkipTLSVerify: {{ not .Values.multicluster.clusterGateway.secureTLS.enabled }} {{ if .Values.multicluster.clusterGateway.secureTLS.enabled }} - {{- /* Preserve an already-valid caBundle on upgrade so we don't reset it to the + {{- /* Preserve an already-valid caBundle on upgrade so we don't reset it to the Cg== placeholder before the patch Job re-runs $apiSvc is the existing APIService looked up above; fall back to the placeholder only on fresh install or when it still holds the placeholder. */}} {{- $caBundle := "Cg==" }} - {{- if and $apiSvc $apiSvc.spec (hasKey $apiSvc.spec "caBundle") (ne $apiSvc.spec.caBundle "Cg==") }} - {{- $caBundle = $apiSvc.spec.caBundle }} + {{- if $apiSvc }} + {{- if $apiSvc.spec }} + {{- if hasKey $apiSvc.spec "caBundle" }} + {{- if ne $apiSvc.spec.caBundle "Cg==" }} + {{- $caBundle = $apiSvc.spec.caBundle }} + {{- end }} + {{- end }} + {{- end }} {{- end }} caBundle: {{ $caBundle }} {{ end }}