Add helm insecure skip tls verify #901

noahlehmann · 2025-04-16T16:01:03Z

SUMMARY

Added the option insecure_skip_tls_verify to the following helm modules:

helm_repository
helm
Unified the option with alias in helm_pull

For helm, added the option to the helm diff call, as it got fixed upstream.

Upstream Issue: databus23/helm-diff#503
Fixed with: helm/helm#12856

Fixes #694

ISSUE TYPE

Bugfix Pull Request

COMPONENT NAME

kubernetes.core.helm
kubernetes.core.helm_repository
kubernetes.core.helm_pull

ADDITIONAL INFORMATION

Basically the option was added in the parameters set in the ansible job, in the docs and then injected in the helm and helm diff binary calls if set. Defaults to False.

Example

---
- name: Test helm modules
  tasks:
    - name: Test helm repository insecure
      kubernetes.core.helm_repository:
        name: insecure
        repo_url: "<helm-repo-with-self-signed-tls>"
        state: present
        insecure_skip_tls_verify: true
    - name: Test helm pull insecure
      kubernetes.core.helm_pull:
        chart_ref: "oci://<helm-repo-with-self-signed-tls>/ptroject"
        destination: /tmp
        insecure_skip_tls_verify: true
    - name: Test helm insecure
      kubernetes.core.helm:
        name: insecure
        chart_ref: "oci://<helm-repo-with-self-signed-tls>/project"
        namespace: helm-insecure-test
        state: present
        insecure_skip_tls_verify: true

Note

Might need an alias for telm_template, as the option is called insecure_registry, in the manual and docs of helm it would be --insecure-skip-tls-verify as well though.
Not included, as it was recently merged with #805

…n helm.py

…n helm_repository.py

…n helm_template.py

# Conflicts: # plugins/modules/helm.py # plugins/modules/helm_pull.py # plugins/modules/helm_repository.py # plugins/modules/helm_template.py

…d deploy usage

softwarefactory-project-zuul · 2025-04-16T16:10:55Z

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/cc6c25a497974fd98f140d8c4f2e3788

✔️ ansible-galaxy-importer SUCCESS in 3m 23s
✔️ build-ansible-collection SUCCESS in 5m 42s

plugins/modules/helm.py

plugins/modules/helm_repository.py

noahlehmann · 2025-04-22T17:55:02Z

@yurnov thanks for checking in. Bumped the version_added field to 5.3.0 for now, can change to 6.0.0 whenever needed. Let me know.

softwarefactory-project-zuul · 2025-04-22T18:19:36Z

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/be84d0c20dbd4e7cb9c2ddfe558d3a6b

✔️ ansible-galaxy-importer SUCCESS in 5m 05s
✔️ build-ansible-collection SUCCESS in 5m 26s

plugins/modules/helm_pull.py

abikouo

@noahlehmann, thanks for your contribution to this collection.
It would be nice to add unit or integration tests related to this new feature.

yurnov · 2025-04-25T16:37:59Z

Hi @noahlehmann,

Do you need support with fixing CI issues (most of them will be fixed by the rebase and the remaining pat is basically linters) and test?

…ls-verify

…y' into add-helm-insecure-skip-tls-verify

softwarefactory-project-zuul · 2025-04-25T17:35:52Z

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/5d0de94e086c471a8661e8917abbbc3b

✔️ ansible-galaxy-importer SUCCESS in 3m 11s
✔️ build-ansible-collection SUCCESS in 5m 35s

noahlehmann · 2025-04-25T19:12:48Z

@yurnov Thanks, but got the linting jobs fixed.

@abikouo The only reasonable test I can think of in the setup is unit testing the helm command to check whether the flag --insecure-skip-tls-verify is set/not-set properly. Preparing a testable helm registry seams way overkill, considering the integration tests seems to run on a fixed repo (ingress-nginx).

I also only see unit tests for complex tasks in the modules helm and helm_template.

Maybe you could guide me on what you had in mind?

yurnov · 2025-04-25T20:21:17Z

@yurnov Thanks, but got the linting jobs fixed.

@abikouo The only reasonable test I can think of in the setup is unit testing the helm command to check whether the flag --insecure-skip-tls-verify is set/not-set properly. Preparing a testable helm registry seams way overkill, considering the integration tests seems to run on a fixed repo (ingress-nginx).

I also only see unit tests for complex tasks in the modules helm and helm_template.

Maybe you could guide me on what you had in mind?

I suggest adding an additional integration test in the same way as here

So, in your case, it will be something like:

    - name: Install chart with insecure-skip-tls-verify
      helm:
        binary_path: "{{ helm_binary }}"
        chart_ref: oci://registry-1.docker.io/bitnamicharts/redis
        release_name: test-redis
        release_namespace: "{{ helm_namespace }}"
        create_namespace: true
        release_values: "{{ chart_release_values }}"
        insecure_skip_tls_verify: true
      register: install

    - name: Assert that --insecure-skip-tls-verify is used
      assert:
        that:
          - install is changed
          - '"--insecure-skip-tls-verify" in install.command'
          - '"--tls" not in install.command'
          - '"--ca-file" not in install.command'

…n requirement

noahlehmann · 2025-04-26T12:34:51Z

@yurnov understood, thanks.

I intentionally left out the mutual exclusion of the ca-file flag, as helm itself doesn't care as well. As far as I could tell at least.

softwarefactory-project-zuul · 2025-04-26T12:40:57Z

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/bf418fd9f987433e8315d72436927891

✔️ ansible-galaxy-importer SUCCESS in 3m 13s
✔️ build-ansible-collection SUCCESS in 5m 42s

yurnov · 2025-04-26T13:09:56Z

@yurnov understood, thanks.

I intentionally left out the mutual exclusion of the ca-file flag, as helm itself doesn't care as well. As far as I could tell at least.

I added '"--ca-file" not in install.command' just as an example, that is not required at all

…kip-tls-verify # Conflicts: # plugins/modules/helm.py # tests/integration/targets/helm/defaults/main.yml

noahlehmann · 2025-04-28T20:10:56Z

Updated the changes, last merge to main had conflicts with this PR.
Tested and formatted.

softwarefactory-project-zuul · 2025-04-28T20:18:41Z

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/5a8076155c40433b828c275da0e66781

✔️ ansible-galaxy-importer SUCCESS in 3m 13s
✔️ build-ansible-collection SUCCESS in 5m 23s

plugins/modules/helm.py

softwarefactory-project-zuul · 2025-04-30T14:28:53Z

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/1030eea287b8463e82f6d5144f57e51b

✔️ ansible-galaxy-importer SUCCESS in 3m 21s
✔️ build-ansible-collection SUCCESS in 5m 30s

…t if the CRD is installed prior running the test

softwarefactory-project-zuul · 2025-05-02T15:12:16Z

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/65deec3bc2eb4f9893651988e4b984ac

✔️ ansible-galaxy-importer SUCCESS in 3m 06s
✔️ build-ansible-collection SUCCESS in 5m 33s

softwarefactory-project-zuul · 2025-05-02T16:24:26Z

Build succeeded (gate pipeline).
https://ansible.softwarefactory-project.io/zuul/buildset/bdbd308ecf8b4da28f6f2b174a246fa1

✔️ ansible-galaxy-importer SUCCESS in 5m 46s
✔️ build-ansible-collection SUCCESS in 5m 26s

patchback · 2025-05-02T16:30:01Z

Backport to stable-5: 💚 backport PR created

✅ Backport PR branch: patchback/backports/stable-5/914a16ec5cfb806ccc529d610295c9481da4566b/pr-901

Backported as #925

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

SUMMARY Added the option insecure_skip_tls_verify to the following helm modules: helm_repository helm Unified the option with alias in helm_pull For helm, added the option to the helm diff call, as it got fixed upstream. Upstream Issue: databus23/helm-diff#503 Fixed with: helm/helm#12856 Fixes #694 ISSUE TYPE Bugfix Pull Request COMPONENT NAME kubernetes.core.helm kubernetes.core.helm_repository kubernetes.core.helm_pull ADDITIONAL INFORMATION Basically the option was added in the parameters set in the ansible job, in the docs and then injected in the helm and helm diff binary calls if set. Defaults to False. Example --- - name: Test helm modules tasks: - name: Test helm repository insecure kubernetes.core.helm_repository: name: insecure repo_url: "<helm-repo-with-self-signed-tls>" state: present insecure_skip_tls_verify: true - name: Test helm pull insecure kubernetes.core.helm_pull: chart_ref: "oci://<helm-repo-with-self-signed-tls>/ptroject" destination: /tmp insecure_skip_tls_verify: true - name: Test helm insecure kubernetes.core.helm: name: insecure chart_ref: "oci://<helm-repo-with-self-signed-tls>/project" namespace: helm-insecure-test state: present insecure_skip_tls_verify: true Note Might need an alias for telm_template, as the option is called insecure_registry, in the manual and docs of helm it would be --insecure-skip-tls-verify as well though. Not included, as it was recently merged with #805 Reviewed-by: Yuriy Novostavskiy Reviewed-by: Noah Lehmann Reviewed-by: Bikouo Aubin Reviewed-by: Bianca Henderson <[email protected]> Reviewed-by: Mike Graves <[email protected]> (cherry picked from commit 914a16e)

This is a backport of PR #901 as merged into main (914a16e). SUMMARY Added the option insecure_skip_tls_verify to the following helm modules: helm_repository helm Unified the option with alias in helm_pull For helm, added the option to the helm diff call, as it got fixed upstream. Upstream Issue: databus23/helm-diff#503 Fixed with: helm/helm#12856 Fixes #694 ISSUE TYPE Bugfix Pull Request COMPONENT NAME kubernetes.core.helm kubernetes.core.helm_repository kubernetes.core.helm_pull ADDITIONAL INFORMATION Basically the option was added in the parameters set in the ansible job, in the docs and then injected in the helm and helm diff binary calls if set. Defaults to False. Example --- - name: Test helm modules tasks: - name: Test helm repository insecure kubernetes.core.helm_repository: name: insecure repo_url: "<helm-repo-with-self-signed-tls>" state: present insecure_skip_tls_verify: true - name: Test helm pull insecure kubernetes.core.helm_pull: chart_ref: "oci://<helm-repo-with-self-signed-tls>/ptroject" destination: /tmp insecure_skip_tls_verify: true - name: Test helm insecure kubernetes.core.helm: name: insecure chart_ref: "oci://<helm-repo-with-self-signed-tls>/project" namespace: helm-insecure-test state: present insecure_skip_tls_verify: true Note Might need an alias for telm_template, as the option is called insecure_registry, in the manual and docs of helm it would be --insecure-skip-tls-verify as well though. Not included, as it was recently merged with #805 Reviewed-by: Bianca Henderson <[email protected]> Reviewed-by: Mike Graves <[email protected]>

noahlehmann added 8 commits April 16, 2024 15:07

add-helm-insecure-skip-tls-verify: Add alias for consistency

a062543

add-helm-insecure-skip-tls-verify: add flag for ignoring repo certs i…

e09514c

…n helm.py

add-helm-insecure-skip-tls-verify: add flag for ignoring repo certs i…

71103cf

…n helm_repository.py

add-helm-insecure-skip-tls-verify: add flag for ignoring repo certs i…

bac8488

…n helm_template.py

add-helm-insecure-skip-tls-verify: add flag for ignoring repo certs i…

fae1569

…n helm_template.py

Merge branch 'main' into add-helm-insecure-skip-tls-verify

eafcf11

# Conflicts: # plugins/modules/helm.py # plugins/modules/helm_pull.py # plugins/modules/helm_repository.py # plugins/modules/helm_template.py

add-helm-insecure-skip-tls-verify: adjust changelog

a497478

add-helm-insecure-skip-tls-verify: adjust version added in docs, fixe…

8d6b2dc

…d deploy usage

noahlehmann mentioned this pull request Apr 16, 2025

validate_certs=no not work in helm module #694

Closed

yurnov reviewed Apr 16, 2025

View reviewed changes

plugins/modules/helm.py Outdated Show resolved Hide resolved

plugins/modules/helm_repository.py Outdated Show resolved Hide resolved

add-helm-insecure-skip-tls-verify: bump version_added to 5.3.0

8211244

abikouo reviewed Apr 25, 2025

View reviewed changes

plugins/modules/helm_pull.py Show resolved Hide resolved

abikouo reviewed Apr 25, 2025

View reviewed changes

noahlehmann and others added 5 commits April 25, 2025 18:57

add-helm-insecure-skip-tls-verify: added alias version description

039d2bd

add-helm-insecure-skip-tls-verify: formatted changes using black

c41c866

add-helm-insecure-skip-tls-verify: remove trailing whitespaces

898e8f9

Merge branch 'ansible-collections:main' into add-helm-insecure-skip-t…

44ce3c2

…ls-verify

Merge remote-tracking branch 'origin/add-helm-insecure-skip-tls-verif…

5d76f70

…y' into add-helm-insecure-skip-tls-verify

noahlehmann added 2 commits April 26, 2025 13:35

add-helm-insecure-skip-tls-verify: add integration test and collectio…

8ffcaec

…n requirement

add-helm-insecure-skip-tls-verify: add integration test for helm

6525483

abikouo approved these changes Apr 28, 2025

View reviewed changes

noahlehmann added 2 commits April 28, 2025 21:53

Merge remote-tracking branch 'upstream/main' into add-helm-insecure-s…

cdadf40

…kip-tls-verify # Conflicts: # plugins/modules/helm.py # tests/integration/targets/helm/defaults/main.yml

add-helm-insecure-skip-tls-verify: fix after merge

a74336e

beeankha approved these changes Apr 29, 2025

View reviewed changes

gravesm reviewed Apr 29, 2025

View reviewed changes

plugins/modules/helm.py Show resolved Hide resolved

plugins/modules/helm.py Show resolved Hide resolved

add-helm-insecure-skip-tls-verify: add helm 3.16 as requirement

b4d93e8

Once installed the CRD resource are not deleted, this commit will tes…

ee09650

…t if the CRD is installed prior running the test

gravesm approved these changes May 2, 2025

View reviewed changes

abikouo added the mergeit label May 2, 2025

softwarefactory-project-zuul bot merged commit 914a16e into ansible-collections:main May 2, 2025
53 checks passed

abikouo added the backport-5 label May 2, 2025

patchback bot mentioned this pull request May 2, 2025

[PR #901/914a16ec backport][stable-5] Add helm insecure skip tls verify #925

Merged

Add helm insecure skip tls verify #901

Add helm insecure skip tls verify #901

Uh oh!

Conversation

noahlehmann commented Apr 16, 2025

SUMMARY

ISSUE TYPE

COMPONENT NAME

ADDITIONAL INFORMATION

Example

Note

Uh oh!

softwarefactory-project-zuul bot commented Apr 16, 2025

Uh oh!

Uh oh!

Uh oh!

noahlehmann commented Apr 22, 2025

Uh oh!

softwarefactory-project-zuul bot commented Apr 22, 2025

Uh oh!

Uh oh!

abikouo left a comment

Choose a reason for hiding this comment

Uh oh!

yurnov commented Apr 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

softwarefactory-project-zuul bot commented Apr 25, 2025

Uh oh!

noahlehmann commented Apr 25, 2025

Uh oh!

yurnov commented Apr 25, 2025

Uh oh!

noahlehmann commented Apr 26, 2025

Uh oh!

softwarefactory-project-zuul bot commented Apr 26, 2025

Uh oh!

yurnov commented Apr 26, 2025

Uh oh!

noahlehmann commented Apr 28, 2025

Uh oh!

softwarefactory-project-zuul bot commented Apr 28, 2025

Uh oh!

Uh oh!

Uh oh!

softwarefactory-project-zuul bot commented Apr 30, 2025

Uh oh!

softwarefactory-project-zuul bot commented May 2, 2025

Uh oh!

softwarefactory-project-zuul bot commented May 2, 2025

Uh oh!

Uh oh!

patchback bot commented May 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Backport to stable-5: 💚 backport PR created

Uh oh!

Uh oh!

yurnov commented Apr 25, 2025 •

edited

Loading

patchback bot commented May 2, 2025 •

edited

Loading