Merge branch 'main' into pdmack/publish-release-tag-versioning

Author: pdmack

pkg/bundler/deployer/helm/templates/README.md.tmpl

@@ -66,6 +66,15 @@ cd NNN-<component-name>
 bash install.sh
 ```
 
+> **Helm 4 vs Helm 3:** On Helm 4 (server-side apply by default), each
+> `install.sh` automatically passes `--force-conflicts` so the upgrade can
+> overwrite fields that operators (cert-manager, gpu-operator, nvsentinel,
+> grove, ...) own on their rotated webhook cert Secrets — without it the
+> upgrade fails on field-manager conflicts. On Helm 3 (client-side apply,
+> no field-manager conflicts) the flag is omitted; the script detects the
+> Helm major version at run time, so the same bundle works with either
+> binary.
+
 ## Customization
 
 Each component folder has its own `values.yaml` (static) and `cluster-values.yaml`

pkg/bundler/deployer/helm/testdata/kai_scheduler_present/001-kai-scheduler/install.sh

@@ -19,10 +19,21 @@ cd "${SCRIPT_DIR}"
 # shellcheck source=/dev/null
 source ./upstream.env
 
+# Helm 4 uses server-side apply by default; --force-conflicts lets the
+# upgrade overwrite fields that operators (cert-manager, gpu-operator,
+# nvsentinel, ...) own on rotated webhook cert Secrets. Helm 3 uses
+# client-side apply (no field-manager conflicts) and does not recognize
+# the flag, so omit it on Helm 3.
+HELM_MAJOR=$(helm version --template '{{.Version}}' 2>/dev/null | sed -nE 's/^v([0-9]+)\..*/\1/p')
+FORCE_CONFLICTS_FLAG=""
+if [[ "${HELM_MAJOR:-0}" -ge 4 ]]; then
+  FORCE_CONFLICTS_FLAG="--force-conflicts"
+fi
+
 # CHART carries the full OCI URI for OCI charts and just the chart name for
 # HTTP/HTTPS charts. REPO is non-empty only for HTTP/HTTPS charts; the
 # ${REPO:+--repo "${REPO}"} expansion adds --repo iff REPO is set.
-helm upgrade --install kai-scheduler "${CHART}" \
+helm upgrade --install ${FORCE_CONFLICTS_FLAG} kai-scheduler "${CHART}" \
   ${REPO:+--repo "${REPO}"} --version "${VERSION}" \
   --namespace kai-scheduler --create-namespace \
   -f values.yaml -f cluster-values.yaml \

pkg/bundler/deployer/helm/testdata/kai_scheduler_present/README.md

@@ -50,6 +50,15 @@ cd NNN-<component-name>
 bash install.sh
 ```
 
+> **Helm 4 vs Helm 3:** On Helm 4 (server-side apply by default), each
+> `install.sh` automatically passes `--force-conflicts` so the upgrade can
+> overwrite fields that operators (cert-manager, gpu-operator, nvsentinel,
+> grove, ...) own on their rotated webhook cert Secrets — without it the
+> upgrade fails on field-manager conflicts. On Helm 3 (client-side apply,
+> no field-manager conflicts) the flag is omitted; the script detects the
+> Helm major version at run time, so the same bundle works with either
+> binary.
+
 ## Customization
 
 Each component folder has its own `values.yaml` (static) and `cluster-values.yaml`

pkg/bundler/deployer/helm/testdata/manifest_only/001-skyhook-customizations/install.sh

@@ -17,7 +17,16 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 cd "${SCRIPT_DIR}"
 
-helm upgrade --install skyhook-customizations ./ \
+# Helm 4 uses server-side apply by default; --force-conflicts lets the
+# upgrade overwrite fields that operators own on rotated webhook cert
+# Secrets. Helm 3 uses client-side apply and does not recognize the flag.
+HELM_MAJOR=$(helm version --template '{{.Version}}' 2>/dev/null | sed -nE 's/^v([0-9]+)\..*/\1/p')
+FORCE_CONFLICTS_FLAG=""
+if [[ "${HELM_MAJOR:-0}" -ge 4 ]]; then
+  FORCE_CONFLICTS_FLAG="--force-conflicts"
+fi
+
+helm upgrade --install ${FORCE_CONFLICTS_FLAG} skyhook-customizations ./ \
   --namespace skyhook --create-namespace \
   -f values.yaml -f cluster-values.yaml \
   ${COMPONENT_WAIT_ARGS:-} ${DRY_RUN_FLAG:-} ${KUBECONFIG_FLAG:-} ${HELM_DEBUG_FLAG:-}

pkg/bundler/deployer/helm/testdata/manifest_only/README.md

@@ -50,6 +50,15 @@ cd NNN-<component-name>
 bash install.sh
 ```
 
+> **Helm 4 vs Helm 3:** On Helm 4 (server-side apply by default), each
+> `install.sh` automatically passes `--force-conflicts` so the upgrade can
+> overwrite fields that operators (cert-manager, gpu-operator, nvsentinel,
+> grove, ...) own on their rotated webhook cert Secrets — without it the
+> upgrade fails on field-manager conflicts. On Helm 3 (client-side apply,
+> no field-manager conflicts) the flag is omitted; the script detects the
+> Helm major version at run time, so the same bundle works with either
+> binary.
+
 ## Customization
 
 Each component folder has its own `values.yaml` (static) and `cluster-values.yaml`

pkg/bundler/deployer/helm/testdata/mixed_gpu_operator/001-gpu-operator-pre/install.sh

@@ -17,7 +17,16 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 cd "${SCRIPT_DIR}"
 
-helm upgrade --install gpu-operator-pre ./ \
+# Helm 4 uses server-side apply by default; --force-conflicts lets the
+# upgrade overwrite fields that operators own on rotated webhook cert
+# Secrets. Helm 3 uses client-side apply and does not recognize the flag.
+HELM_MAJOR=$(helm version --template '{{.Version}}' 2>/dev/null | sed -nE 's/^v([0-9]+)\..*/\1/p')
+FORCE_CONFLICTS_FLAG=""
+if [[ "${HELM_MAJOR:-0}" -ge 4 ]]; then
+  FORCE_CONFLICTS_FLAG="--force-conflicts"
+fi
+
+helm upgrade --install ${FORCE_CONFLICTS_FLAG} gpu-operator-pre ./ \
   --namespace privileged-gpu-operator \
   -f values.yaml -f cluster-values.yaml \
   ${COMPONENT_WAIT_ARGS:-} ${DRY_RUN_FLAG:-} ${KUBECONFIG_FLAG:-} ${HELM_DEBUG_FLAG:-}

pkg/bundler/deployer/helm/testdata/mixed_gpu_operator/002-gpu-operator/install.sh

@@ -19,10 +19,21 @@ cd "${SCRIPT_DIR}"
 # shellcheck source=/dev/null
 source ./upstream.env
 
+# Helm 4 uses server-side apply by default; --force-conflicts lets the
+# upgrade overwrite fields that operators (cert-manager, gpu-operator,
+# nvsentinel, ...) own on rotated webhook cert Secrets. Helm 3 uses
+# client-side apply (no field-manager conflicts) and does not recognize
+# the flag, so omit it on Helm 3.
+HELM_MAJOR=$(helm version --template '{{.Version}}' 2>/dev/null | sed -nE 's/^v([0-9]+)\..*/\1/p')
+FORCE_CONFLICTS_FLAG=""
+if [[ "${HELM_MAJOR:-0}" -ge 4 ]]; then
+  FORCE_CONFLICTS_FLAG="--force-conflicts"
+fi
+
 # CHART carries the full OCI URI for OCI charts and just the chart name for
 # HTTP/HTTPS charts. REPO is non-empty only for HTTP/HTTPS charts; the
 # ${REPO:+--repo "${REPO}"} expansion adds --repo iff REPO is set.
-helm upgrade --install gpu-operator "${CHART}" \
+helm upgrade --install ${FORCE_CONFLICTS_FLAG} gpu-operator "${CHART}" \
   ${REPO:+--repo "${REPO}"} --version "${VERSION}" \
   --namespace privileged-gpu-operator --create-namespace \
   -f values.yaml -f cluster-values.yaml \

pkg/bundler/deployer/helm/testdata/mixed_gpu_operator/003-gpu-operator-post/install.sh

@@ -17,7 +17,16 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 cd "${SCRIPT_DIR}"
 
-helm upgrade --install gpu-operator-post ./ \
+# Helm 4 uses server-side apply by default; --force-conflicts lets the
+# upgrade overwrite fields that operators own on rotated webhook cert
+# Secrets. Helm 3 uses client-side apply and does not recognize the flag.
+HELM_MAJOR=$(helm version --template '{{.Version}}' 2>/dev/null | sed -nE 's/^v([0-9]+)\..*/\1/p')
+FORCE_CONFLICTS_FLAG=""
+if [[ "${HELM_MAJOR:-0}" -ge 4 ]]; then
+  FORCE_CONFLICTS_FLAG="--force-conflicts"
+fi
+
+helm upgrade --install ${FORCE_CONFLICTS_FLAG} gpu-operator-post ./ \
   --namespace privileged-gpu-operator --create-namespace \
   -f values.yaml -f cluster-values.yaml \
   ${COMPONENT_WAIT_ARGS:-} ${DRY_RUN_FLAG:-} ${KUBECONFIG_FLAG:-} ${HELM_DEBUG_FLAG:-}

pkg/bundler/deployer/helm/testdata/mixed_gpu_operator/README.md

@@ -50,6 +50,15 @@ cd NNN-<component-name>
 bash install.sh
 ```
 
+> **Helm 4 vs Helm 3:** On Helm 4 (server-side apply by default), each
+> `install.sh` automatically passes `--force-conflicts` so the upgrade can
+> overwrite fields that operators (cert-manager, gpu-operator, nvsentinel,
+> grove, ...) own on their rotated webhook cert Secrets — without it the
+> upgrade fails on field-manager conflicts. On Helm 3 (client-side apply,
+> no field-manager conflicts) the flag is omitted; the script detects the
+> Helm major version at run time, so the same bundle works with either
+> binary.
+
 ## Customization
 
 Each component folder has its own `values.yaml` (static) and `cluster-values.yaml`

pkg/bundler/deployer/helm/testdata/mixed_with_pre/001-foo-pre/install.sh

@@ -17,7 +17,16 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 cd "${SCRIPT_DIR}"
 
-helm upgrade --install foo-pre ./ \
+# Helm 4 uses server-side apply by default; --force-conflicts lets the
+# upgrade overwrite fields that operators own on rotated webhook cert
+# Secrets. Helm 3 uses client-side apply and does not recognize the flag.
+HELM_MAJOR=$(helm version --template '{{.Version}}' 2>/dev/null | sed -nE 's/^v([0-9]+)\..*/\1/p')
+FORCE_CONFLICTS_FLAG=""
+if [[ "${HELM_MAJOR:-0}" -ge 4 ]]; then
+  FORCE_CONFLICTS_FLAG="--force-conflicts"
+fi
+
+helm upgrade --install ${FORCE_CONFLICTS_FLAG} foo-pre ./ \
   --namespace privileged-foo \
   -f values.yaml -f cluster-values.yaml \
   ${COMPONENT_WAIT_ARGS:-} ${DRY_RUN_FLAG:-} ${KUBECONFIG_FLAG:-} ${HELM_DEBUG_FLAG:-}