Uh oh!
There was an error while loading. Please reload this page.
Conversation
Ship a chart-side CronJob that polls the published Helm repo daily and runs
`helm upgrade --reuse-values` when a newer chart version is available, so
deployed clients no longer freeze on the version they first installed and
miss security/stability fixes.
- New templates: auto-upgrade-cronjob.yaml (ConfigMap + CronJob),
auto-upgrade-rbac.yaml (ServiceAccount + ClusterRoleBinding to the
built-in cluster-admin ClusterRole).
- New values: autoUpgrade.{enabled, schedule, repoUrl, repoName, chartName,
timeout, suspend, successfulJobsHistoryLimit, failedJobsHistoryLimit,
startingDeadlineSeconds, image, resources}; default ON.
- Pod satisfies PSA restricted (runAsNonRoot, dropped caps, RO root,
RuntimeDefault seccomp); HOME/HELM_*_HOME redirected to a tmp emptyDir.
- Version compare uses sort -V so 1.10 > 1.9.
- Bumps chart 1.2.3 -> 1.3.0; MIGRATION.md documents how to opt out.
Cluster-admin (rather than a curated narrow role) keeps the upgrader
robust: the chart already templates cluster-scoped resources
(PriorityClass, StorageClass, ClusterRole/Binding, optionally Namespace),
so a narrower role would silently break the day a future chart adds a new
resource kind. Operators who want tighter posture can disable the feature
and run `helm upgrade` manually.
Backend reporting from the issue is intentionally deferred — no endpoint
exists yet; will land as a follow-up once the contract is defined.Caught during the #69 verification on tb-client-dev-templates: a dry-run 1.1.0 -> 1.3.0 helm upgrade with --reuse-values fails with template: client/templates/auto-upgrade-rbac.yaml:1:14: executing "..." at <.Values.autoUpgrade.enabled>: nil pointer evaluating interface {}.enabled because --reuse-values reuses the previous release's COMPUTED values, not just user overrides — so any top-level key added to values.yaml in the upgraded chart (autoUpgrade in 1.3.0, anything similar in future bumps) is absent from the merged values when rendering and the new templates blow up. --reset-then-reuse-values (helm 3.14+, available in our pinned alpine/helm 3.16.4 image) resets to the new chart's defaults, then layers the customer's user-supplied values on top — operator overrides like clientId, dockerRegistry creds, or autoUpgrade.enabled=false are preserved while new defaults flow through. - Switch the in-chart upgrade script to --reset-then-reuse-values. - Update the unit test to assert the corrected flag. - MIGRATION.md: tell operators to use the same flag for the manual 1.x -> 1.3.0 jump (subsequent chart bumps will go through the CronJob, which now uses the right flag itself).
feat(client): self-upgrade CronJob (closes#69)
saqlainsyed007
approved these changes
Apr 30, 2026
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Related
Type of change
Test plan
Screenshots / recordings
Deployment notes
Checklist
Note
High Risk
Installs a default-on CronJob that can mutate the release and binds its ServiceAccount to
cluster-admin, increasing blast radius if the pod or chart repo is compromised and potentially changing cluster state automatically over time.Overview
Bumps the
clientHelm chart to1.3.0and adds an opt-out, default-enabled self-upgrade mechanism that periodically upgrades the release to the latest published chart.This introduces new templates for an
auto-upgradeConfigMap+CronJob (runs a pinnedalpine/helmimage and executeshelm upgrade --reset-then-reuse-valuesafter semver-checking the repo) plus accompanying RBAC (ServiceAccount +cluster-adminClusterRoleBinding), wires the feature intovalues.yaml/values.schema.json, adds helm-unittest coverage, and updatesNOTES.txtandMIGRATION.mdwith upgrade/rollback guidance and the newautoUpgradeconfiguration.Reviewed by Cursor Bugbot for commit 39e5349. Bugbot is set up for automated code reviews on this repo. Configure here.