nikhilsbhat / helm-drift

Helm plugin that identifies the configuration that has drifted from the Helm chart

Hi there, I'm Nikhil Bhat 👋

I'm a passionate DevOps Engineer and an open-source enthusiast.

About Me

• 🌟 Creator of helm-images, helm-drift, and etc.
• 💻 Experienced in Kubernetes, Helm, Terraform, and Docker.
• 🛠️ Focused on building scalable and resilient infrastructure.
• 🐹 Enthusiastic about Go programming language.

Projects

Helm Plugins

• helm-images: A Helm plugin to manage container images in your Helm charts.
• helm-drift: A Helm plugin to detect drifts between your Helm releases and the Kubernetes cluster.

Other Notable Projects

• k3d-terraform-provider: A Terraform provider for managing K3D clusters.
• gocd-terraform-provider: A Terraform provider for managing GoCD resources.
• terragen: A tool for scaffolding Terraform providers.

       

helm-drift's Issues

Missing option to specify version of chart to run against

When using helm drift against chart and not release, it automatically takes latest chart in repo to check against.

for example:
helm drift run -n test-bo02-ca-02 test-bo02 repo/clientarea --skip-validation -f ../values-terragrunt-plan.yaml
would take latest chart of clientarea from repo repo and check against that.

In operational environments, it is often required to check againt some devel version or maybe little bit older version than latest in repo.

As workaround, one can fetch and unpack desired chart version into subfolder but this is extra step.

Please consider adding --version option for helm drift plugin

Target older chart version

How do you determine drift from a specific version of a helm chart and not the newest?

install on debian arm64 fails (tries to use aarch64 instead of arm64)

running on debian on arm-m1

helm plugin install https://github.com/nikhilsbhat/helm-drift

errors out with

Installing helm-drift...
download url set to https://github.com/nikhilsbhat/helm-drift/releases/download/v0.0.7/helm-drift_0.0.7_Linux_aarch64.tar.gz

artifact name with path /root/.local/share/helm/plugins/helm-drift/helm-drift.tar.gz

downloading https://github.com/nikhilsbhat/helm-drift/releases/download/v0.0.7/helm-drift_0.0.7_Linux_aarch64.tar.gz to /root/.local/share/helm/plugins/helm-drift

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (22) The requested URL returned error: 404 
failed while downloading helm archive

Failed to install plugin helm drift
Error: plugin install hook for "drift" exited with error

Since the files listed in releases have arm64 instead of aarch64, this is prob the cause.

Helm drift fails because of duplicate keys

Helm very annoyingly allows duplicate keys

This breaks the yaml parsing in helm-drift

helm drift all
2024/04/30 11:58:57 from_template.go:153: yaml: unmarshal errors:
  line 14: mapping key "app.kubernetes.io/managed-by" already defined at line 12
Error: plugin "drift" exited with error

We can fix the chart, but the plugin should also be more resilient to match the behavior of helm itself

max must be greater than 0

Just the project I was looking for!

I've tried running it on helm charts in my cluster and for every helm chart I get the error "max must be greater than 0"

< helm drift --log-level debug run datadog --from-release
{"level":"debug","msg":"all manifests rendered to disk was cleaned","time":"2023-05-25T10:46:16-07:00"}
{"level":"debug","msg":"got all required values to identify drifts from chart/release 'datadog' proceeding furter to fetch the same","time":"2023-05-25T10:46:16-07:00"}
{"level":"debug","msg":"from-release is selected, hence fetching manifests for 'datadog' from helm release","time":"2023-05-25T10:46:16-07:00"}
{"level":"debug","msg":"fetching chart manifest for release 'datadog' from kube cluster","time":"2023-05-25T10:46:16-07:00"}
{"level":"debug","msg":"chart manifest for release 'datadog' was successfully retrieved from kube cluster","time":"2023-05-25T10:46:17-07:00"}
{"level":"debug","msg":"splitting helm manifests with regex pattern: '---\\n# Source:\\s.*.'","time":"2023-05-25T10:46:17-07:00"}
{"level":"debug","msg":"rendering helm manifests to disk under /home/jack/.helm-drift/templates/datadog","time":"2023-05-25T10:46:17-07:00"}
{"level":"debug","msg":"creating directories '/home/jack/.helm-drift/templates/datadog' to generate manifests","time":"2023-05-25T10:46:17-07:00"}
2023/05/25 10:46:17 cmd.go:22: max must be greater than 0
Error: plugin "drift" exited with error

Unfortunately, I cannot share the values of the helm chats since they are private. Any idea why this could be the case?

Flag for excluding resources from detection

I have a scenario where I use hooks "helm.sh/hook: pre-install, pre-upgrade" and I want to exclude those resources, it can be based on KIND e.g "Job", "Deployment" etc.

Fails to identify multiple kubeconfig files

I've multiple clusters, split across several kubeconfig files. kubectl is able to handle these without issues with a kubeconfig env. var as follows:

KUBECONFIG="/infra/.kube/k8s.local:/infra/.kube/k8s.vault"

and i've not faced issue with this in other helm plugins i'm using (helm-dashboard). i wanted to give helm-drift a try, but it seems it fails to identify multiple kubeconfig files, and reports:

{"level":"fatal","msg":"calculating diff errored with: running kubectl diff errored with exit code: exit status 2 ,with message: error: stat /infra/.kube/k8s.local:/infra/.kube/k8s.vault: no such file or directory\n\nrunning kubectl diff errored with exit code: exit status 2 ,with message: error: stat /infra/.kube/k8s.local:/infra/.kube/k8s.vault: no such file or directory\n\nrunning kubectl diff errored with exit code: exit status 2 ,with message: error: stat /infra/.kube/k8s.local:/infra/.kube/k8s.vault: no such file or directory\n","time":"2024-02-14T09:09:37Z"}

Unable to execute drift because prerequisites failing

When trying to run drift
helm --debug -l debug drift run -n test-bo02-ca-02 test-bo02 --from-release -l debug
, I get

{"level":"info","msg":"exec: \"go\": executable file not found in $PATH","time":"2024-03-08T08:31:40Z"}
{"level":"info","msg":"helm-drift requires 'kubectl' to identify drifts","time":"2024-03-08T08:31:40Z"}
2024/03/08 08:31:40 cmd.go:22: validation failed, please install prerequisites to identify drifts
Error: plugin "drift" exited with error
helm.go:84: [debug] plugin "drift" exited with error

I have kubectl in path
kubectl version

Client Version: v1.28.4
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.28.5-eks-5e0fdde

helm drift version

drift version: {"version":"0.0.8","revision":"407b5c7627dc9403ee4d4f09f16863cdbb5aec06","environment":"production","build-date":"2023-10-29T16:50:21Z","go-version":"go1.21.1","platform":"linux/amd64"} 

Documentation does mention about kubectl being needed but nothing more specific.
Not sure if this is bug or documentation issue

new feat: exclude normal helm diff out when helm drift run RELEASE -f <valuesXXX.yaml> <local_chart_path>

My situation is that, in cluster deployed release with CHART version 1.0 and image tag 1_1, then manual edit one workload. Now going to install CHART version 1.1 and image tag 1_2.

I use helm drift run RELEASE -f <valuesXXX.yaml> <local_chart_v1.1_path> in my local, but drift found manual edit and image tag diff 1_1 -> 1_2. How to exclude image tag diff out in drift result because it's expected.

Actually, I want to merge the feature of helm drift run RELEASE from local chart and from release. The expected diff should be filtered out. If local chart value is same as manual update, it's also supposed to be filtered out.