Skip to content

feat(k8s): a Helm chart deploys its objects, images and values - #2663

Merged
DeusData merged 1 commit into
mainfrom
feat/helm-chart-edges
Oct 16, 2026
Merged

DeusData merged 1 commit into
mainfrom
feat/helm-chart-edges

Conversation

@DeusData

Copy link
Copy Markdown
Owner

Summary

Feedback: Kubernetes manifests index well, Helm charts do not. A Chart node was an isolated leaf.

Its only outgoing edge was DEPENDS_ON, for a dependency its Chart.yaml declares. The chart directory was used only as a scope, for bundle naming and for include resolution. Nothing linked a chart to the objects its templates render, to its values files, or to the images it runs.

Change (src/pipeline/pass_k8s.c)

Edge From → to
DEPLOYS {via: chart} Chart → each Resource in <chart>/templates/ (nearest enclosing chart, so a subchart's objects are the subchart's). This is the same edge a Flux Kustomization draws to the objects it applies.
CONFIGURES {strategy: helm_values} values.yaml / values-<x>.yaml beside Chart.yaml → Chart. A values file elsewhere, such as ci/test-values.yaml, does not.
DEPLOYS {via: chart, ref: image} Chart → each Image its objects name literally. It is read after pass_docker.c moved references onto component Images. A templated image ({{ .Values.image.repository }}) names no Image, and no values default is read.

With these edges, HelmRelease → Chart → Deployment → Image is one traversable path. No new edge type or label is added.

Incremental runs (pipeline_incremental.c):

  • A closure repair re-runs the K8s pass over its plan only, so a values file or template edited alone would lose its chart edge.
  • Such an edit now declines to the full rebuild, as a Chart.yaml edit already does: helm_values_changed, helm_template_changed.

Proof on real input

Indexed with builds of ec6427c3 and of this branch. The corpora are the 17 pinned infra corpora plus the Phase-8 split-system ones (opentelemetry-helm-charts, podinfo, prometheus/prometheus):

before after
Charts with no outgoing edge 238 of 260 109
Chart → object (DEPLOYS) 0 2,511
values file → Chart (CONFIGURES) 0 112
Chart → Image (DEPLOYS ref:image) 0 25
objects in templates/ not reached from a Chart 2,626 115
every other edge 1,428,293 1,428,293, identical in every corpus
  • prometheus-community/helm-charts, where the feedback came from: 51 → 7 leaf charts, and all 580 template objects are linked.
  • Every remaining leaf Chart there is an external dependency, an OCI or __helm_dep__ chart without local templates.
  • The 115 unlinked objects sit in templates/ directories with no Chart.yaml:
    • deckhouse's werf .helm/ directories;
    • gardener's Go-embedded component templates;
    • cluster-api's clusterctl templates.

Tests

  • probe_helm_chart_deploys_its_objects (grammar_probe_f) uses a chart with a subchart, two values files and a ci/ values file. Its objects use one templated image and two literal ones. The test asserts the full Chart edge set. On ec6427c3 the set is empty.
  • incremental_helm_values_edit_keeps_chart_edge (pipeline_semantic_manifest_repro) edits values.yaml and checks that its CONFIGURES edge survives through a full rebuild.
    • On ec6427c3 it fails at before == 0.
    • With only the decline rule reverted, it fails at after == 0: the edge is lost on the edit.

Verification

  • macOS, ASan + UBSan test runner, whole suite on the final tree: 9707 passed, 0 failed. The 11 skipped tests are platform-only (Linux user namespaces, Windows ACL, Job Object and PowerShell probes). No sanitizer reports.
  • clang-format (Homebrew LLVM) and cppcheck 2.20 (the CI version) are clean on the changed sources.
  • Skipped locally: the Linux and Windows legs. The change is platform-neutral graph code; PR CI runs both.
  • Independent of fix(docker): never invent a registry host for an image #2654 (image hosts, index format 3). The tests use images with a stated registry, so they pass in either merge order. No format bump here: the edges are additive, and an edit to any chart input rebuilds.

Found, not changed here

  • Values are not traced. A template's {{ .Values.image.repository }} stays the placeholder <.Values.image.repository>. Nothing links it to the values key, or to the overrides that set it: HelmRelease values, kustomize helmCharts.valuesInline, Terraform set {}, helm install -f. Value backtracing, and per-release variants with resolved images, are a separate design.
  • crds/ objects, which Helm installs before templates/, are not linked from the Chart.
  • werf .helm/ directories without Chart.yaml are not treated as charts.

A Chart node had one kind of outgoing edge, DEPENDS_ON for a dependency
its Chart.yaml declares. A chart without dependencies, most of them, was
an isolated leaf: nothing linked it to the objects its templates render,
to its values files, or to the images it runs. On 20 pinned infra
corpora, 238 of 260 Charts had no outgoing edge, while 2,626 objects sat
in chart templates/ directories.

- Chart -DEPLOYS {via: chart}-> each Resource of <chart>/templates/, for
  its nearest enclosing chart: a subchart's objects are the subchart's.
  The same edge a Flux Kustomization draws to what it applies.
- values.yaml / values-<x>.yaml beside Chart.yaml -CONFIGURES {strategy:
  helm_values}-> the Chart.
- Chart -DEPLOYS {via: chart, ref: image}-> each Image its objects name
  literally, read after pass_docker.c moved references onto component
  Images. A templated image names no Image, and no values default is read.

An incremental closure repair re-runs the K8s pass over its plan only, so
a values file or a template edited alone would lose the chart's edge; such
an edit now declines to the full rebuild, like a Chart.yaml edit.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
@DeusData
DeusData merged commit e7ea0af into main Oct 16, 2026
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant