Argument parsing for --kube-insecure-skip-tls-verify broken when used with helm v3.16.4

[bsmelo]

Current Behavior

Somewhere between helm v3.15.1 and v3.16.4, argument parsing for --kube-insecure-skip-tls-verify got broken when used with helm-secrets. I wasn't sure if I should post this issue here or in the helm repository, since it happens by changing only the version of helm itself, but at the same time is triggered only when the helm-secrets plugin is used.

Below is the behavior with helm v3.16.4:

$ helm version
version.BuildInfo{Version:"v3.16.4", GitCommit:"7877b45b63f95635153b29a42c0c2f4273ec45ca", GitTreeState:"clean", GoVersion:"go1.22.7"}
$ helm plugin list
NAME   	VERSION	DESCRIPTION                                                                  
secrets	4.6.2  	This plugin provides secrets values encryption for Helm charts secure storing

$ helm upgrade --install --kube-apiserver $MY_K8S_API_SERVER --kube-insecure-skip-tls-verify --kube-token $MY_K8S_API_TOKEN --namespace $MY_K8S_NAMESPACE mysql-test bitnami/mysql --dry-run=server
Release "mysql-test" does not exist. Installing it now.
Error: repo bitnami not found

$ helm secrets upgrade --install --kube-apiserver $MY_K8S_API_SERVER --kube-insecure-skip-tls-verify --kube-token $MY_K8S_API_TOKEN --namespace $MY_K8S_NAMESPACE mysql-test bitnami/mysql --dry-run=server
Error: "helm upgrade" requires 2 arguments

Usage:  helm upgrade [RELEASE] [CHART] [flags]
Error: plugin "secrets" exited with error

$ helm secrets upgrade --install --kube-apiserver $MY_K8S_API_SERVER --kube-insecure-skip-tls-verify=true --kube-token $MY_K8S_API_TOKEN --namespace $MY_K8S_NAMESPACE mysql-test bitnami/mysql --dry-run=server
Release "mysql-test" does not exist. Installing it now.
Error: repo bitnami not found
Error: plugin "secrets" exited with error

We can of course ignore the "Error: repo bitnami not found", it just means the command syntax actually worked.
What we see is that, with the same arguments, helm upgrade works, but helm secrets upgrade doesn't work. To fix the issue, we have to force a value on the mentioned flag, as in --kube-insecure-skip-tls-verify=true. That wan't necessary at least until helm v3.15.1, as seen below.

Expected Behavior

Below is the behavior with helm v3.15.1:

$ helm version
version.BuildInfo{Version:"v3.15.1", GitCommit:"e211f2aa62992bd72586b395de50979e31231829", GitTreeState:"clean", GoVersion:"go1.22.3"}
$ helm plugin list
NAME   	VERSION	DESCRIPTION                                                                  
secrets	4.6.2  	This plugin provides secrets values encryption for Helm charts secure storing

$ helm upgrade --install --kube-apiserver $MY_K8S_API_SERVER --kube-insecure-skip-tls-verify --kube-token $MY_K8S_API_TOKEN --namespace $MY_K8S_NAMESPACE mysql-test bitnami/mysql --dry-run=server
Release "mysql-test" does not exist. Installing it now.
Error: repo bitnami not found

$ helm secrets upgrade --install --kube-apiserver $MY_K8S_API_SERVER --kube-insecure-skip-tls-verify --kube-token $MY_K8S_API_TOKEN --namespace $MY_K8S_NAMESPACE mysql-test bitnami/mysql --dry-run=server
Release "mysql-test" does not exist. Installing it now.
Error: repo bitnami not found
Error: plugin "secrets" exited with error

We can see the command syntax works even when helm secrets upgrade is used without any =true in the flag --kube-insecure-skip-tls-verify.

Steps To Reproduce

1. Run `helm upgrade` with `--kube-insecure-skip-tls-verify` and additional arguments
2. Run `helm secrets upgrade` with all the same arguments as before

Environment

• Helm Version: v3.16.4
• Helm Secrets Version: 4.6.2
• OS: Ubuntu 24.04.1 LTS
• Shell: GNU bash, version 5.2.21(1)-release (x86_64-pc-linux-gnu)

Anything else?

It actually took me quote some time to figure out why my pipeline was broken, since helm's error message of Error: "helm upgrade" requires 2 arguments Usage: helm upgrade [RELEASE] [CHART] [flags] is quite far from being helpful and is just thrown in many different situations. But that's just for saying.

[jkroepke]

Could you run helm --debug secrets and post the output?

[bsmelo]

Could you run helm --debug secrets and post the output?

Sure. The output is below. But I really think it might be a general argument parsing issue. Somewhere in the code the handling of this specific flag --kube-insecure-skip-tls-verify (or flags in general) would not require a value (e.g.: =true) after the flag itself, it could be used as a "standalone valueless flag"; but now it does require a value.

$ helm --debug secrets
+ SCRIPT_DIR=/home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/common.sh
+ set -euf
+ uname -s
+ [ -f /proc/version ]
+ grep -qi microsoft /proc/version
+ on_wsl
+ false
+ on_cygwin
+ false
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/expand_vars_strict.sh
+ set -euf
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/file.sh
+ set -euf
+ VALUES_ALLOW_SYMLINKS=true
+ VALUES_ALLOW_ABSOLUTE_PATH=true
+ VALUES_ALLOW_PATH_TRAVERSAL=true
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/file/local.sh
+ set -euf
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/file/http.sh
+ set -euf
+ URL_VARIABLE_EXPANSION=false
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/file/custom.sh
+ set -euf
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/backend.sh
+ set -euf
+ ALLOWED_BACKENDS=
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/backends/noop.sh
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/backends/sops.sh
+ _SOPS=sops
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/backends/vals.sh
+ set -euf
+ _VALS=vals
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/http.sh
+ set -euf
+ HELM_BIN=helm
+ on_cygwin
+ false
+ mktemp -d
+ TMPDIR=/tmp/tmp.nLVocJip8v
+ export TMPDIR
+ mkdir -p /tmp/tmp.nLVocJip8v
+ [ -n  ]
+ QUIET=false
+ SECRET_BACKEND=sops
+ SECRET_BACKEND_ARGS=
+ DEC_PREFIX=
+ DEC_SUFFIX=.dec
+ DEC_DIR=
+ IGNORE_MISSING_VALUES=false
+ EVALUATE_TEMPLATES=false
+ EVALUATE_TEMPLATES_DECODE_SECRETS=false
+ DECRYPT_SECRETS_IN_TMP_DIR=false
+ LOAD_GPG_KEYS=false
+ trap _trap EXIT
+ trap trap - EXIT; _trap; exit 1 HUP INT QUIT TERM
+ load_secret_backend sops
+ backend=sops
+ [ sops =  ]
+ [  !=  ]
+ [ -f /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/backends/sops.sh ]
+ SECRET_BACKEND=sops
+ return
+ DEFAULT_SECRET_BACKEND=sops
+ [ false != false ]
+ [ -n  ]
+ true
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/commands/help.sh
+ set -euf
+ help_usage
+ cat

helm-secrets is a helm plugin for decrypt encrypted helm value files on the fly.

For more information, see the README.md at https://github.com/jkroepke/helm-secrets

To decrypt/encrypt/edit locally you need to initialize/first encrypt secrets with
sops - https://github.com/getsops/sops

Available Commands:
  encrypt Encrypt secrets file
  decrypt Decrypt secrets file
  edit    Edit secrets file and encrypt afterwards
  dir     Get plugin directory
  <cmd>   wrapper that decrypts encrypted yaml files before running helm <cmd>

Available Options:
  --quiet                                          -q  Suppress info messages (env: $HELM_SECRETS_QUIET)
  --backend                                        -b  Secret backend to use for decryption or encryption (env: $HELM_SECRETS_BACKEND)
  --backend-args                                   -a  Additional args for secret backend (env: $HELM_SECRETS_BACKEND_ARGS)
  --ignore-missing-values [true|false]                 Ignore missing value files (env: $HELM_SECRETS_IGNORE_MISSING_VALUES)
  --evaluate-templates [true|false]                    Evaluate secret expressions inside helm template (only supported by vals backend) (env: $HELM_SECRETS_EVALUATE_TEMPLATES)
  --evaluate-templates-decode-secrets [true|false]     If --evaluate-templates is set, decode base64 values from secrets to evaluate them (env: $HELM_SECRETS_EVALUATE_TEMPLATES_DECODE_SECRETS)
  --decrypt-secrets-in-tmp-dir [true|false]            Decrypt secrets in a temp directory. May solve concurrency issues. (env: $HELM_SECRETS_DECRYPT_SECRETS_IN_TMP_DIR)
  --help                                           -h  Show help
  --version                                        -v  Display version of helm-secrets
+ exit 1
+ _trap
+ command -v _trap_hook
+ [ -n  ]
+ rm -rf /tmp/tmp.nLVocJip8v
Error: plugin "secrets" exited with error
helm.go:86: 2025-01-17 16:51:33.130131481 +0000 UTC m=+0.076142745 [debug] plugin "secrets" exited with error

[jkroepke]

Sorry for the miscommunication here.

Please run the command with --debug

helm --debug secrets upgrade --install --kube-apiserver $MY_K8S_API_SERVER --kube-insecure-skip-tls-verify --kube-token $MY_K8S_API_TOKEN --namespace $MY_K8S_NAMESPACE mysql-test bitnami/mysql --dry-run=server

[bsmelo]

$ helm --debug secrets upgrade --install --kube-apiserver $MY_K8S_API_SERVER --kube-insecure-skip-tls-verify --kube-token $MY_K8S_API_TOKEN --namespace $MY_K8S_NAMESPACE mysql-test bitnami/mysql --dry-run=server
+ SCRIPT_DIR=/home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/common.sh
+ set -euf
+ uname -s
+ [ -f /proc/version ]
+ grep -qi microsoft /proc/version
+ on_wsl
+ false
+ on_cygwin
+ false
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/expand_vars_strict.sh
+ set -euf
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/file.sh
+ set -euf
+ VALUES_ALLOW_SYMLINKS=true
+ VALUES_ALLOW_ABSOLUTE_PATH=true
+ VALUES_ALLOW_PATH_TRAVERSAL=true
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/file/local.sh
+ set -euf
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/file/http.sh
+ set -euf
+ URL_VARIABLE_EXPANSION=false
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/file/custom.sh
+ set -euf
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/backend.sh
+ set -euf
+ ALLOWED_BACKENDS=
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/backends/noop.sh
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/backends/sops.sh
+ _SOPS=sops
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/backends/vals.sh
+ set -euf
+ _VALS=vals
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/http.sh
+ set -euf
+ HELM_BIN=helm
+ on_cygwin
+ false
+ mktemp -d
+ TMPDIR=/tmp/tmp.aEDsjsWTMN
+ export TMPDIR
+ mkdir -p /tmp/tmp.aEDsjsWTMN
+ [ -n  ]
+ QUIET=false
+ SECRET_BACKEND=sops
+ SECRET_BACKEND_ARGS=
+ DEC_PREFIX=
+ DEC_SUFFIX=.dec
+ DEC_DIR=
+ IGNORE_MISSING_VALUES=false
+ EVALUATE_TEMPLATES=false
+ EVALUATE_TEMPLATES_DECODE_SECRETS=false
+ DECRYPT_SECRETS_IN_TMP_DIR=false
+ LOAD_GPG_KEYS=false
+ trap _trap EXIT
+ trap trap - EXIT; _trap; exit 1 HUP INT QUIT TERM
+ load_secret_backend sops
+ backend=sops
+ [ sops =  ]
+ [  !=  ]
+ [ -f /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/backends/sops.sh ]
+ SECRET_BACKEND=sops
+ return
+ DEFAULT_SECRET_BACKEND=sops
+ [ false != false ]
+ [ -n  ]
+ true
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/commands/helm.sh
+ set -euf
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/commands/decrypt.sh
+ set -euf
+ _mktemp -d
+ [ 1 -eq 0 ]
+ mktemp -d /tmp/tmp.aEDsjsWTMN/XXXXXX
+ decrypted_file_list_dir=/tmp/tmp.aEDsjsWTMN/6ZAKyI
+ helm_command upgrade --install <REDACTED_TOKEN> mysql-test bitnami/mysql --dry-run=server
+ [ 6 -lt 2 ]
+ is_help --install
+ false
+ helm_wrapper upgrade --install <REDACTED_TOKEN> mysql-test bitnami/mysql --dry-run=server
+ argc=6
+ j=0
+ [ 0 -lt 6 ]
+ [ -d upgrade ]
+ [ -f upgrade ]
+ set -- upgrade --install <REDACTED_TOKEN> mysql-test bitnami/mysql --dry-run=server upgrade
+ shift
+ j=1
+ [ 1 -lt 6 ]
+ [ -d --install ]
+ [ -f --install ]
+ set -- --install <REDACTED_TOKEN> mysql-test bitnami/mysql --dry-run=server upgrade --install
+ shift
+ j=2
+ [ 2 -lt 6 ]
+ [ -d <REDACTED_TOKEN> ]
+ [ -f <REDACTED_TOKEN> ]
+ set -- <REDACTED_TOKEN> mysql-test bitnami/mysql --dry-run=server upgrade --install <REDACTED_TOKEN>
+ shift
+ j=3
+ [ 3 -lt 6 ]
+ [ -d mysql-test ]
+ [ -f mysql-test ]
+ set -- mysql-test bitnami/mysql --dry-run=server upgrade --install <REDACTED_TOKEN> mysql-test
+ shift
+ j=4
+ [ 4 -lt 6 ]
+ [ -d bitnami/mysql ]
+ [ -f bitnami/mysql ]
+ set -- bitnami/mysql --dry-run=server upgrade --install <REDACTED_TOKEN> mysql-test bitnami/mysql
+ shift
+ j=5
+ [ 5 -lt 6 ]
+ [ -d --dry-run=server ]
+ [ -f --dry-run=server ]
+ set -- --dry-run=server upgrade --install <REDACTED_TOKEN> mysql-test bitnami/mysql --dry-run=server
+ shift
+ j=6
+ [ 6 -lt 6 ]
+ [ false = true ]
+ helm upgrade --install <REDACTED_TOKEN> mysql-test bitnami/mysql --dry-run=server
Error: "helm upgrade" requires 2 arguments

Usage:  helm upgrade [RELEASE] [CHART] [flags]
helm.go:86: 2025-01-17 17:48:32.989716426 +0000 UTC m=+0.038178017 [debug] "helm upgrade" requires 2 arguments

Usage:  helm upgrade [RELEASE] [CHART] [flags]
main.newUpgradeCmd.ExactArgs.func4
	helm.sh/helm/v3/cmd/helm/require/args.go:39
github.com/spf13/cobra.(*Command).ValidateArgs
	github.com/spf13/[email protected]/command.go:1145
github.com/spf13/cobra.(*Command).execute
	github.com/spf13/[email protected]/command.go:938
github.com/spf13/cobra.(*Command).ExecuteC
	github.com/spf13/[email protected]/command.go:1117
github.com/spf13/cobra.(*Command).Execute
	github.com/spf13/[email protected]/command.go:1041
main.main
	helm.sh/helm/v3/cmd/helm/helm.go:85
runtime.main
	runtime/proc.go:271
runtime.goexit
	runtime/asm_amd64.s:1695
+ _trap
+ command -v _trap_hook
+ _trap_hook
+ [ -d /tmp/tmp.aEDsjsWTMN/6ZAKyI ]
+ set +f
+ set -f
+ [ -e /tmp/tmp.aEDsjsWTMN/6ZAKyI/*.file ]
+ rm -rf /tmp/tmp.aEDsjsWTMN/6ZAKyI
+ [ -n  ]
+ rm -rf /tmp/tmp.aEDsjsWTMN
Error: plugin "secrets" exited with error
helm.go:86: 2025-01-17 17:48:32.997726712 +0000 UTC m=+0.110175378 [debug] plugin "secrets" exited with error

[bsmelo]

This is interesting: below is the output of the same command as in the last comment, but with =true on the flag. Apparently, handling of the arguments in the first case (with error, without =true) is adding <REDACTED_TOKEN> (the value of $MY_K8S_API_TOKEN) to the helm_command call when it shouldn't.

$ helm --debug secrets upgrade --install --kube-apiserver $MY_K8S_API_SERVER --kube-insecure-skip-tls-verify=true --kube-token $MY_K8S_API_TOKEN --namespace $MY_K8S_NAMESPACE mysql-test bitnami/mysql --dry-run=server+ SCRIPT_DIR=/home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/common.sh
+ set -euf
+ uname -s
+ [ -f /proc/version ]
+ grep -qi microsoft /proc/version
+ on_wsl
+ false
+ on_cygwin
+ false
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/expand_vars_strict.sh
+ set -euf
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/file.sh
+ set -euf
+ VALUES_ALLOW_SYMLINKS=true
+ VALUES_ALLOW_ABSOLUTE_PATH=true
+ VALUES_ALLOW_PATH_TRAVERSAL=true
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/file/local.sh
+ set -euf
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/file/http.sh
+ set -euf
+ URL_VARIABLE_EXPANSION=false
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/file/custom.sh
+ set -euf
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/backend.sh
+ set -euf
+ ALLOWED_BACKENDS=
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/backends/noop.sh
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/backends/sops.sh
+ _SOPS=sops
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/backends/vals.sh
+ set -euf
+ _VALS=vals
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/http.sh
+ set -euf
+ HELM_BIN=helm
+ on_cygwin
+ false
+ mktemp -d
+ TMPDIR=/tmp/tmp.NWpBstEBRc
+ export TMPDIR
+ mkdir -p /tmp/tmp.NWpBstEBRc
+ [ -n  ]
+ QUIET=false
+ SECRET_BACKEND=sops
+ SECRET_BACKEND_ARGS=
+ DEC_PREFIX=
+ DEC_SUFFIX=.dec
+ DEC_DIR=
+ IGNORE_MISSING_VALUES=false
+ EVALUATE_TEMPLATES=false
+ EVALUATE_TEMPLATES_DECODE_SECRETS=false
+ DECRYPT_SECRETS_IN_TMP_DIR=false
+ LOAD_GPG_KEYS=false
+ trap _trap EXIT
+ trap trap - EXIT; _trap; exit 1 HUP INT QUIT TERM
+ load_secret_backend sops
+ backend=sops
+ [ sops =  ]
+ [  !=  ]
+ [ -f /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/lib/backends/sops.sh ]
+ SECRET_BACKEND=sops
+ return
+ DEFAULT_SECRET_BACKEND=sops
+ [ false != false ]
+ [ -n  ]
+ true
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/commands/helm.sh
+ set -euf
+ . /home/ubuntu/.local/share/helm/plugins/helm-secrets/scripts/commands/decrypt.sh
+ set -euf
+ _mktemp -d
+ [ 1 -eq 0 ]
+ mktemp -d /tmp/tmp.NWpBstEBRc/XXXXXX
+ decrypted_file_list_dir=/tmp/tmp.NWpBstEBRc/TWkPKa
+ helm_command upgrade --install mysql-test bitnami/mysql --dry-run=server
+ [ 5 -lt 2 ]
+ is_help --install
+ false
+ helm_wrapper upgrade --install mysql-test bitnami/mysql --dry-run=server
+ argc=5
+ j=0
+ [ 0 -lt 5 ]
+ [ -d upgrade ]
+ [ -f upgrade ]
+ set -- upgrade --install mysql-test bitnami/mysql --dry-run=server upgrade
+ shift
+ j=1
+ [ 1 -lt 5 ]
+ [ -d --install ]
+ [ -f --install ]
+ set -- --install mysql-test bitnami/mysql --dry-run=server upgrade --install
+ shift
+ j=2
+ [ 2 -lt 5 ]
+ [ -d mysql-test ]
+ [ -f mysql-test ]
+ set -- mysql-test bitnami/mysql --dry-run=server upgrade --install mysql-test
+ shift
+ j=3
+ [ 3 -lt 5 ]
+ [ -d bitnami/mysql ]
+ [ -f bitnami/mysql ]
+ set -- bitnami/mysql --dry-run=server upgrade --install mysql-test bitnami/mysql
+ shift
+ j=4
+ [ 4 -lt 5 ]
+ [ -d --dry-run=server ]
+ [ -f --dry-run=server ]
+ set -- --dry-run=server upgrade --install mysql-test bitnami/mysql --dry-run=server
+ shift
+ j=5
+ [ 5 -lt 5 ]
+ [ false = true ]
+ helm upgrade --install mysql-test bitnami/mysql --dry-run=server
history.go:56: 2025-01-17 18:12:20.023343236 +0000 UTC m=+0.209238555 [debug] getting history for release mysql-test
Release "mysql-test" does not exist. Installing it now.
install.go:224: 2025-01-17 18:12:20.067872868 +0000 UTC m=+0.253768201 [debug] Original chart version: ""
Error: repo bitnami not found
helm.go:86: 2025-01-17 18:12:20.069860278 +0000 UTC m=+0.255755601 [debug] repo bitnami not found
helm.sh/helm/v3/pkg/downloader.pickChartRepositoryConfigByName
	helm.sh/helm/v3/pkg/downloader/chart_downloader.go:350
helm.sh/helm/v3/pkg/downloader.(*ChartDownloader).ResolveChartVersion
	helm.sh/helm/v3/pkg/downloader/chart_downloader.go:253
helm.sh/helm/v3/pkg/downloader.(*ChartDownloader).DownloadTo
	helm.sh/helm/v3/pkg/downloader/chart_downloader.go:90
helm.sh/helm/v3/pkg/action.(*ChartPathOptions).LocateChart
	helm.sh/helm/v3/pkg/action/install.go:821
main.runInstall
	helm.sh/helm/v3/cmd/helm/install.go:236
main.newUpgradeCmd.func2
	helm.sh/helm/v3/cmd/helm/upgrade.go:159
github.com/spf13/cobra.(*Command).execute
	github.com/spf13/[email protected]/command.go:985
github.com/spf13/cobra.(*Command).ExecuteC
	github.com/spf13/[email protected]/command.go:1117
github.com/spf13/cobra.(*Command).Execute
	github.com/spf13/[email protected]/command.go:1041
main.main
	helm.sh/helm/v3/cmd/helm/helm.go:85
runtime.main
	runtime/proc.go:271
runtime.goexit
	runtime/asm_amd64.s:1695
+ _trap
+ command -v _trap_hook
+ _trap_hook
+ [ -d /tmp/tmp.NWpBstEBRc/TWkPKa ]
+ set +f
+ set -f
+ [ -e /tmp/tmp.NWpBstEBRc/TWkPKa/*.file ]
+ rm -rf /tmp/tmp.NWpBstEBRc/TWkPKa
+ [ -n  ]
+ rm -rf /tmp/tmp.NWpBstEBRc
Error: plugin "secrets" exited with error
helm.go:86: 2025-01-17 18:12:20.081869905 +0000 UTC m=+0.339561329 [debug] plugin "secrets" exited with error

That is:

$ helm --debug secrets upgrade --install --kube-apiserver $MY_K8S_API_SERVER --kube-insecure-skip-tls-verify --kube-token $MY_K8S_API_TOKEN --namespace $MY_K8S_NAMESPACE mysql-test bitnami/mysql --dry-run=server

Results in:

+ helm_command upgrade --install <REDACTED_TOKEN> mysql-test bitnami/mysql --dry-run=server

While

$ helm --debug secrets upgrade --install --kube-apiserver $MY_K8S_API_SERVER --kube-insecure-skip-tls-verify=true --kube-token $MY_K8S_API_TOKEN --namespace $MY_K8S_NAMESPACE mysql-test bitnami/mysql --dry-run=server

Results in:

+ helm_command upgrade --install mysql-test bitnami/mysql --dry-run=server