chore: Update CI Helm tooling to Helm 4.x by Mallikarjunadevops · Pull Request #4622 · open-policy-agent/gatekeeper

Mallikarjunadevops · 2026-06-17T20:29:22Z

Hey maintainers! 👋

This PR addresses issue #4605 by updating the Helm version in our CI tooling to 4.2.1 (the latest v4 release). As noted in the Helm v3.21.0 release notes, Helm 3 is approaching EOL and we should migrate our pipelines to use v4.x.

Changes Made:

Updated HELM_VERSION from 3.17.4 to 4.2.1 in the Makefile.
Updated the Helm version matrix in .github/workflows/upgrade.yaml and .github/workflows/workflow.yaml to use 4.2.1.

These changes ensure that all our lint, build, test, and upgrade jobs will now run using Helm 4.x and catch any potential incompatibilities moving forward.

Fixes #4605

Thanks for reviewing! Let me know if there's anything else needed.

Fixes open-policy-agent#4605 Signed-off-by: Mallikarjunadevops <muchu.mallikarjunarpa@gmail.com>

Mallikarjunadevops · 2026-06-17T20:31:54Z

Since this PR updates the Helm CI tooling to v4.x, the primary testing evidence will be the successful execution of our automated CI workflows (check-helm-lint, build-and-test, and helm-upgrade).

Once the CI checks on this PR pass, it will confirm that Helm 4.2.1 handles our charts without any breaking changes.

Copilot

Pull request overview

This PR updates the Helm version used in CI tooling from Helm 3.x to Helm 4.x (4.2.1) in preparation for Helm 3 end-of-life, as tracked by issue #4605. The change touches the Makefile and two workflow files to update the Helm version pins.

Changes:

Updated HELM_VERSION from 3.17.4 to 4.2.1 in the Makefile.
Updated the Helm version matrix entries in workflow.yaml and upgrade.yaml from 3.14.1 to 4.2.1.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
`Makefile`	Updated `HELM_VERSION` default from `3.17.4` to `4.2.1`.
`.github/workflows/workflow.yaml`	Updated `HELM_VERSION` matrix entry from `3.14.1` to `4.2.1` for the Helm build-and-test job.
`.github/workflows/upgrade.yaml`	Updated `HELM_VERSION` matrix entry from `3.14.1` to `4.2.1` for the Helm upgrade-test job.

JaydipGabani · 2026-07-02T22:28:30Z

      fail-fast: false
      matrix:
-        HELM_VERSION: ["3.14.1"]
+        HELM_VERSION: ["4.2.1"]


@Mallikarjunadevops this is a valid concern, can you address this?

      fail-fast: false
      matrix:
-        HELM_VERSION: ["3.14.1"]
+        HELM_VERSION: ["4.2.1"]


JaydipGabani · 2026-06-19T18:49:42Z

@Mallikarjunadevops can you resolve conflicts?

Mallikarjunadevops · 2026-06-19T23:23:33Z

@JaydipGabani The conflicts with master have been resolved. The PR is now up to date!

JaydipGabani · 2026-07-02T22:28:30Z

      fail-fast: false
      matrix:
-        HELM_VERSION: ["3.14.1"]
+        HELM_VERSION: ["4.2.1"]


@Mallikarjunadevops this is a valid concern, can you address this?

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

          make e2e-bootstrap KUBERNETES_VERSION=${{ env.KUBERNETES_VERSION }}
        env:
-          KUBERNETES_VERSION: 1.24.4
+          KUBERNETES_VERSION: 1.33.2


codecov-commenter · 2026-07-03T20:41:37Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 44.86%. Comparing base (3350319) to head (6b50929).
⚠️ Report is 770 commits behind head on master.

❗ There is a different number of reports uploaded between BASE (3350319) and HEAD (6b50929). Click for more details.

HEAD has 1 upload less than BASE

Flag BASE (3350319) HEAD (6b50929)

unittests 2 1

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4622      +/-   ##
==========================================
- Coverage   54.49%   44.86%   -9.64%     
==========================================
  Files         134      284     +150     
  Lines       12329    21041    +8712     
==========================================
+ Hits         6719     9439    +2720     
- Misses       5116    10794    +5678     
- Partials      494      808     +314

Flag	Coverage Δ
unittests	`44.86% <ø> (-9.64%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

          make e2e-bootstrap KUBERNETES_VERSION=${{ env.KUBERNETES_VERSION }}
        env:
-          KUBERNETES_VERSION: 1.24.4
+          KUBERNETES_VERSION: 1.33.2


 KIND_CLUSTER_FILE ?= ""
 # note: k8s version pinned since KIND image availability lags k8s releases
-KUBERNETES_VERSION ?= 1.33.0
+KUBERNETES_VERSION ?= 1.33.2


Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

          make e2e-bootstrap KUBERNETES_VERSION=${{ env.KUBERNETES_VERSION }}
        env:
-          KUBERNETES_VERSION: 1.24.4
+          KUBERNETES_VERSION: 1.33.2


Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
-        with:
-          egress-policy: audit
-
      - name: Check out code into the Go module directory


          make e2e-bootstrap KUBERNETES_VERSION=${{ env.KUBERNETES_VERSION }}
        env:
-          KUBERNETES_VERSION: 1.24.4
+          KUBERNETES_VERSION: 1.33.2


Signed-off-by: Mallikarjunadevops <muchu.mallikarjunarpa@gmail.com>

Mallikarjunadevops · 2026-07-04T01:14:49Z

I have updated the PR to cleanly bump the Helm version to 4.2.1 in the Makefile, workflow.yaml, and helm-lint.yaml. I removed any extraneous hacks or K8s version bumps to keep the changes strictly focused.

However, for the upgrade.yaml workflow, I intentionally reverted the HELM_VERSION back to 3.14.1 with an explanatory comment. As pointed out in the review, the base release 3.9.2 requires Kubernetes 1.24 (due to PodSecurityPolicy), which falls outside Helm 4's supported version skew. Keeping Helm 3 specifically for this matrix ensures the upgrade job remains functional and correctly tests the base-release installation without skew errors.

Regarding the 2 CI test cancellations ([Helm] Build and Test):
I investigated the logs and found that the jobs are hitting the 30-minute timeout limit. This appears to be caused by Helm 4's new default Server-Side Apply behavior interacting with Gatekeeper's pre-install hooks (specifically the RBAC resources like ServiceAccount, ClusterRole, etc.). When using --wait, Helm 4's cli-utils waiter polls for these hook resources to be "ready", but since they don't have a status field, it hangs for a hardcoded 5 minutes per resource until it hits a timeout for each one before continuing. With 4+ hook resources, this silently eats up 20+ minutes and times out the GitHub Actions job.

I have left the code simple for now without workarounds so you can review and decide the best way to address this Helm 4 behavior for Gatekeeper.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

      fail-fast: false
      matrix:
-        HELM_VERSION: ["3.17.4"]
+        HELM_VERSION: ["4.2.1"]


Signed-off-by: Mallikarjunadevops <muchu.mallikarjunarpa@gmail.com>

chore: Update CI Helm tooling to Helm 4.x

129d799

Fixes open-policy-agent#4605 Signed-off-by: Mallikarjunadevops <muchu.mallikarjunarpa@gmail.com>

Mallikarjunadevops requested a review from a team as a code owner June 17, 2026 20:29

Copilot AI review requested due to automatic review settings June 17, 2026 20:29

Copilot started reviewing on behalf of Mallikarjunadevops June 17, 2026 20:29 View session

Copilot AI reviewed Jun 17, 2026

View reviewed changes

Resolve merge conflicts with upstream/master

5b72408

JaydipGabani requested changes Jul 2, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 3, 2026 20:15

Copilot started reviewing on behalf of Mallikarjunadevops July 3, 2026 20:15 View session

Copilot AI reviewed Jul 3, 2026

View reviewed changes

Comment thread .github/workflows/upgrade.yaml Outdated

make e2e-bootstrap KUBERNETES_VERSION=${{ env.KUBERNETES_VERSION }}

env:

KUBERNETES_VERSION: 1.24.4

KUBERNETES_VERSION: 1.33.2

Copilot AI review requested due to automatic review settings July 3, 2026 21:48

Copilot started reviewing on behalf of Mallikarjunadevops July 3, 2026 21:48 View session

Mallikarjunadevops force-pushed the fix-4605 branch from 5c6221a to ab4434c Compare July 3, 2026 21:50

Copilot AI reviewed Jul 3, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 3, 2026 21:51

Copilot started reviewing on behalf of Mallikarjunadevops July 3, 2026 21:51 View session

Copilot AI reviewed Jul 3, 2026

View reviewed changes

Comment thread .github/workflows/upgrade.yaml Outdated

make e2e-bootstrap KUBERNETES_VERSION=${{ env.KUBERNETES_VERSION }}

env:

KUBERNETES_VERSION: 1.24.4

KUBERNETES_VERSION: 1.33.2

Copilot AI review requested due to automatic review settings July 3, 2026 23:11

Copilot started reviewing on behalf of Mallikarjunadevops July 3, 2026 23:11 View session

Copilot AI reviewed Jul 3, 2026

View reviewed changes

chore: clean update of CI Helm tooling to Helm 4.x

4be0a8e

Signed-off-by: Mallikarjunadevops <muchu.mallikarjunarpa@gmail.com>

Copilot AI review requested due to automatic review settings July 4, 2026 01:14

Mallikarjunadevops force-pushed the fix-4605 branch from 50c665b to 4be0a8e Compare July 4, 2026 01:14

Copilot started reviewing on behalf of Mallikarjunadevops July 4, 2026 01:14 View session

Copilot AI reviewed Jul 4, 2026

View reviewed changes

Comment thread .github/workflows/upgrade.yaml Outdated

fail-fast: false

matrix:

HELM_VERSION: ["3.17.4"]

HELM_VERSION: ["4.2.1"]

Mallikarjunadevops and others added 2 commits July 3, 2026 21:58

chore: keep Helm 3 for upgrade job to support K8s 1.24 version skew

028e864

Signed-off-by: Mallikarjunadevops <muchu.mallikarjunarpa@gmail.com>

Merge branch 'master' into fix-4605

6b50929

Uh oh!

Conversation

Mallikarjunadevops commented Jun 17, 2026

Changes Made:

Uh oh!

Mallikarjunadevops commented Jun 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

JaydipGabani Jul 2, 2026

Choose a reason for hiding this comment

Uh oh!

JaydipGabani commented Jun 19, 2026

Uh oh!

Mallikarjunadevops commented Jun 19, 2026

Uh oh!

JaydipGabani Jul 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

codecov-commenter commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Mallikarjunadevops commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codecov-commenter commented Jul 3, 2026 •

edited

Loading

Mallikarjunadevops commented Jul 4, 2026 •

edited

Loading