helmfile: helmfile -f ... apply throws error

workaround:

helmDefaults:
  verify: false

no idea why

The flag --detailed-exitcode shouldn’t be passed to helm diff plugin when the chart is not installed yet.

On the diff plugin command we have --detailed-exitcode return a non-zero exit code when there are changes

That means the helm diff command will always fail during an installation because there are changes involved.

You will be able to reproduce the error running these commands in a fresh cluster (no helm chart installed).

helmfile.yaml

repositories:
  - name: stable
    url: https://kubernetes-charts.storage.googleapis.com

releases:
- name: metricbaet
  chart: stable/metricbeat

helmfile diff command success

➜  helmfile diff
Comparing metricbaet stable/metricbeat
********************

        Release was not present in Helm.  Diff will show entire contents as new.

********************
default, metricbaet-metricbeat-daemonset-modules, Secret (v1) has been added:
....
➜  echo $?
0

helmfile diff command error

➜ helmfile diff --detailed-exitcode
Error: identified at least one change, exiting with non-zero exit code (detailed-exitcode parameter enabled)
identified at least one change, exiting with non-zero exit code (detailed-exitcode parameter enabled)
Error: plugin "diff" exited with error

err: exit status 2
exit status 2

➜  helmfile apply
Adding repo stable https://kubernetes-charts.storage.googleapis.com
"stable" has been added to your repositories

Updating repo
Hang tight while we grab the latest from your chart repositories...
...Skip local chart repository
...Successfully got an update from the "stable" chart repository
...Successfully got an update from the "chartmuseum" chart repository
...Successfully got an update from the "jenkins-x" chart repository
Update Complete. ⎈ Happy Helming!⎈

Comparing metricbaet stable/metricbeat
********************

        Release was not present in Helm.  Diff will show entire contents as new.

********************
default, metricbaet-metricbeat-daemonset-modules, Secret (v1) has been added:
-
+ # Source: metricbeat/templates/secret.yaml
+ apiVersion: v1
....

Error: identified at least one change, exiting with non-zero exit code (detailed-exitcode parameter enabled)
identified at least one change, exiting with non-zero exit code (detailed-exitcode parameter enabled)
Error: plugin "diff" exited with error

Upgrading stable/metricbeat
Error: failed to download "stable/metricbeat" (hint: running `helm repo update` may help)

err: release "metricbaet" in "helmfile.yaml" failed: exit status 1
exit status 1

➜  bla helm version
Client: &version.Version{SemVer:"v2.11.0", GitCommit:"2e55dbe1fdb5fdb96b75ff144a339489417b146b", GitTreeState:"clean"}
Server: &version.Version{SemVer:"v2.11.0", GitCommit:"2e55dbe1fdb5fdb96b75ff144a339489417b146b", GitTreeState:"clean"}
➜  helmfile --version
helmfile version v0.40.1
➜  helm plugin list
NAME    VERSION         DESCRIPTION
diff    2.11.0+1        Preview helm upgrade changes as a diff
tiller  0.5.4           Start a Tiller server locally

@RiceBowlJr Thanks, with the latest v0.78.0 I cannot repoduce this issue anymore.

@Constantin07 try with the flag --log-level debug, it is very verbose but might help you find the error.

@yurrriq Glad to hear it finally worked for you ☺️ Thanks for reporting!

I also have this problem, but it is not as easy as upgrading helm, as we have live clusters with a 2.9.x tiller.

This is compounded by the fact that helm diff plugin embeds helm, which is shabby: consider:

helm v.	helm diff v.	cluster v.	works
2.9.x	2.10.x	2.9.x	no
2.10.x	2.10.x	2.9.x	no
2.10.x	2.10.x	2.10.x	yes

Then helm 2.9.x drives a plugin which embeds helm at a different version 2.10, which wants to diff a cluster with another 2.9.

The only compatible guarantee is to have all the same versions. Anyway, as I write this, it is the tight client-server version coupling of helm-tiller which is at cause. But having separate installations brings confusion.