helm/helm

incorrect arg parsing with helm plugins

Open

#13686 opened on Jan 29, 2025

View on GitHub
 (12 comments) (0 reactions) (0 assignees)Go (29,815 stars) (7,602 forks)batch import
bughelp wanted

Description

Hi,

a user of the helm-secrets plugin reports an issue with --kube-insecure-skip-tls-verify since helm 3.16.

https://github.com/jkroepke/helm-secrets/issues/492

It turn out that this boolean flag was ignored before (https://github.com/helm/helm/pull/12856). I expect that the internal behavior was broken before.

From my point of view, if --kube-insecure-skip-tls-verify is set, the value after the flag is parsed wrongly and lead to unexpected behavior.

Here is a simple plugin to indicate the issue:

# helm plugin install https://github.com/jkroepke/helm-arg-demo-plugin
Installed plugin: arg-demo
# helm arg-demo
Hello World
# helm arg-demo --kube-insecure-skip-tls-verify
Hello World
# helm arg-demo --kube-insecure-skip-tls-verify --version 1.0.3
Error: unknown flag: --version
# helm --debug arg-demo --kube-insecure-skip-tls-verify=true --version 1.0.3
Hello World --version 1.0.3
# helm --debug arg-demo --kube-insecure-skip-tls-verify true --version 1.0.3
Hello World --version 1.0.3

A workaround exists: A explicit boolean value must be set after the flag.

Contributor guide

Tech stack
go
Domain
clibackend
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Gohelm plugin systemflag parsing
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60
Research direction
Investigate the flag parsing logic in the helm plugin subsystem, specifically around boolean flags like ` kube insecure skip tls verify`. The issue is that when a plugin is invoked, boolean flags are not correctly parsed, causing subsequent flags to be misinterpreted. Look at how the plugin command passes arguments to the plugin binary. The relevant code is likely in `cmd/helm/plugin.go` or `pkg/plugin/`. Check the PR #12856 which changed the behavior. The fix may involve ensuring that boolean flags are handled as either ` flag` or ` flag=true` without consuming the next argument as the flag's value.