feat(chart): add configurable Helm storage driver to HelmChart spec

Allow users to configure the Helm storage driver via spec.driver
on HelmChart resources. Accepts 'secret' (default) and 'configmap'.
This enables installation of large charts whose release metadata
exceeds the effective capacity of Kubernetes Secrets.

The driver field is immutable after creation to prevent accidental
loss of release metadata when switching storage backends.

Made getChartReleaseRevision() driver-aware so that
EXPECTED_RELEASE_REVISION is correctly injected for the
klipper-helm revision guard when using the configmap driver.

Fixes #317

Signed-off-by: Furkan Akman <hi@furkanakman.dev>

Author: fvrk4n

doc/helmchart.md

@@ -162,6 +162,7 @@ _Appears in:_
 | `dockerRegistrySecret` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#localobjectreference-v1-core)_ | Reference to Secret of type kubernetes.io/dockerconfigjson holding Docker auth credentials for the OCI-based registry acting as the Chart repo. |  |  |
 | `podSecurityContext` _[PodSecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#podsecuritycontext-v1-core)_ | Custom PodSecurityContext for the helm job pod. |  |  |
 | `securityContext` _[SecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#securitycontext-v1-core)_ | custom SecurityContext for the helm job pod. |  |  |
+| `driver` _[HelmDriver](#helmdriver)_ | Helm storage driver to use for this chart's release metadata.<br />`secret` stores releases in Kubernetes Secrets (default).<br />`configmap` stores releases in ConfigMaps.<br />This field is effectively immutable after the first install; changing the storage backend is not a supported migration path.<br />Helm CLI environment variable: `HELM_DRIVER` | secret | Enum: [secret configmap] <br /> |
 
 
 #### HelmChartStatus
@@ -181,6 +182,20 @@ _Appears in:_
 | `conditions` _[HelmChartCondition](#helmchartcondition) array_ | `JobCreated` indicates that a job has been created to install or upgrade the chart.<br />`Failed` indicates that the helm job has failed and the failure policy is set to `abort`. |  |  |
 
 
+#### HelmDriver
+
+_Underlying type:_ _string_
+
+
+
+_Validation:_
+- Enum: [secret configmap]
+
+_Appears in:_
+- [HelmChartSpec](#helmchartspec)
+
+
+
 #### SecretSpec
 
 

pkg/apis/helm.cattle.io/v1/types.go

@@ -13,6 +13,9 @@ import (
 // +kubebuilder:validation:Enum={"abort","reinstall"}
 type FailurePolicy string
 
+// +kubebuilder:validation:Enum={"secret","configmap"}
+type HelmDriver string
+
 // +genclient
 // +kubebuilder:subresource:status
 // +kubebuilder:resource:shortName=hc
@@ -108,6 +111,14 @@ type HelmChartSpec struct {
 	PodSecurityContext *corev1.PodSecurityContext `json:"podSecurityContext,omitempty"`
 	// custom SecurityContext for the helm job pod.
 	SecurityContext *corev1.SecurityContext `json:"securityContext,omitempty"`
+	// Helm storage driver to use for this chart's release metadata.
+	// `secret` stores releases in Kubernetes Secrets (default).
+	// `configmap` stores releases in ConfigMaps.
+	// This field is effectively immutable after the first install; changing the storage backend is not a supported migration path.
+	// Helm CLI environment variable: `HELM_DRIVER`
+	// +kubebuilder:default=secret
+	// +kubebuilder:validation:XValidation:rule="!oldSelf.hasValue() || self == oldSelf.value()",message="driver is immutable after creation",optionalOldSelf=true
+	Driver HelmDriver `json:"driver,omitempty"`
 }
 
 // HelmChartStatus represents the resulting state from processing HelmChart events

pkg/controllers/chart/chart.go

@@ -105,13 +105,22 @@ type Controller struct {
 	confCache       helmcontroller.HelmChartConfigCache
 	jobs            batchcontroller.JobController
 	jobCache        batchcontroller.JobCache
-	secrets         corecontroller.SecretController
+	configMaps      configMapLister
+	secrets         secretLister
 	secretCache     corecontroller.SecretCache
 	apply           apply.Apply
 	recorder        record.EventRecorder
 	apiServerPort   string
 }
 
+type configMapLister interface {
+	List(namespace string, opts metav1.ListOptions) (*corev1.ConfigMapList, error)
+}
+
+type secretLister interface {
+	List(namespace string, opts metav1.ListOptions) (*corev1.SecretList, error)
+}
+
 func Register(
 	ctx context.Context,
 	systemNamespace,
@@ -142,6 +151,7 @@ func Register(
 		confCache:       confCache,
 		jobs:            jobs,
 		jobCache:        jobCache,
+		configMaps:      cm,
 		secrets:         s,
 		secretCache:     sCache,
 		recorder:        recorder,
@@ -565,20 +575,40 @@ func (c *Controller) getJobAndRelatedResources(chart *v1.HelmChart) (*batch.Job,
 }
 
 func (c *Controller) getChartReleaseRevision(chart *v1.HelmChart) (int64, error) {
-	var version int64
-	fs := fields.OneTermEqualSelector("type", ReleaseType)
 	ls := labels.Set{"owner": "helm", "name": chart.Name}.AsSelector()
+
+	if helmDriver(chart) == "configmap" {
+		cmList, err := c.configMaps.List(chart.Spec.TargetNamespace, metav1.ListOptions{LabelSelector: ls.String()})
+		if err != nil {
+			return 0, err
+		}
+		objects := make([]metav1.ObjectMeta, len(cmList.Items))
+		for i := range cmList.Items {
+			objects[i] = cmList.Items[i].ObjectMeta
+		}
+		return maxReleaseRevision(objects), nil
+	}
+
+	fs := fields.OneTermEqualSelector("type", ReleaseType)
 	secretList, err := c.secrets.List(chart.Spec.TargetNamespace, metav1.ListOptions{FieldSelector: fs.String(), LabelSelector: ls.String()})
 	if err != nil {
-		return version, err
+		return 0, err
+	}
+	objects := make([]metav1.ObjectMeta, len(secretList.Items))
+	for i := range secretList.Items {
+		objects[i] = secretList.Items[i].ObjectMeta
 	}
-	for _, secret := range secretList.Items {
-		if sv, err := strconv.ParseInt(secret.ObjectMeta.Labels["version"], 10, 64); err == nil && sv > version {
+	return maxReleaseRevision(objects), nil
+}
+
+func maxReleaseRevision(objects []metav1.ObjectMeta) int64 {
+	var version int64
+	for _, obj := range objects {
+		if sv, err := strconv.ParseInt(obj.Labels["version"], 10, 64); err == nil && sv > version {
 			version = sv
 		}
 	}
-
-	return version, nil
+	return version
 }
 
 func chartBySecret(chart *v1.HelmChart) ([]string, error) {
@@ -668,7 +698,7 @@ func job(chart *v1.HelmChart, apiServerPort string) (*batch.Job, *corev1.Secret,
 								},
 								{
 									Name:  "HELM_DRIVER",
-									Value: "secret",
+									Value: helmDriver(chart),
 								},
 								{
 									Name:  "CHART_NAMESPACE",
@@ -1329,6 +1359,13 @@ func templateChanged(oldJob, newJob *batch.Job) bool {
 	return !equality.Semantic.DeepEqual(oldPodTemplate, newPodTemplate)
 }
 
+func helmDriver(chart *v1.HelmChart) string {
+	if chart.Spec.Driver != "" {
+		return string(chart.Spec.Driver)
+	}
+	return "secret"
+}
+
 func objectToJob(obj runtime.Object) (*batch.Job, error) {
 	if job, ok := obj.(*batch.Job); ok {
 		return job, nil

pkg/controllers/chart/chart_test.go

@@ -11,7 +11,10 @@ import (
 	"github.com/rancher/wrangler/v3/pkg/yaml"
 	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/util/intstr"
 )
@@ -199,6 +202,146 @@ func TestDeleteArgs(t *testing.T) {
 	assert.Equal("delete", stringArgs)
 }
 
+func TestDriverField(t *testing.T) {
+	tests := []struct {
+		name     string
+		driver   v1.HelmDriver
+		expected string
+	}{
+		{"default driver", "", "secret"},
+		{"secret driver", "secret", "secret"},
+		{"configmap driver", "configmap", "configmap"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert := assert.New(t)
+			chart := NewChart()
+			chart.Spec.Driver = tt.driver
+			j, _, _ := job(chart, "6443")
+			envs := j.Spec.Template.Spec.Containers[0].Env
+			var helmDriver string
+			for _, e := range envs {
+				if e.Name == "HELM_DRIVER" {
+					helmDriver = e.Value
+					break
+				}
+			}
+			assert.Equal(tt.expected, helmDriver)
+		})
+	}
+}
+
+func TestMaxReleaseRevision(t *testing.T) {
+	tests := []struct {
+		name     string
+		objects  []metav1.ObjectMeta
+		expected int64
+	}{
+		{"no objects", nil, 0},
+		{"single revision", []metav1.ObjectMeta{
+			{Labels: map[string]string{"version": "1"}},
+		}, 1},
+		{"multiple revisions returns max", []metav1.ObjectMeta{
+			{Labels: map[string]string{"version": "1"}},
+			{Labels: map[string]string{"version": "3"}},
+			{Labels: map[string]string{"version": "2"}},
+		}, 3},
+		{"invalid version label ignored", []metav1.ObjectMeta{
+			{Labels: map[string]string{"version": "abc"}},
+			{Labels: map[string]string{"version": "2"}},
+		}, 2},
+		{"missing version label ignored", []metav1.ObjectMeta{
+			{Labels: map[string]string{"owner": "helm"}},
+			{Labels: map[string]string{"version": "5"}},
+		}, 5},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert := assert.New(t)
+			assert.Equal(tt.expected, maxReleaseRevision(tt.objects))
+		})
+	}
+}
+
+func TestGetChartReleaseRevision(t *testing.T) {
+	t.Run("configmap driver uses configmap storage", func(t *testing.T) {
+		assert := assert.New(t)
+		var called bool
+		c := &Controller{
+			configMaps: fakeConfigMapLister{
+				list: func(namespace string, opts metav1.ListOptions) (*corev1.ConfigMapList, error) {
+					called = true
+					assert.Equal("target-ns", namespace)
+					assert.Equal(labels.Set{"owner": "helm", "name": "traefik"}.AsSelector().String(), opts.LabelSelector)
+					assert.Empty(opts.FieldSelector)
+					return &corev1.ConfigMapList{
+						Items: []corev1.ConfigMap{
+							{ObjectMeta: metav1.ObjectMeta{Labels: map[string]string{"version": "1"}}},
+							{ObjectMeta: metav1.ObjectMeta{Labels: map[string]string{"version": "3"}}},
+						},
+					}, nil
+				},
+			},
+		}
+
+		chart := NewChart()
+		chart.Spec.Driver = "configmap"
+		chart.Spec.TargetNamespace = "target-ns"
+
+		revision, err := c.getChartReleaseRevision(chart)
+		assert.NoError(err)
+		assert.True(called)
+		assert.Equal(int64(3), revision)
+	})
+
+	t.Run("default driver uses secret storage", func(t *testing.T) {
+		assert := assert.New(t)
+		var called bool
+		c := &Controller{
+			secrets: fakeSecretLister{
+				list: func(namespace string, opts metav1.ListOptions) (*corev1.SecretList, error) {
+					called = true
+					assert.Equal("target-ns", namespace)
+					assert.Equal(labels.Set{"owner": "helm", "name": "traefik"}.AsSelector().String(), opts.LabelSelector)
+					assert.Equal(fields.OneTermEqualSelector("type", ReleaseType).String(), opts.FieldSelector)
+					return &corev1.SecretList{
+						Items: []corev1.Secret{
+							{ObjectMeta: metav1.ObjectMeta{Labels: map[string]string{"version": "2"}}},
+							{ObjectMeta: metav1.ObjectMeta{Labels: map[string]string{"version": "5"}}},
+						},
+					}, nil
+				},
+			},
+		}
+
+		chart := NewChart()
+		chart.Spec.TargetNamespace = "target-ns"
+
+		revision, err := c.getChartReleaseRevision(chart)
+		assert.NoError(err)
+		assert.True(called)
+		assert.Equal(int64(5), revision)
+	})
+}
+
+type fakeConfigMapLister struct {
+	list func(namespace string, opts metav1.ListOptions) (*corev1.ConfigMapList, error)
+}
+
+func (f fakeConfigMapLister) List(namespace string, opts metav1.ListOptions) (*corev1.ConfigMapList, error) {
+	return f.list(namespace, opts)
+}
+
+type fakeSecretLister struct {
+	list func(namespace string, opts metav1.ListOptions) (*corev1.SecretList, error)
+}
+
+func (f fakeSecretLister) List(namespace string, opts metav1.ListOptions) (*corev1.SecretList, error) {
+	return f.list(namespace, opts)
+}
+
 func NewChart() *v1.HelmChart {
 	return v1.NewHelmChart("kube-system", "traefik", v1.HelmChart{
 		Spec: v1.HelmChartSpec{

pkg/crds/yaml/generated/helm.cattle.io_helmcharts.yaml

@@ -126,6 +126,22 @@ spec:
                     type: string
                 type: object
                 x-kubernetes-map-type: atomic
+              driver:
+                default: secret
+                description: |-
+                  Helm storage driver to use for this chart's release metadata.
+                  `secret` stores releases in Kubernetes Secrets (default).
+                  `configmap` stores releases in ConfigMaps.
+                  This field is effectively immutable after the first install; changing the storage backend is not a supported migration path.
+                  Helm CLI environment variable: `HELM_DRIVER`
+                enum:
+                - secret
+                - configmap
+                type: string
+                x-kubernetes-validations:
+                - message: driver is immutable after creation
+                  optionalOldSelf: true
+                  rule: '!oldSelf.hasValue() || self == oldSelf.value()'
               failurePolicy:
                 default: reinstall
                 description: |-

test/framework/framework.go

@@ -158,7 +158,7 @@ func (f *Framework) NewHelmChartConfig(name, values, valuesContent string) *v1.H
 	}
 }
 
-func (f *Framework) ListReleases(chart *v1.HelmChart) ([]corev1.Secret, error) {
+func (f *Framework) ListSecretReleases(chart *v1.HelmChart) ([]corev1.Secret, error) {
 	labelSelector := labels.SelectorFromSet(labels.Set{
 		"owner": "helm",
 		"name":  chart.Name,
@@ -180,6 +180,27 @@ func (f *Framework) ListReleases(chart *v1.HelmChart) ([]corev1.Secret, error) {
 	return secretList.Items, nil
 }
 
+func (f *Framework) ListConfigMapReleases(chart *v1.HelmChart) ([]corev1.ConfigMap, error) {
+	labelSelector := labels.SelectorFromSet(labels.Set{
+		"owner": "helm",
+		"name":  chart.Name,
+	})
+	namespace := chart.Namespace
+	if chart.Spec.TargetNamespace != "" {
+		namespace = chart.Spec.TargetNamespace
+	}
+
+	cmList, err := f.ClientSet.CoreV1().ConfigMaps(namespace).List(context.TODO(), metav1.ListOptions{LabelSelector: labelSelector.String()})
+	if err != nil {
+		if apierrors.IsNotFound(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+
+	return cmList.Items, nil
+}
+
 // GetDeployedRelease fetches the secret containing meta data about the currently deployed helm release.
 func (f *Framework) GetDeployedRelease(chart *v1.HelmChart) (*corev1.Secret, error) {
 	labelSelector := labels.SelectorFromSet(labels.Set{