Helm lookup function doesn't seem to be working

[shinebayar-g]

Description of the bug:

While generating yaml files from Cilium helm chart, I ran into some issue. Every time cdk8s synth runes, it's generating a new certificate.

Looks like Cilium helm chart uses helm lookup function to decide whether to generate a new certificate or not.
Because of this cdk8s synth is always overwriting a generated Secrets.

In this example, Secret.cilium-ca.yaml, Secret.hubble-server-certs.yaml files are always overwritten.

Reproduction Steps:

export class Cilium {
    constructor(chart: Construct) {
        new Helm(chart, 'cilium', {
            releaseName: 'cilium',
            chart: 'cilium',
            repo: 'https://helm.cilium.io/',
            version: '1.14.6',
            namespace: 'kube-system',
            values: {
                securityContext: {
                    capabilities: {
                        ciliumAgent: [
                            'CHOWN',
                            'KILL',
                            'NET_ADMIN',
                            'NET_RAW',
                            'IPC_LOCK',
                            'SYS_ADMIN',
                            'SYS_RESOURCE',
                            'DAC_OVERRIDE',
                            'FOWNER',
                            'SETGID',
                            'SETUID',
                        ],
                        cleanCiliumState: ['NET_ADMIN', 'SYS_ADMIN', 'SYS_RESOURCE'],
                    },
                },
                ipam: {
                    mode: 'kubernetes',
                },
                kubeProxyReplacement: 'false',
                cgroup: {
                    autoMount: {
                        enabled: false,
                    },
                    hostRoot: '/sys/fs/cgroup',
                },
            },
        });
    }
}

Error Log:

Environment:

• Framework Version:

"cdk8s": "2.68.31",
"constructs": "10.3.0",
"cdk8s-cli": "2.198.36",

• OS: Linux

Other:

---

This is 🐛 Bug Report

[iliapolo]

@shinebayar-g Are you not getting the same behavior when running helm template? All the Helm construct does is run helm template, so as long as helm as the necessary cluster context, I don't see a reason for this to fail.

Can you verify helm is able to connect to your cluster and identify existing certificates when running helm template?

Thanks

[github-actions]

This issue has not received a response in a while and will be closed soon. If you want to keep it open, please leave a comment below @mentioning a maintainer.

[shinebayar-g]

I revisited this again recently. It seems lookup function doesn't work in helm template command, hence the error.
Related issue in ArgoCD argoproj/argo-cd#5202

Actually, https://helm.sh/docs/chart_template_guide/functions_and_pipelines/#using-the-lookup-function mentions that lookup function doesn't work by default in helm template. To allow connection to the running cluster, we must use --dry-run=server flag.

In cdk8s, it's equivalent to helmFlags: ['--dry-run=server'],. Once it's added it seems to be working correctly.