fix: bound Helm release operations by timeout

Author: shirkevich

pkg/component/helm/client.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"time"
 
 	"helm.sh/helm/v4/pkg/action"
 	"helm.sh/helm/v4/pkg/cli"
@@ -84,7 +85,9 @@ func applyRelease(ctx context.Context, spec *chartSpec, dryRun bool) (releaseAct
 			return releaseActionResult{Operation: releaseOperationInstall}, resolveErr
 		}
 		spec.Lifecycle = lifecycle
-		manifest, installErr := installRelease(ctx, actx, spec, dryRun)
+		operationCtx, cancel := releaseOperationContext(ctx, lifecycle.Policy.Timeout)
+		defer cancel()
+		manifest, installErr := installRelease(operationCtx, actx, spec, dryRun)
 		return releaseActionResult{Manifest: manifest, Operation: releaseOperationInstall, Lifecycle: lifecycle}, installErr
 	} else if historyErr != nil {
 		return releaseActionResult{}, fmt.Errorf("%w %q: %w", errUtils.ErrHelmReleaseHistory, spec.ReleaseName, historyErr)
@@ -94,10 +97,29 @@ func applyRelease(ctx context.Context, spec *chartSpec, dryRun bool) (releaseAct
 		return releaseActionResult{Operation: releaseOperationUpgrade}, resolveErr
 	}
 	spec.Lifecycle = lifecycle
-	manifest, upgradeErr := upgradeRelease(ctx, actx, spec, dryRun)
+	operationCtx, cancel := releaseOperationContext(ctx, lifecycle.Policy.Timeout)
+	defer cancel()
+	manifest, upgradeErr := upgradeRelease(operationCtx, actx, spec, dryRun)
 	return releaseActionResult{Manifest: manifest, Operation: releaseOperationUpgrade, Lifecycle: lifecycle}, upgradeErr
 }
 
+// releaseOperationContext applies the effective lifecycle timeout to every
+// cluster-side Helm action. A zero timeout intentionally remains unbounded
+// during the timeout-default migration.
+func releaseOperationContext(parent context.Context, timeout time.Duration) (context.Context, context.CancelFunc) {
+	if timeout <= 0 {
+		return parent, func() {}
+	}
+	return context.WithTimeout(parent, timeout)
+}
+
+func releaseWaitOptions(ctx context.Context) []kube.WaitOption {
+	return []kube.WaitOption{
+		kube.WithWaitContext(ctx),
+		kube.WithWaitForDeleteMethodContext(ctx),
+	}
+}
+
 func installRelease(ctx context.Context, actx *actionContext, spec *chartSpec, dryRun bool) (string, error) {
 	client := action.NewInstall(actx.cfg)
 	client.SetRegistryClient(actx.cfg.RegistryClient)
@@ -106,6 +128,7 @@ func installRelease(ctx context.Context, actx *actionContext, spec *chartSpec, d
 	client.CreateNamespace = true
 	client.Version = spec.Version
 	configureInstallLifecycle(client, spec.Lifecycle.Policy)
+	client.WaitOptions = releaseWaitOptions(ctx)
 	if dryRun {
 		client.DryRunStrategy = action.DryRunServer
 	}
@@ -121,6 +144,7 @@ func upgradeRelease(ctx context.Context, actx *actionContext, spec *chartSpec, d
 	client.Namespace = spec.Namespace
 	client.Version = spec.Version
 	configureUpgradeLifecycle(client, spec.Lifecycle.Policy)
+	client.WaitOptions = releaseWaitOptions(ctx)
 	if dryRun {
 		client.DryRunStrategy = action.DryRunServer
 	}
@@ -203,6 +227,8 @@ func deleteRelease(ctx context.Context, spec *chartSpec, dryRun bool) error {
 	if err := ctx.Err(); err != nil {
 		return err
 	}
+	operationCtx, cancel := releaseOperationContext(ctx, spec.Lifecycle.Policy.Timeout)
+	defer cancel()
 
 	actx, err := newActionContext(spec.Namespace)
 	if err != nil {
@@ -211,21 +237,18 @@ func deleteRelease(ctx context.Context, spec *chartSpec, dryRun bool) error {
 
 	client := action.NewUninstall(actx.cfg)
 	configureUninstallLifecycle(client, spec.Lifecycle.Policy, dryRun)
-	client.WaitOptions = []kube.WaitOption{
-		kube.WithWaitContext(ctx),
-		kube.WithWaitForDeleteMethodContext(ctx),
-	}
+	client.WaitOptions = releaseWaitOptions(operationCtx)
 	if _, err := client.Run(spec.ReleaseName); err != nil {
 		if errors.Is(err, driver.ErrReleaseNotFound) {
 			return nil
 		}
 		uninstallErr := fmt.Errorf("%w %q: %w", errUtils.ErrHelmReleaseUninstall, spec.ReleaseName, err)
-		if ctxErr := ctx.Err(); ctxErr != nil {
+		if ctxErr := operationCtx.Err(); ctxErr != nil {
 			return errors.Join(ctxErr, uninstallErr)
 		}
 		return uninstallErr
 	}
-	if err := ctx.Err(); err != nil {
+	if err := operationCtx.Err(); err != nil {
 		return err
 	}
 	return nil

pkg/component/helm/client_lifecycle_test.go

@@ -5,6 +5,7 @@ import (
 	"io"
 	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -177,3 +178,38 @@ func TestDeleteReleaseHonorsCanceledContext(t *testing.T) {
 	require.NoError(t, getErr)
 	assert.NotEmpty(t, deployed)
 }
+
+func TestApplyReleaseUsesLifecycleTimeoutAndWaitContext(t *testing.T) {
+	actx := memoryActionContext(t)
+	stubActionContext(t, actx)
+	spec := testdataChartSpec(t, "bounded-upgrade")
+
+	_, err := applyRelease(context.Background(), spec, false)
+	require.NoError(t, err)
+
+	kubeClient, ok := actx.cfg.KubeClient.(*kubefake.FailingKubeClient)
+	require.True(t, ok)
+	kubeClient.RecordedWaitOptions = nil
+	kubeClient.WaitDuration = 2 * time.Second
+	timeout := "25ms"
+	spec.Release.Upgrade.Timeout = &timeout
+
+	started := time.Now()
+	result, err := applyRelease(context.Background(), spec, false)
+	elapsed := time.Since(started)
+
+	require.ErrorIs(t, err, context.DeadlineExceeded)
+	assert.Equal(t, releaseOperationUpgrade, result.Operation)
+	assert.Less(t, elapsed, time.Second, "upgrade must return at the lifecycle deadline")
+	assert.NotEmpty(t, kubeClient.RecordedWaitOptions, "Helm waiters must receive the operation context")
+}
+
+func TestReleaseOperationContextPreservesZeroTimeout(t *testing.T) {
+	parent := context.Background()
+	ctx, cancel := releaseOperationContext(parent, 0)
+	defer cancel()
+
+	assert.Same(t, parent, ctx)
+	_, hasDeadline := ctx.Deadline()
+	assert.False(t, hasDeadline)
+}