feat: add plugin --keyring option (#1150)

* feat: add plugin --keyring option

* docs: add changelog fragment

* Update changelogs/fragments/20260620-add-plugin-keyring-option.yaml

Co-authored-by: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>

* feat: restrict helm_plugin keyring to install subcommand (#1)

Restrict the keyring option to state=present (helm plugin install),
the only implemented subcommand that supports --keyring, and fail
explicitly when it is used with other states.

Co-authored-by: Kenji Gaillac <48765390+Nhqml@users.noreply.github.com>

* refactor(helm_plugin): warn instead of fail

* Resolve linter error

* Update plugins/modules/helm_plugin.py

---------

Co-authored-by: Yuriy Novostavskiy <yuriy@novostavskiy.kyiv.ua>
Co-authored-by: Bianca Henderson <bianca@redhat.com>
Co-authored-by: Bianca Henderson <beeankha@gmail.com>

changelogs/fragments/20260620-add-plugin-keyring-option.yaml

@@ -0,0 +1,3 @@
+---
+minor_changes:
+  - helm_plugin - add ``--keyring`` argument to allow changing the keyring default location. The option is only accepted with ``state=present`` (the ``helm plugin install`` subcommand), as that is the only implemented subcommand that supports ``--keyring`` (https://github.com/ansible-collections/kubernetes.core/pull/1150).

plugins/modules/helm_plugin.py

@@ -56,6 +56,14 @@ options:
     type: bool
     default: true
     version_added: 6.4.0
+  keyring:
+    description:
+      - Location of public keys used for verification.
+      - Only valid with C(state=present), which maps to the C(helm plugin install) subcommand.
+      - This option requires helm version >= 4.0.0.
+    type: path
+    required: false
+    version_added: 6.5.0
 extends_documentation_fragment:
   - kubernetes.core.helm_common_options
 """
@@ -153,6 +161,10 @@ def argument_spec():
                 type="bool",
                 default=True,
             ),
+            keyring=dict(
+                type="path",
+                required=False,
+            ),
         )
     )
     return arg_spec
@@ -181,16 +193,28 @@ def main():
 
     state = module.params.get("state")
 
+    # The ``--keyring`` flag is only supported by the ``install``, ``verify`` and
+    # ``package`` plugin subcommands. Of those, this module only implements
+    # ``install`` (state=present); using ``keyring`` with other states emits a
+    # warning and the option is not passed to Helm.
+    if module.params.get("keyring") is not None and state != "present":
+        module.warn(
+            "The 'keyring' option is only supported with state=present "
+            "(the 'helm plugin install' subcommand)."
+        )
+
     helm_cmd_common = module.get_helm_binary() + " plugin"
 
     if state == "present":
         helm_cmd_common += " install %s" % module.params.get("plugin_path")
         plugin_version = module.params.get("plugin_version")
         verify = module.params.get("verify")
+        keyring = module.params.get("keyring")
         if plugin_version is not None:
             helm_cmd_common += " --version=%s" % plugin_version
-        if not verify:
+        if not verify or keyring is not None:
             helm_version = module.get_helm_version()
+        if not verify:
             if LooseVersion(helm_version) < LooseVersion("4.0.0"):
                 module.warn(
                     "verify parameter requires helm >= 4.0.0, current version is {0}".format(
@@ -199,6 +223,15 @@ def main():
                 )
             else:
                 helm_cmd_common += " --verify=false"
+        if keyring is not None:
+            if LooseVersion(helm_version) < LooseVersion("4.0.0"):
+                module.warn(
+                    "keyring parameter requires helm >= 4.0.0, current version is {0}".format(
+                        helm_version
+                    )
+                )
+            else:
+                helm_cmd_common += " --keyring=" + keyring
         if not module.check_mode:
             rc, out, err = module.run_helm_command(
                 helm_cmd_common, fails_on_error=False