Prep 5.4.2 release (#1083)

SUMMARY

Prep kubernetes.core 5.4.2 release

COMPONENT NAME

Multiple

Reviewed-by: Bianca Henderson <beeankha@gmail.com>
Reviewed-by: Bikouo Aubin
Reviewed-by: Alina Buzachis
Reviewed-by: Mike Graves <mgraves@redhat.com>

.ansible-lint

@@ -2,5 +2,8 @@
 profile: production
 
 exclude_paths:
+  - .ansible/
+  - .github/
   - tests/integration
+  - tests/unit
   - tests/sanity

.ansible-lint-ignore

@@ -0,0 +1,6 @@
+# https://docs.ansible.com/ansible-lint/docs/rules/
+# no-changed-when is not requried for examples
+plugins/connection/kubectl.py no-changed-when
+# false positive result
+plugins/connection/kubectl.py var-naming[no-reserved]
+plugins/connection/kubectl.py jinja[invalid]

.github/stale.yml

@@ -1,60 +0,0 @@
----
-# Configuration for probot-stale - https://github.com/probot/stale
-
-# Number of days of inactivity before an Issue or Pull Request becomes stale
-daysUntilStale: 90
-
-# Number of days of inactivity before an Issue or Pull Request with the stale
-# label is closed. Set to false to disable. If disabled, issues still need to be
-# closed manually, but will remain marked as stale.
-daysUntilClose: 30
-
-# Only issues or pull requests with all of these labels are check if stale.
-# Defaults to `[]` (disabled)
-onlyLabels: []
-
-# Issues or Pull Requests with these labels will never be considered stale. Set
-# to `[]` to disable
-exemptLabels:
-  - security
-  - planned
-  - priority/critical
-  - lifecycle/frozen
-  - verified
-
-# Set to true to ignore issues in a project (defaults to false)
-exemptProjects: false
-
-# Set to true to ignore issues in a milestone (defaults to false)
-exemptMilestones: true
-
-# Set to true to ignore issues with an assignee (defaults to false)
-exemptAssignees: false
-
-# Label to use when marking as stale
-staleLabel: lifecycle/stale
-
-# Limit the number of actions per hour, from 1-30. Default is 30
-limitPerRun: 30
-
-pulls:
-  markComment: |-
-    PRs go stale after 90 days of inactivity.
-    If there is no further activity, the PR will be closed in another 30 days.
-
-  unmarkComment: >-
-    This pull request is no longer stale.
-
-  closeComment: >-
-    This pull request has been closed due to inactivity.
-
-issues:
-  markComment: |-
-    Issues go stale after 90 days of inactivity.
-    If there is no further activity, the issue will be closed in another 30 days.
-
-  unmarkComment: >-
-    This issue is no longer stale.
-
-  closeComment: >-
-    This issue has been closed due to inactivity.

.github/workflows/integration-tests.yaml

@@ -26,6 +26,7 @@ jobs:
         with:
           path: ${{ env.source_dir }}
           fetch-depth: "0"
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - name: list changes for pull request
         id: splitter
@@ -50,6 +51,7 @@ jobs:
       source: "./source"
       cloud_common: "./cloudcommon"
       ansible_posix: "./ansible_posix"
+      community_general: "./community_general"
     strategy:
       fail-fast: false
       matrix:
@@ -61,7 +63,7 @@ jobs:
           - true
           - false
         workflow-id: ${{ fromJson(needs.splitter.outputs.test_jobs) }}
-    name: "integration-py${{ matrix.python-version }}-${{ matrix.ansible-version }}-${{ matrix.workflow-id }}"
+    name: "integration-py${{ matrix.python-version }}-${{ matrix.ansible-version }}-${{ matrix.workflow-id }}-enable_turbo=${{ matrix.enable-turbo-mode }}"
     steps:
       - name: Read target
         id: read-targets
@@ -118,6 +120,13 @@ jobs:
           path: ${{ env.ansible_posix }}
           ref: main
 
+      - name: checkout ansible-collections/community.general
+        uses: ansible-network/github_actions/.github/actions/checkout_dependency@main
+        with:
+          repository: ansible-collections/community.general
+          path: ${{ env.community_general }}
+          ref: main
+
       - name: install cloud.common collection
         uses: ansible-network/github_actions/.github/actions/build_install_collection@main
         with:
@@ -130,8 +139,16 @@ jobs:
           install_python_dependencies: true
           source_path: ${{ env.ansible_posix }}
 
+      - name: install community.general collection
+        uses: ansible-network/github_actions/.github/actions/build_install_collection@main
+        with:
+          install_python_dependencies: false
+          source_path: ${{ env.community_general }}
+
       - name: create kubernetes cluster
         uses: helm/kind-action@v1.8.0
+        with:
+          node_image: "kindest/node:v1.29.2"
 
       - name: Run integration tests
         uses: ansible-network/github_actions/.github/actions/ansible_test_integration@main

.github/workflows/label-new-prs.yaml

@@ -0,0 +1,28 @@
+---
+name: label new prs
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - converted_to_draft
+      - ready_for_review
+
+jobs:
+  add_label:
+    if: github.actor != 'patchback[bot]'
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Add 'needs_triage' label if the pr is not a draft
+        uses: actions-ecosystem/action-add-labels@v1
+        if: github.event.pull_request.draft == false
+        with:
+          labels: needs_triage
+
+      - name: Remove 'needs_triage' label if the pr is a draft
+        uses: actions-ecosystem/action-remove-labels@v1
+        if: github.event.pull_request.draft == true
+        with:
+          labels: needs_triage

.github/workflows/linters.yaml

@@ -19,6 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-
-      - name: Run ansible-lint
-        uses: ansible/ansible-lint@v6.21.0
+      - name: run-ansible-lint
+        uses: ansible/ansible-lint@main
+        with:
+          gh_action_ref: "v25.5.0"

.gitignore

@@ -13,6 +13,7 @@ changelogs/.plugin-cache.yaml
 tests/output
 tests/integration/cloud-config-*
 .cache
+.ansible
 
 # Helm charts
 tests/integration/*-chart-*.tgz
@@ -20,3 +21,6 @@ tests/integration/*-chart-*.tgz
 # ansible-test generated file
 tests/integration/inventory
 tests/integration/*-*.yml
+
+# VS Code settings
+.vscode/

.yamllint

@@ -5,16 +5,25 @@ rules:
   braces:
     max-spaces-inside: 1
     level: error
+
   brackets:
     max-spaces-inside: 1
     level: error
+  comments:
+    min-spaces-from-content: 1
+  comments-indentation: false
   document-start: disable
   line-length: disable
   truthy: disable
   indentation:
     spaces: 2
     indent-sequences: consistent
+  octal-values:
+    forbid-implicit-octal: true
+    forbid-explicit-octal: true
 ignore: |
   .cache
   .tox
+  .ansible
   tests/output
+  plugins/connection/kubectl.py

CHANGELOG.rst

@@ -4,6 +4,270 @@ Kubernetes Collection Release Notes
 
 .. contents:: Topics
 
+v5.4.2
+======
+
+Release Summary
+---------------
+
+This release includes bugfixes such as replacing the passing of ``warnings`` to ``exit_json`` with ``AnsibleModule.warn`` as well as a security update for selectively redacting sensitive information from kubeconfig.
+
+Minor Changes
+-------------
+
+- helm - add ``release_values`` key to ``status`` return value that can be accessed using Jinja2 dot notation (https://github.com/ansible-collections/kubernetes.core/pull/1056).
+- helm_info - add ``release_values`` key to ``status`` return value that can be accessed using Jinja2 dot notation (https://github.com/ansible-collections/kubernetes.core/pull/1056).
+
+Deprecated Features
+-------------------
+
+- helm - the ``status.values`` return value has been deprecated and will be removed in a release after 2027-01-08. Use ``status.release_values`` instead (https://github.com/ansible-collections/kubernetes.core/pull/1056).
+- helm_info - the ``status.values`` return value has been deprecated and will be removed in a release after 2027-01-08. Use ``status.release_values`` instead (https://github.com/ansible-collections/kubernetes.core/pull/1056).
+
+Security Fixes
+--------------
+
+- Selectively redact sensitive info from kubeconfig instead of applying blanket ``no_log=True`` (https://github.com/ansible-collections/kubernetes.core/pull/1014).
+
+Bugfixes
+--------
+
+- Add idempotency for ``helm_pull`` module (https://github.com/ansible-collections/kubernetes.core/pull/1055).
+- Fixed a bug where setting ``K8S_AUTH_VERIFY_SSL=true`` (or any string value) caused the value to be treated as a separate ``kubectl`` command argument (https://github.com/ansible-collections/kubernetes.core/pull/1049).
+- Limit supported versions of Helm to <4.0.0 (https://github.com/ansible-collections/kubernetes.core/pull/1039).
+- Replace passing ``warnings`` to ``exit_json`` with ``AnsibleModule.warn`` in the ``k8s_drain``, ``k8s_rollback.py`` and ``k8s_scale.py`` modules as it deprecated in ``ansible-core>=2.19.0`` and will be removed in ``ansible-core>=2.23.0`` (https://github.com/ansible-collections/kubernetes.core/pull/1033).
+- k8s - Fix return block from the module documentation (https://github.com/ansible-collections/kubernetes.core/pull/1056).
+- meta - Add ``k8s_cluster_info``, ``k8s_json_patch`` and ``k8s_rollback`` to k8s action group (https://github.com/ansible-collections/kubernetes.core/pull/992).
+
+v5.4.1
+======
+
+Release Summary
+---------------
+
+This release includes bugfixes for k8s service field handling, k8s_cp init containers support, and removes deprecated ansible.module_utils.six imports.
+
+Bugfixes
+--------
+
+- Remove ``ansible.module_utils.six`` imports to avoid warnings (https://github.com/ansible-collections/kubernetes.core/pull/998).
+- Update the `k8s_cp` module to also work for init containers (https://github.com/ansible-collections/kubernetes.core/pull/971).
+- module_utils/k8s/service - hide fields first before creating diffs (https://github.com/ansible-collections/kubernetes.core/pull/915).
+
+v5.4.0
+======
+
+Release Summary
+---------------
+
+This release updates the ``helm_registry_auth`` module to match the behavior of ``helm >= 3.18.0`` which reports a successful logout regardless of the current state (i.e., no idempotency).
+
+Minor Changes
+-------------
+
+- Module ``helm_registry_auth`` does not support idempotency with ``helm >= 3.18.0`` (https://github.com/ansible-collections/kubernetes.core/pull/946)
+
+v5.3.0
+======
+
+Release Summary
+---------------
+
+This release includes minor changes, bug fixes and also bumps ``ansible-lint`` version to ``25.1.2``.
+
+Minor Changes
+-------------
+
+- Bump version of ``ansible-lint`` to 25.1.2 (https://github.com/ansible-collections/kubernetes.core/pull/919).
+- action/k8s_info - update templating mechanism with changes from ``ansible-core 2.19`` (https://github.com/ansible-collections/kubernetes.core/pull/888).
+- helm - add ``reset_then_reuse_values`` support to helm module (https://github.com/ansible-collections/kubernetes.core/issues/803).
+- helm - add support for ``insecure_skip_tls_verify`` option to helm and helm_repository(https://github.com/ansible-collections/kubernetes.core/issues/694).
+
+Bugfixes
+--------
+
+- module_utils/k8s/service - fix issue when trying to delete resource using ``delete_options`` and ``check_mode=true`` (https://github.com/ansible-collections/kubernetes.core/issues/892).
+
+v5.2.0
+======
+
+Release Summary
+---------------
+
+This release adds more functionality to the hidden_fields option and support for waiting on ClusterOperators to reach a ready state.
+
+Minor Changes
+-------------
+
+- k8s - Extend hidden_fields to allow the expression of more complex field types to be hidden (https://github.com/ansible-collections/kubernetes.core/pull/872)
+- k8s_info - Extend hidden_fields to allow the expression of more complex field types to be hidden (https://github.com/ansible-collections/kubernetes.core/pull/872)
+- waiter.py - add ClusterOperator support. The module can now check OpenShift cluster health by verifying ClusterOperator status requiring 'Available: True', 'Degraded: False', and 'Progressing: False' for success. (https://github.com/ansible-collections/kubernetes.core/issues/869)
+
+v5.1.0
+======
+
+Release Summary
+---------------
+
+This release came with new module ``helm_registry_auth``, improvements to the error messages in the k8s_drain module, new parameter ``insecure_registry`` for ``helm_template`` module and several bug fixes.
+
+Minor Changes
+-------------
+
+- Bump version of ``ansible-lint`` to minimum 24.7.0 (https://github.com/ansible-collections/kubernetes.core/pull/765).
+- Parameter insecure_registry added to helm_template as equivalent of insecure-skip-tls-verify (https://github.com/ansible-collections/kubernetes.core/pull/805).
+- k8s_drain - Improve error message for pod disruption budget when draining a node (https://github.com/ansible-collections/kubernetes.core/issues/797).
+
+Bugfixes
+--------
+
+- helm - Helm version checks did not support RC versions. They now accept any version tags. (https://github.com/ansible-collections/kubernetes.core/pull/745).
+- helm_pull - Apply no_log=True to pass_credentials to silence false positive warning. (https://github.com/ansible-collections/kubernetes.core/pull/796).
+- k8s_drain - Fix k8s_drain does not wait for single pod (https://github.com/ansible-collections/kubernetes.core/issues/769).
+- k8s_drain - Fix k8s_drain runs into a timeout when evicting a pod which is part of a stateful set  (https://github.com/ansible-collections/kubernetes.core/issues/792).
+- kubeconfig option should not appear in module invocation log (https://github.com/ansible-collections/kubernetes.core/issues/782).
+- kustomize - kustomize plugin fails with deprecation warnings (https://github.com/ansible-collections/kubernetes.core/issues/639).
+- waiter - Fix waiting for daemonset when desired number of pods is 0. (https://github.com/ansible-collections/kubernetes.core/pull/756).
+
+New Modules
+-----------
+
+- helm_registry_auth - Helm registry authentication module
+
+v5.0.0
+======
+
+Release Summary
+---------------
+
+This major release drops support for ``ansible-core<2.15``.
+
+Minor Changes
+-------------
+
+- connection/kubectl.py - Added an example of using the kubectl connection plugin to the documentation (https://github.com/ansible-collections/kubernetes.core/pull/741).
+- inventory/k8s.py - Defer removal of k8s inventory plugin to version 6.0.0 (https://github.com/ansible-collections/kubernetes.core/pull/734).
+
+Breaking Changes / Porting Guide
+--------------------------------
+
+- Remove support for ``ansible-core<2.15`` (https://github.com/ansible-collections/kubernetes.core/pull/737).
+
+v4.0.0
+======
+
+Release Summary
+---------------
+
+This major release brings several bug fixes. We have also removed support for ``ansible-core<2.15`` and deprecated functions and class from ``module_utils/common.py``.
+
+Minor Changes
+-------------
+
+- inventory/k8s.py - Defer removal of k8s inventory plugin to version 5.0 (https://github.com/ansible-collections/kubernetes.core/pull/723).
+- k8s - The module and K8sService were changed so warnings returned by the K8S API are now displayed to the user.
+
+Removed Features (previously deprecated)
+----------------------------------------
+
+- k8s - Support for ``merge_type=json`` has been removed in version 4.0.0. Please use ``kubernetes.core.k8s_json_patch`` instead (https://github.com/ansible-collections/kubernetes.core/pull/722).
+- k8s_exec - the previously deprecated ``result.return_code`` return value has been removed, consider using ``result.rc`` instead (https://github.com/ansible-collections/kubernetes.core/pull/726).
+- module_utils/common.py - the previously deprecated ``K8sAnsibleMixin`` class has been removed (https://github.com/ansible-collections/kubernetes.core/pull/726).
+- module_utils/common.py - the previously deprecated ``configuration_digest()`` function has been removed (https://github.com/ansible-collections/kubernetes.core/pull/726).
+- module_utils/common.py - the previously deprecated ``get_api_client()`` function has been removed (https://github.com/ansible-collections/kubernetes.core/pull/726).
+- module_utils/common.py - the previously deprecated ``unique_string()`` function has been removed (https://github.com/ansible-collections/kubernetes.core/pull/726).
+
+Bugfixes
+--------
+
+- Resolve Collections util resource discovery fails when complex subresources present (https://github.com/ansible-collections/kubernetes.core/pull/676).
+- align `helmdiff_check()` function commandline rendering with the `deploy()` function (https://github.com/ansible-collections/kubernetes.core/pull/670).
+- avoid unsafe conditions in integration tests (https://github.com/ansible-collections/kubernetes.core/pull/665).
+- helm - use ``reuse-values`` when running ``helm diff`` command (https://github.com/ansible-collections/kubernetes.core/issues/680).
+- integrations test helm_kubeconfig - set helm version to v3.10.3 to avoid incompatability with new bitnami charts (https://github.com/ansible-collections/kubernetes.core/pull/670).
+
+v3.3.1
+======
+
+Release Summary
+---------------
+
+This release fixes the CI issues with the ``linters`` workflow.
+
+v3.3.0
+======
+
+Release Summary
+---------------
+
+This release comes with improvements to the error messages in the k8s_drain module and several bug fixes.
+
+Minor Changes
+-------------
+
+- k8s_drain - Improve error message for pod disruption budget when draining a node (https://github.com/ansible-collections/kubernetes.core/issues/797).
+
+Bugfixes
+--------
+
+- helm - Helm version checks did not support RC versions. They now accept any version tags. (https://github.com/ansible-collections/kubernetes.core/pull/745).
+- helm_pull - Apply no_log=True to pass_credentials to silence false positive warning. (https://github.com/ansible-collections/kubernetes.core/pull/796).
+- k8s_drain - Fix k8s_drain does not wait for single pod (https://github.com/ansible-collections/kubernetes.core/issues/769).
+- k8s_drain - Fix k8s_drain runs into a timeout when evicting a pod which is part of a stateful set  (https://github.com/ansible-collections/kubernetes.core/issues/792).
+- kubeconfig option should not appear in module invocation log (https://github.com/ansible-collections/kubernetes.core/issues/782).
+- kustomize - kustomize plugin fails with deprecation warnings (https://github.com/ansible-collections/kubernetes.core/issues/639).
+- waiter - Fix waiting for daemonset when desired number of pods is 0. (https://github.com/ansible-collections/kubernetes.core/pull/756).
+
+v3.2.0
+======
+
+Release Summary
+---------------
+
+This release comes with documentation updates.
+
+Minor Changes
+-------------
+
+- connection/kubectl.py - Added an example of using the kubectl connection plugin to the documentation (https://github.com/ansible-collections/kubernetes.core/pull/741).
+- inventory/k8s.py - Defer removal of k8s inventory plugin to version 5.0 (https://github.com/ansible-collections/kubernetes.core/pull/723).
+- inventory/k8s.py - Defer removal of k8s inventory plugin to version 6.0.0 (https://github.com/ansible-collections/kubernetes.core/pull/734).
+
+v3.1.0
+======
+
+Release Summary
+---------------
+
+This release comes with some bugfixes and documentation updates. It also adds new features to the kubectl connection plugin and the kustomize lookup plugin.
+
+Minor Changes
+-------------
+
+- kubectl - added support of local enviroment variable that will be used for kubectl and may be requried for establishing connections ifself (https://github.com/ansible-collections/kubernetes.core/pull/702)
+- kustomize - new parameter added to --enable-helm (https://github.com/ansible-collections/kubernetes.core/issues/568)
+
+Bugfixes
+--------
+
+- helm - expand kubeconfig path with user's home directory for consistency with k8s
+- k8s_json_patch - rename action symlink to ensure k8s action plugin is used (https://github.com/ansible-collections/kubernetes.core/pull/652).
+
+v3.0.1
+======
+
+Release Summary
+---------------
+
+This release fixes issue with resources discovery when complex subresources are present, and fixes issues with `reuse-values` parameter for helm module.
+
+Bugfixes
+--------
+
+- Resolve Collections util resource discovery fails when complex subresources present (https://github.com/ansible-collections/kubernetes.core/pull/676).
+- align `helmdiff_check()` function commandline rendering with the `deploy()` function (https://github.com/ansible-collections/kubernetes.core/pull/670).
+- helm - use ``reuse-values`` when running ``helm diff`` command (https://github.com/ansible-collections/kubernetes.core/issues/680).
+- integrations test helm_kubeconfig - set helm version to v3.10.3 to avoid incompatability with new bitnami charts (https://github.com/ansible-collections/kubernetes.core/pull/670).
 
 v3.0.0
 ======

CONTRIBUTING.md

@@ -48,7 +48,7 @@ Where modules have multiple parameters we recommend running through the 4-step m
 
 For general information on running the integration tests see the
 [Integration Tests page of the Module Development Guide](https://docs.ansible.com/ansible/devel/dev_guide/testing_integration.html#testing-integration),
-especially the section on configuration for cloud tests. For questions about writing tests the Ansible Kubernetes community can be found on Libera.Chat IRC as detailed below.
+especially the section on configuration for cloud tests.
 
 ### Updating documentation
 
@@ -70,11 +70,3 @@ Review the changes and create a pull request using updated files.
 The `kubernetes.core` collection follows the Ansible project's
 [Code of Conduct](https://docs.ansible.com/ansible/devel/community/code_of_conduct.html).
 Please read and familiarize yourself with this document.
-
-### IRC
-Our IRC channels may require you to register your nickname. If you receive an error when you connect, see
-[Libera.Chat's Nickname Registration guide](https://libera.chat/guides/registration) for instructions.
-
-The `#ansible-kubernetes` channel on [libera.chat](https://libera.chat/) IRC is the main and official place to discuss use and development of the `kubernetes.core` collection.
-
-For more information about Ansible's Kubernetes integration, browse the resources in the [Kubernetes Working Group](https://github.com/ansible/community/wiki/Kubernetes) Community wiki page.

Makefile

@@ -1,5 +1,5 @@
 # Also needs to be updated in galaxy.yml
-VERSION = 3.0.0
+VERSION = 5.4.2
 
 TEST_ARGS ?= ""
 PYTHON_VERSION ?= `python -c 'import platform; print(".".join(platform.python_version_tuple()[0:2]))'`

README.md

@@ -1,15 +1,29 @@
 # Kubernetes Collection for Ansible
 
-[![CI](https://github.com/ansible-collections/kubernetes.core/workflows/CI/badge.svg?event=push)](https://github.com/ansible-collections/kubernetes.core/actions) [![Codecov](https://img.shields.io/codecov/c/github/ansible-collections/kubernetes.core)](https://codecov.io/gh/ansible-collections/kubernetes.core)
-
 This repository hosts the `kubernetes.core` (formerly known as `community.kubernetes`) Ansible Collection.
 
+## Description
+
 The collection includes a variety of Ansible content to help automate the management of applications in Kubernetes and OpenShift clusters, as well as the provisioning and maintenance of clusters themselves.
 
-<!--start requires_ansible-->
-## Ansible version compatibility
+## Communication
 
-This collection has been tested against following Ansible versions: **>=2.14.0**.
+* Join the Ansible forum:
+  * [Get Help](https://forum.ansible.com/c/help/6): get help or help others.
+  * [Posts tagged with 'kubernetes'](https://forum.ansible.com/tag/kubernetes): subscribe to participate in collection-related conversations.
+  * [Social Spaces](https://forum.ansible.com/c/chat/4): gather and interact with fellow enthusiasts.
+  * [News & Announcements](https://forum.ansible.com/c/news/5): track project-wide announcements including social events.
+
+* The Ansible [Bullhorn newsletter](https://docs.ansible.com/ansible/devel/community/communication.html#the-bullhorn): used to announce releases and important changes.
+
+For more information about communication, see the [Ansible communication guide](https://docs.ansible.com/ansible/devel/community/communication.html).
+
+## Requirements
+
+<!--start requires_ansible-->
+## Ansible Version Compatibility
+
+This collection has been tested against following Ansible versions: **>=2.15.0**.
 
 For collections that support Ansible 2.9, please ensure you update your `network_os` to use the
 fully qualified collection name (for example, `cisco.ios.ios`).
@@ -18,37 +32,41 @@ A collection may contain metadata that identifies these versions.
 PEP440 is the schema used to describe the versions of Ansible.
 <!--end requires_ansible-->
 
-## Python Support
+### Helm Version Compatibility
+
+Helm modules in this collection are compatible with Helm v3.x and are not yet compatible with Helm v4. Individual modules and their parameters may support a more specific range of Helm versions.
+
+### Python Support
 
 * Collection supports 3.9+
 
 Note: Python2 is deprecated from [1st January 2020](https://www.python.org/doc/sunset-python-2/). Please switch to Python3.
 
-## Kubernetes Version Support
+### Kubernetes Version Support
 
 This collection supports Kubernetes versions >= 1.24.
 
-## Included content
+### Included Content
 
 Click on the name of a plugin or module to view that content's documentation:
 
 <!--start collection content-->
-### Connection plugins
+### Connection Plugins
 Name | Description
 --- | ---
 [kubernetes.core.kubectl](https://github.com/ansible-collections/kubernetes.core/blob/main/docs/kubernetes.core.kubectl_connection.rst)|Execute tasks in pods running on Kubernetes.
 
-### K8s filter plugins
+### K8s filter Plugins
 Name | Description
 --- | ---
 kubernetes.core.k8s_config_resource_name|Generate resource name for the given resource of type ConfigMap, Secret
 
-### Inventory plugins
+### Inventory Plugins
 Name | Description
 --- | ---
 [kubernetes.core.k8s](https://github.com/ansible-collections/kubernetes.core/blob/main/docs/kubernetes.core.k8s_inventory.rst)|Kubernetes (K8s) inventory source
 
-### Lookup plugins
+### Lookup Plugins
 Name | Description
 --- | ---
 [kubernetes.core.k8s](https://github.com/ansible-collections/kubernetes.core/blob/main/docs/kubernetes.core.k8s_lookup.rst)|Query the K8s API
@@ -62,6 +80,7 @@ Name | Description
 [kubernetes.core.helm_plugin](https://github.com/ansible-collections/kubernetes.core/blob/main/docs/kubernetes.core.helm_plugin_module.rst)|Manage Helm plugins
 [kubernetes.core.helm_plugin_info](https://github.com/ansible-collections/kubernetes.core/blob/main/docs/kubernetes.core.helm_plugin_info_module.rst)|Gather information about Helm plugins
 [kubernetes.core.helm_pull](https://github.com/ansible-collections/kubernetes.core/blob/main/docs/kubernetes.core.helm_pull_module.rst)|download a chart from a repository and (optionally) unpack it in local directory.
+[kubernetes.core.helm_registry_auth](https://github.com/ansible-collections/kubernetes.core/blob/main/docs/kubernetes.core.helm_registry_auth_module.rst)|Helm registry authentication module
 [kubernetes.core.helm_repository](https://github.com/ansible-collections/kubernetes.core/blob/main/docs/kubernetes.core.helm_repository_module.rst)|Manage Helm repositories.
 [kubernetes.core.helm_template](https://github.com/ansible-collections/kubernetes.core/blob/main/docs/kubernetes.core.helm_template_module.rst)|Render chart templates
 [kubernetes.core.k8s](https://github.com/ansible-collections/kubernetes.core/blob/main/docs/kubernetes.core.k8s_module.rst)|Manage Kubernetes (K8s) objects
@@ -79,9 +98,7 @@ Name | Description
 
 <!--end collection content-->
 
-## Installation and Usage
-
-### Installing the Collection from Ansible Galaxy
+## Installation
 
 Before using the Kubernetes collection, you need to install it with the Ansible Galaxy CLI:
 
@@ -93,7 +110,7 @@ You can also include it in a `requirements.yml` file and install it via `ansible
 ---
 collections:
   - name: kubernetes.core
-    version: 3.0.0
+    version: 5.4.2
 ```
 
 ### Installing the Kubernetes Python Library
@@ -102,7 +119,7 @@ Content in this collection requires the [Kubernetes Python client](https://pypi.
 
     pip3 install kubernetes
 
-### Using modules from the Kubernetes Collection in your playbooks
+## Use Cases
 
 It's preferable to use content in this collection using their Fully Qualified Collection Namespace (FQCN), for example `kubernetes.core.k8s_info`:
 
@@ -170,8 +187,7 @@ If upgrading older playbooks which were built prior to Ansible 2.10 and this col
 
 For documentation on how to use individual modules and other content included in this collection, please see the links in the 'Included content' section earlier in this README.
 
-## Ansible Turbo mode Tech Preview
-
+## Ansible Turbo Mode Tech Preview
 
 The ``kubernetes.core`` collection supports Ansible Turbo mode as a tech preview via the ``cloud.common`` collection. By default, this feature is disabled. To enable Turbo mode for modules, set the environment variable `ENABLE_TURBO_MODE=1` on the managed node. For example:
 
@@ -189,12 +205,16 @@ defined in the playbook using `environment` keyword as above, you must set it us
 
 Please read more about Ansible Turbo mode - [here](https://github.com/ansible-collections/kubernetes.core/blob/main/docs/ansible_turbo_mode.rst).
 
-## Testing and Development
+## Contributing to this Collection
 
 If you want to develop new content for this collection or improve what's already here, the easiest way to work on the collection is to clone it into one of the configured [`COLLECTIONS_PATHS`](https://docs.ansible.com/ansible/latest/reference_appendices/config.html#collections-paths), and work on it there.
 
 See [Contributing to kubernetes.core](CONTRIBUTING.md).
 
+## Testing
+
+[![Linters](https://img.shields.io/github/actions/workflow/status/ansible-collections/kubernetes.core/linters.yaml?label=linters)](https://github.com/ansible-collections/kubernetes.core/actions/workflows/linters.yaml) [![Integration tests](https://img.shields.io/github/actions/workflow/status/ansible-collections/kubernetes.core/integration-tests.yaml?label=integration%20tests)](https://github.com/ansible-collections/kubernetes.core/actions/workflows/integration-tests.yaml) [![Sanity tests](https://img.shields.io/github/actions/workflow/status/ansible-collections/kubernetes.core/sanity-tests.yaml?label=sanity%20tests)](https://github.com/ansible-collections/kubernetes.core/actions/workflows/sanity-tests.yaml) [![Unit tests](https://img.shields.io/github/actions/workflow/status/ansible-collections/kubernetes.core/unit-tests.yaml?label=unit%20tests)](https://github.com/ansible-collections/kubernetes.core/actions/workflows/unit-tests.yaml) [![Codecov](https://img.shields.io/codecov/c/github/ansible-collections/kubernetes.core)](https://app.codecov.io/gh/ansible-collections/kubernetes.core)
+
 ### Testing with `ansible-test`
 
 The `tests` directory contains configuration for running sanity and integration tests using [`ansible-test`](https://docs.ansible.com/ansible/latest/dev_guide/testing_integration.html).
@@ -207,7 +227,7 @@ You can run the collection's test suites with the commands:
 
 ### Testing with `molecule`
 
-There are also integration tests in the `molecule` directory which are meant to be run against a local Kubernetes cluster, e.g. using [KinD](https://kind.sigs.k8s.io) or [Minikube](https://minikube.sigs.k8s.io). To setup a local cluster using KinD and run Molecule:
+There are also integration tests in the `molecule` directory which are meant to be run against a local Kubernetes cluster, e.g. using [KinD](https://kind.sigs.k8s.io) or [Minikube](https://minikube.sigs.k8s.io). To set up a local cluster using KinD and run Molecule:
 
     kind create cluster
     make test-molecule
@@ -231,12 +251,35 @@ After the version is published, verify it exists on the [Kubernetes Collection G
 
 The process for uploading a supported release to Automation Hub is documented separately.
 
-## More Information
+## Support
 
-For more information about Ansible's Kubernetes integration, join the `#ansible-kubernetes` channel on [libera.chat](https://libera.chat/) IRC, and browse the resources in the [Kubernetes Working Group](https://github.com/ansible/community/wiki/Kubernetes) Community wiki page.
+<!--List available communication channels. In addition to channels specific to your collection, we also recommend to use the following ones.-->
+
+> **Note:** The `stable-4` branch, which handles all `4.x.y` releases of this collection, is no longer supported. This means that no backports nor releases will be performed on the `stable-4` branch.
+
+We announce releases and important changes through Ansible's [The Bullhorn newsletter](https://github.com/ansible/community/wiki/News#the-bullhorn). Be sure you are [subscribed](https://eepurl.com/gZmiEP).
+
+We take part in the global quarterly [Ansible Contributor Summit](https://github.com/ansible/community/wiki/Contributor-Summit) virtually or in-person. Track [The Bullhorn newsletter](https://eepurl.com/gZmiEP) and join us.
+
+For more information about communication, refer to the [Ansible Communication guide](https://docs.ansible.com/ansible/devel/community/communication.html).
+
+For the latest supported versions, refer to the release notes below.
+
+If you encounter issues or have questions, you can submit a support request through the following channels:
+ - GitHub Issues: Report bugs, request features, or ask questions by opening an issue in the [GitHub repository](https://github.com/ansible-collections/kubernetes.core/).
+
+## Release Notes
+
+See the [raw generated changelog](https://github.com/ansible-collections/kubernetes.core/blob/main/CHANGELOG.rst).
+
+## Code of Conduct
+
+We follow the [Ansible Code of Conduct](https://docs.ansible.com/ansible/devel/community/code_of_conduct.html) in all our interactions within this project.
+
+If you encounter abusive behavior, please refer to the [policy violations](https://docs.ansible.com/ansible/devel/community/code_of_conduct.html#policy-violations) section of the Code for information on how to raise a complaint.
 
 ## License
 
 GNU General Public License v3.0 or later
 
-See LICENCE to see the full text.
+See LICENSE to see the full text.

changelogs/changelog.yaml

@@ -814,3 +814,305 @@ releases:
     - remove_ansible_2_13.yaml
     - update_supported_versions.yaml
     release_date: '2023-11-17'
+  3.0.1:
+    changes:
+      bugfixes:
+      - Resolve Collections util resource discovery fails when complex subresources
+        present (https://github.com/ansible-collections/kubernetes.core/pull/676).
+      - align `helmdiff_check()` function commandline rendering with the `deploy()`
+        function (https://github.com/ansible-collections/kubernetes.core/pull/670).
+      - helm - use ``reuse-values`` when running ``helm diff`` command (https://github.com/ansible-collections/kubernetes.core/issues/680).
+      - integrations test helm_kubeconfig - set helm version to v3.10.3 to avoid incompatability
+        with new bitnami charts (https://github.com/ansible-collections/kubernetes.core/pull/670).
+      release_summary: This release fixes issue with resources discovery when complex
+        subresources are present, and fixes issues with `reuse-values` parameter for
+        helm module.
+    fragments:
+    - 20240117-fix-helm-diff-cmd-line-rendering.yml
+    - 20240222-Collections-util-resource-discovery-fails-when-complex-subresources-present.yml
+    - 20240228-fix-helm-diff-with-reuse-values.yml
+    - 3.0.1.yml
+    release_date: '2024-03-01'
+  3.1.0:
+    changes:
+      bugfixes:
+      - helm - expand kubeconfig path with user's home directory for consistency with
+        k8s
+      - k8s_json_patch - rename action symlink to ensure k8s action plugin is used
+        (https://github.com/ansible-collections/kubernetes.core/pull/652).
+      minor_changes:
+      - kubectl - added support of local enviroment variable that will be used for
+        kubectl and may be requried for establishing connections ifself (https://github.com/ansible-collections/kubernetes.core/pull/702)
+      - kustomize - new parameter added to --enable-helm (https://github.com/ansible-collections/kubernetes.core/issues/568)
+      release_summary: This release comes with some bugfixes and documentation updates.
+        It also adds new features to the kubectl connection plugin and the kustomize
+        lookup plugin.
+    fragments:
+    - 20240426-add-support-of-kubectl-local-env-vars-for-connection-plugin.yml
+    - 3.1.0.yml
+    - 592-kustomize-helm-support.yml
+    - 652-fix-json-patch-action.yml
+    - 654-helm-expand-user.yml
+    release_date: '2024-05-16'
+  3.2.0:
+    changes:
+      minor_changes:
+      - connection/kubectl.py - Added an example of using the kubectl connection plugin
+        to the documentation (https://github.com/ansible-collections/kubernetes.core/pull/741).
+      - inventory/k8s.py - Defer removal of k8s inventory plugin to version 5.0 (https://github.com/ansible-collections/kubernetes.core/pull/723).
+      - inventory/k8s.py - Defer removal of k8s inventory plugin to version 6.0.0
+        (https://github.com/ansible-collections/kubernetes.core/pull/734).
+      release_summary: This release comes with documentation updates.
+    fragments:
+    - 20240530-defer-removal-and-ansible-core-support-update.yaml
+    - 20240601-doc-example-of-using-kubectl.yaml
+    - 3.2.0.yml
+    - inventory-update_removal_date.yml
+    release_date: '2024-06-14'
+  3.3.0:
+    changes:
+      bugfixes:
+      - helm - Helm version checks did not support RC versions. They now accept any
+        version tags. (https://github.com/ansible-collections/kubernetes.core/pull/745).
+      - helm_pull - Apply no_log=True to pass_credentials to silence false positive
+        warning. (https://github.com/ansible-collections/kubernetes.core/pull/796).
+      - k8s_drain - Fix k8s_drain does not wait for single pod (https://github.com/ansible-collections/kubernetes.core/issues/769).
+      - k8s_drain - Fix k8s_drain runs into a timeout when evicting a pod which is
+        part of a stateful set  (https://github.com/ansible-collections/kubernetes.core/issues/792).
+      - kubeconfig option should not appear in module invocation log (https://github.com/ansible-collections/kubernetes.core/issues/782).
+      - kustomize - kustomize plugin fails with deprecation warnings (https://github.com/ansible-collections/kubernetes.core/issues/639).
+      - waiter - Fix waiting for daemonset when desired number of pods is 0. (https://github.com/ansible-collections/kubernetes.core/pull/756).
+      minor_changes:
+      - k8s_drain - Improve error message for pod disruption budget when draining
+        a node (https://github.com/ansible-collections/kubernetes.core/issues/797).
+      release_summary: This release comes with improvements to the error messages
+        in the k8s_drain module and several bug fixes.
+    fragments:
+    - 20240530-ansible-core-support-update.yaml
+    - 20240611-helm-rc-version.yaml
+    - 20240620-fix-kustomize-plugin-fails-with-deprecation-warnings.yml
+    - 20241102-fix-ci-post-2.18-issue.yaml
+    - 20241213-kubeconfig-set-no_log-true.yaml
+    - 756-fix-daemonset-waiting.yaml
+    - 770-fix-k8s-drain-doesnt-wait-for-single-pod.yaml
+    - 793-fix-k8s-drain-runs-into-timeout.yaml
+    - 796-false-positive-helmull.yaml
+    - 798-drain-pdb-error-message.yaml
+    - readme_template_update.yml
+    release_date: '2025-01-20'
+  3.3.1:
+    changes:
+      release_summary: This release fixes the CI issues with the ``linters`` workflow.
+    fragments:
+    - release_summary.yml
+    release_date: '2025-03-26'
+  4.0.0:
+    changes:
+      bugfixes:
+      - Resolve Collections util resource discovery fails when complex subresources
+        present (https://github.com/ansible-collections/kubernetes.core/pull/676).
+      - align `helmdiff_check()` function commandline rendering with the `deploy()`
+        function (https://github.com/ansible-collections/kubernetes.core/pull/670).
+      - avoid unsafe conditions in integration tests (https://github.com/ansible-collections/kubernetes.core/pull/665).
+      - helm - use ``reuse-values`` when running ``helm diff`` command (https://github.com/ansible-collections/kubernetes.core/issues/680).
+      - integrations test helm_kubeconfig - set helm version to v3.10.3 to avoid incompatability
+        with new bitnami charts (https://github.com/ansible-collections/kubernetes.core/pull/670).
+      minor_changes:
+      - inventory/k8s.py - Defer removal of k8s inventory plugin to version 5.0 (https://github.com/ansible-collections/kubernetes.core/pull/723).
+      - k8s - The module and K8sService were changed so warnings returned by the K8S
+        API are now displayed to the user.
+      release_summary: This major release brings several bug fixes. We have also removed
+        support for ``ansible-core<2.15`` and deprecated functions and class from
+        ``module_utils/common.py``.
+      removed_features:
+      - k8s - Support for ``merge_type=json`` has been removed in version 4.0.0. Please
+        use ``kubernetes.core.k8s_json_patch`` instead (https://github.com/ansible-collections/kubernetes.core/pull/722).
+      - k8s_exec - the previously deprecated ``result.return_code`` return value has
+        been removed, consider using ``result.rc`` instead (https://github.com/ansible-collections/kubernetes.core/pull/726).
+      - module_utils/common.py - the previously deprecated ``K8sAnsibleMixin`` class
+        has been removed (https://github.com/ansible-collections/kubernetes.core/pull/726).
+      - module_utils/common.py - the previously deprecated ``configuration_digest()``
+        function has been removed (https://github.com/ansible-collections/kubernetes.core/pull/726).
+      - module_utils/common.py - the previously deprecated ``get_api_client()`` function
+        has been removed (https://github.com/ansible-collections/kubernetes.core/pull/726).
+      - module_utils/common.py - the previously deprecated ``unique_string()`` function
+        has been removed (https://github.com/ansible-collections/kubernetes.core/pull/726).
+    fragments:
+    - 20231206-fix-unsafe-condition-in-integration.yml
+    - 20240117-fix-helm-diff-cmd-line-rendering.yml
+    - 20240222-Collections-util-resource-discovery-fails-when-complex-subresources-present.yml
+    - 20240228-fix-helm-diff-with-reuse-values.yml
+    - 20240423-k8s-display-warnings-to-users.yml
+    - 4.0.0.yaml
+    - inventory-update_removal_date.yml
+    - k8s-merge_type-removed.yml
+    - module_utils-common-remove-deprecated-functions-and-class.yaml
+    release_date: '2024-05-24'
+  5.0.0:
+    changes:
+      breaking_changes:
+      - Remove support for ``ansible-core<2.15`` (https://github.com/ansible-collections/kubernetes.core/pull/737).
+      minor_changes:
+      - connection/kubectl.py - Added an example of using the kubectl connection plugin
+        to the documentation (https://github.com/ansible-collections/kubernetes.core/pull/741).
+      - inventory/k8s.py - Defer removal of k8s inventory plugin to version 6.0.0
+        (https://github.com/ansible-collections/kubernetes.core/pull/734).
+      release_summary: This major release drops support for ``ansible-core<2.15``.
+    fragments:
+    - 20240530-ansible-core-support-update.yaml
+    - 20240530-defer-removal-and-ansible-core-support-update.yaml
+    - 5.0.0.yml
+    release_date: '2024-05-31'
+  5.1.0:
+    changes:
+      bugfixes:
+      - helm - Helm version checks did not support RC versions. They now accept any
+        version tags. (https://github.com/ansible-collections/kubernetes.core/pull/745).
+      - helm_pull - Apply no_log=True to pass_credentials to silence false positive
+        warning. (https://github.com/ansible-collections/kubernetes.core/pull/796).
+      - k8s_drain - Fix k8s_drain does not wait for single pod (https://github.com/ansible-collections/kubernetes.core/issues/769).
+      - k8s_drain - Fix k8s_drain runs into a timeout when evicting a pod which is
+        part of a stateful set  (https://github.com/ansible-collections/kubernetes.core/issues/792).
+      - kubeconfig option should not appear in module invocation log (https://github.com/ansible-collections/kubernetes.core/issues/782).
+      - kustomize - kustomize plugin fails with deprecation warnings (https://github.com/ansible-collections/kubernetes.core/issues/639).
+      - waiter - Fix waiting for daemonset when desired number of pods is 0. (https://github.com/ansible-collections/kubernetes.core/pull/756).
+      minor_changes:
+      - Bump version of ``ansible-lint`` to minimum 24.7.0 (https://github.com/ansible-collections/kubernetes.core/pull/765).
+      - Parameter insecure_registry added to helm_template as equivalent of insecure-skip-tls-verify
+        (https://github.com/ansible-collections/kubernetes.core/pull/805).
+      - k8s_drain - Improve error message for pod disruption budget when draining
+        a node (https://github.com/ansible-collections/kubernetes.core/issues/797).
+      release_summary: This release came with new module ``helm_registry_auth``, improvements
+        to the error messages in the k8s_drain module, new parameter ``insecure_registry``
+        for ``helm_template`` module and several bug fixes.
+    fragments:
+    - 0-readme.yml
+    - 20240601-doc-example-of-using-kubectl.yaml
+    - 20240611-helm-rc-version.yaml
+    - 20240620-fix-kustomize-plugin-fails-with-deprecation-warnings.yml
+    - 20241102-fix-ci-post-2.18-issue.yaml
+    - 20241103-completly-remove-obsolate-communication-channel.yaml
+    - 20241207-add-insecure-skip-tls-verify-to-helm-template.yaml
+    - 20241213-kubeconfig-set-no_log-true.yaml
+    - 756-fix-daemonset-waiting.yaml
+    - 765-bump-ansible-lint-version.yml
+    - 770-fix-k8s-drain-doesnt-wait-for-single-pod.yaml
+    - 793-fix-k8s-drain-runs-into-timeout.yaml
+    - 796-false-positive-helmull.yaml
+    - 798-drain-pdb-error-message.yaml
+    - readme_template_update.yml
+    modules:
+    - description: Helm registry authentication module
+      name: helm_registry_auth
+      namespace: ''
+    release_date: '2025-01-20'
+  5.2.0:
+    changes:
+      minor_changes:
+      - k8s - Extend hidden_fields to allow the expression of more complex field types
+        to be hidden (https://github.com/ansible-collections/kubernetes.core/pull/872)
+      - k8s_info - Extend hidden_fields to allow the expression of more complex field
+        types to be hidden (https://github.com/ansible-collections/kubernetes.core/pull/872)
+      - 'waiter.py - add ClusterOperator support. The module can now check OpenShift
+        cluster health by verifying ClusterOperator status requiring ''Available:
+        True'', ''Degraded: False'', and ''Progressing: False'' for success. (https://github.com/ansible-collections/kubernetes.core/issues/869)'
+      release_summary: This release adds more functionality to the hidden_fields option
+        and support for waiting on ClusterOperators to reach a ready state.
+    fragments:
+    - 5.2.0.yml
+    - 643-extend-hidden-fields.yaml
+    - 879-clusteroperator-waiter.py.yaml
+    release_date: '2025-03-27'
+  5.3.0:
+    changes:
+      bugfixes:
+      - module_utils/k8s/service - fix issue when trying to delete resource using
+        `delete_options` and `check_mode=true` (https://github.com/ansible-collections/kubernetes.core/issues/892).
+      minor_changes:
+      - kubernetes.core - Bump version of ``ansible-lint`` to ``25.1.2`` (https://github.com/ansible-collections/kubernetes.core/pull/919).
+      - action/k8s_info - update templating mechanism with changes from ``ansible-core
+        2.19`` (https://github.com/ansible-collections/kubernetes.core/pull/888).
+      - helm - add ``reset_then_reuse_values`` support to helm module (https://github.com/ansible-collections/kubernetes.core/issues/803).
+      - helm - add support for ``insecure_skip_tls_verify`` option to helm and ``helm_repository`` (https://github.com/ansible-collections/kubernetes.core/issues/694).
+      release_summary: This release includes minor changes, bug fixes and also bumps
+        ``ansible-lint`` version to ``25.1.2``.
+    fragments:
+    - 20250324-k8s_info-templating.yaml
+    - 5.3.0.yml
+    - 694-add-insecure-skip-tls-verify.yml
+    - 800-helm-add-reset_then_reuse_values-support.yml
+    - 898-k8s-dont-delete-in-check-mode.yaml
+    - 919-update-ansible-lint-version.yaml
+    release_date: '2025-05-16'
+  5.4.0:
+    changes:
+      minor_changes:
+      - Module ``helm_registry_auth`` does not support idempotency with ``helm >=
+        3.18.0`` (https://github.com/ansible-collections/kubernetes.core/pull/946).
+      release_summary: This release updates the ``helm_registry_auth`` module to match
+        the behavior of ``helm >= 3.18.0`` which reports a successful logout regardless
+        of the current state (i.e., no idempotency).
+    fragments:
+    - 20250411-kubeconfig-no_log-revert.yaml
+    - 20250503-fix-unit-tests.yml
+    - 20250605-fix-helm_registry_auth-integration_test.yaml
+    - 5.4.0.yml
+    release_date: '2025-08-12'
+  5.4.1:
+    changes:
+      bugfixes:
+      - Remove ``ansible.module_utils.six`` imports to avoid warnings (https://github.com/ansible-collections/kubernetes.core/pull/998).
+      - Update the `k8s_cp` module to also work for init containers (https://github.com/ansible-collections/kubernetes.core/pull/971).
+      - module_utils/k8s/service - hide fields first before creating diffs (https://github.com/ansible-collections/kubernetes.core/pull/915).
+      release_summary: This release includes bugfixes for k8s service field handling,
+        k8s_cp init containers support, and removes deprecated ansible.module_utils.six
+        imports.
+    fragments:
+    - 20250428-k8s-service-hide-fields-first.yaml
+    - 20250731-fix-k8s_cp-initcontainers.yaml
+    - 20250922-remove-ansible-six-imports.yaml
+    - 5.4.1.yml
+    release_date: '2025-10-07'
+  5.4.2:
+    changes:
+      bugfixes:
+      - Add idempotency for ``helm_pull`` module (https://github.com/ansible-collections/kubernetes.core/pull/1055).
+      - Fixed a bug where setting ``K8S_AUTH_VERIFY_SSL=true`` (or any string value)
+        caused the value to be treated as a separate ``kubectl`` command argument
+        (https://github.com/ansible-collections/kubernetes.core/pull/1049).
+      - Limit supported versions of Helm to <4.0.0 (https://github.com/ansible-collections/kubernetes.core/pull/1039).
+      - Replace passing ``warnings`` to ``exit_json`` with ``AnsibleModule.warn``
+        in the ``k8s_drain``, ``k8s_rollback.py`` and ``k8s_scale.py`` modules as
+        it deprecated in ``ansible-core>=2.19.0`` and will be removed in ``ansible-core>=2.23.0``
+        (https://github.com/ansible-collections/kubernetes.core/pull/1033).
+      - k8s - Fix return block from the module documentation (https://github.com/ansible-collections/kubernetes.core/pull/1056).
+      - meta - Add ``k8s_cluster_info``, ``k8s_json_patch`` and ``k8s_rollback`` to
+        k8s action group (https://github.com/ansible-collections/kubernetes.core/pull/992).
+      deprecated_features:
+      - helm - the ``status.values`` return value has been deprecated and will be
+        removed in a release after 2027-01-08. Use ``status.release_values`` instead
+        (https://github.com/ansible-collections/kubernetes.core/pull/1056).
+      - helm_info - the ``status.values`` return value has been deprecated and will
+        be removed in a release after 2027-01-08. Use ``status.release_values`` instead
+        (https://github.com/ansible-collections/kubernetes.core/pull/1056).
+      minor_changes:
+      - helm - added ``release_values`` key to ``status`` return value that can be
+        accessed using Jinja2 dot notation (https://github.com/ansible-collections/kubernetes.core/pull/1056).
+      - helm_info - added ``release_values`` key to ``status`` return value that can
+        be accessed using Jinja2 dot notation (https://github.com/ansible-collections/kubernetes.core/pull/1056).
+      release_summary: This release includes various bugfixes such as replacing the
+        passing of ``warnings`` to ``exit_json`` with ``AnsibleModule.warn`` as well
+        as security updates for selectively redacting sensitive information from kubeconfig.
+      security_fixes:
+      - Selectively redact sensitive info from kubeconfig instead of applying blanket
+        ``no_log=True`` (https://github.com/ansible-collections/kubernetes.core/pull/1014).
+    fragments:
+    - 1033-warnings-deprecations.yaml
+    - 20251002-fix-k8s-actiongroup.yaml
+    - 20251007-selective-kubeconfig-redaction.yaml
+    - 20251115-limit-versions-of-helm.yaml
+    - 20251220-fix-K8S_AUTH_VERIFY_SSL-in-kubectl-connecton-plugion.yaml
+    - 20260107-add-idempodency-for-helm-pull.yaml
+    - 20260108-fix-sanity-failures.yml
+    - 5-4-2.yaml
+    release_date: '2026-02-03'

docs/kubernetes.core.helm_module.rst

@@ -289,6 +289,29 @@ Parameters
                         <div>Provide a URL for accessing the API. Can also be specified via <code>K8S_AUTH_HOST</code> environment variable.</div>
                 </td>
             </tr>
+            <tr>
+                <td colspan="2">
+                    <div class="ansibleOptionAnchor" id="parameter-"></div>
+                    <b>insecure_skip_tls_verify</b>
+                    <a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
+                    <div style="font-size: small">
+                        <span style="color: purple">boolean</span>
+                    </div>
+                    <div style="font-style: italic; font-size: small; color: darkgreen">added in 5.3.0</div>
+                </td>
+                <td>
+                        <ul style="margin: 0; padding: 0"><b>Choices:</b>
+                                    <li><div style="color: blue"><b>no</b>&nbsp;&larr;</div></li>
+                                    <li>yes</li>
+                        </ul>
+                </td>
+                <td>
+                        <div>Skip tls certificate checks for the chart download.</div>
+                        <div>Do not confuse with the <code>validate_certs</code> option.</div>
+                        <div>This option is only available for helm &gt;= 3.16.0.</div>
+                        <div style="font-size: small; color: darkgreen"><br/>aliases: skip_tls_certs_check</div>
+                </td>
+            </tr>
             <tr>
                 <td colspan="2">
                     <div class="ansibleOptionAnchor" id="parameter-"></div>
@@ -435,6 +458,28 @@ Parameters
                         <div>mutually exclusive with with <code>history_max</code>.</div>
                 </td>
             </tr>
+            <tr>
+                <td colspan="2">
+                    <div class="ansibleOptionAnchor" id="parameter-"></div>
+                    <b>reset_then_reuse_values</b>
+                    <a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
+                    <div style="font-size: small">
+                        <span style="color: purple">boolean</span>
+                    </div>
+                    <div style="font-style: italic; font-size: small; color: darkgreen">added in 6.0.0</div>
+                </td>
+                <td>
+                        <ul style="margin: 0; padding: 0"><b>Choices:</b>
+                                    <li><div style="color: blue"><b>no</b>&nbsp;&larr;</div></li>
+                                    <li>yes</li>
+                        </ul>
+                </td>
+                <td>
+                        <div>When upgrading package, reset the values to the ones built into the chart, apply the last release&#x27;s values and merge in any overrides from parameters O(release_values), O(values_files) or O(set_values).</div>
+                        <div>If O(reset_values) or O(reuse_values) is set to V(True), this is ignored.</div>
+                        <div>This feature requires helm diff &gt;= 3.9.12.</div>
+                </td>
+            </tr>
             <tr>
                 <td colspan="2">
                     <div class="ansibleOptionAnchor" id="parameter-"></div>
@@ -443,7 +488,7 @@ Parameters
                     <div style="font-size: small">
                         <span style="color: purple">boolean</span>
                     </div>
-                    <div style="font-style: italic; font-size: small; color: darkgreen">added in 2.5.0</div>
+                    <div style="font-style: italic; font-size: small; color: darkgreen">added in 3.0.0</div>
                 </td>
                 <td>
                         <ul style="margin: 0; padding: 0"><b>Choices:</b>
@@ -463,7 +508,7 @@ Parameters
                     <div style="font-size: small">
                         <span style="color: purple">boolean</span>
                     </div>
-                    <div style="font-style: italic; font-size: small; color: darkgreen">added in 2.5.0</div>
+                    <div style="font-style: italic; font-size: small; color: darkgreen">added in 3.0.0</div>
                 </td>
                 <td>
                         <ul style="margin: 0; padding: 0"><b>Choices:</b>

docs/kubernetes.core.helm_pull_module.rst

@@ -27,7 +27,7 @@ Requirements
 ------------
 The below requirements are needed on the host that executes this module.
 
-- helm >= 3.0 (https://github.com/helm/helm/releases)
+- helm >= 3.0, <4.0.0 (https://github.com/helm/helm/releases)
 
 
 Parameters
@@ -174,6 +174,28 @@ Parameters
                         <div>location to write the chart.</div>
                 </td>
             </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="parameter-"></div>
+                    <b>force</b>
+                    <a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
+                    <div style="font-size: small">
+                        <span style="color: purple">boolean</span>
+                    </div>
+                    <div style="font-style: italic; font-size: small; color: darkgreen">added in 6.3.0</div>
+                </td>
+                <td>
+                        <ul style="margin: 0; padding: 0"><b>Choices:</b>
+                                    <li><div style="color: blue"><b>no</b>&nbsp;&larr;</div></li>
+                                    <li>yes</li>
+                        </ul>
+                </td>
+                <td>
+                        <div>Force download of the chart even if it already exists in the destination directory.</div>
+                        <div>By default, the module will skip downloading if the chart with the same version already exists for idempotency.</div>
+                        <div>When used with O(untar_chart=true), will remove any existing chart directory before extracting.</div>
+                </td>
+            </tr>
             <tr>
                 <td colspan="1">
                     <div class="ansibleOptionAnchor" id="parameter-"></div>
@@ -279,7 +301,8 @@ Parameters
                 </td>
                 <td>
                         <div>Whether or not to check tls certificate for the chart download.</div>
-                        <div>Requires helm &gt;= 3.3.0.</div>
+                        <div>Requires helm &gt;= 3.3.0. Alias <code>insecure_skip_tls_verify</code> added in 5.3.0.</div>
+                        <div style="font-size: small; color: darkgreen"><br/>aliases: insecure_skip_tls_verify</div>
                 </td>
             </tr>
             <tr>
@@ -375,11 +398,28 @@ Examples
         username: myuser
         password: mypassword123
 
+    - name: Download Chart (force re-download even if exists)
+      kubernetes.core.helm_pull:
+        chart_ref: redis
+        repo_url: https://charts.bitnami.com/bitnami
+        chart_version: '17.0.0'
+        destination: /path/to/chart
+        force: yes
+
+    - name: Download and untar chart (force re-extraction even if directory exists)
+      kubernetes.core.helm_pull:
+        chart_ref: redis
+        repo_url: https://charts.bitnami.com/bitnami
+        chart_version: '17.0.0'
+        destination: /path/to/chart
+        untar_chart: yes
+        force: yes
+
 
 
 Return Values
 -------------
-Common return values are documented `here <https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values>`_, the following are the fields unique to this module:
+Common return values are documented `here <https://docs.ansible.com/projects/ansible/latest/reference_appendices/common_return_values.html#common-return-values>`_, the following are the fields unique to this module:
 
 .. raw:: html
 
@@ -406,6 +446,23 @@ Common return values are documented `here <https://docs.ansible.com/ansible/late
                         <div style="font-size: smaller; color: blue; word-wrap: break-word; word-break: break-all;">helm pull --repo test ...</div>
                 </td>
             </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="return-"></div>
+                    <b>msg</b>
+                    <a class="ansibleOptionLink" href="#return-" title="Permalink to this return value"></a>
+                    <div style="font-size: small">
+                      <span style="color: purple">string</span>
+                    </div>
+                </td>
+                <td>when chart already exists</td>
+                <td>
+                            <div>A message indicating the result of the operation.</div>
+                    <br/>
+                        <div style="font-size: smaller"><b>Sample:</b></div>
+                        <div style="font-size: smaller; color: blue; word-wrap: break-word; word-break: break-all;">Chart redis version 17.0.0 already exists in destination directory</div>
+                </td>
+            </tr>
             <tr>
                 <td colspan="1">
                     <div class="ansibleOptionAnchor" id="return-"></div>

docs/kubernetes.core.helm_registry_auth_module.rst

@@ -0,0 +1,333 @@
+.. _kubernetes.core.helm_registry_auth_module:
+
+
+**********************************
+kubernetes.core.helm_registry_auth
+**********************************
+
+**Helm registry authentication module**
+
+
+Version added: 5.1.0
+
+.. contents::
+   :local:
+   :depth: 1
+
+
+Synopsis
+--------
+- Helm registry authentication module allows you to login ``helm registry login`` and logout ``helm registry logout`` from a Helm registry.
+
+
+
+Requirements
+------------
+The below requirements are needed on the host that executes this module.
+
+- helm (https://github.com/helm/helm/releases) >= 3.8.0, <4.0.0
+
+
+Parameters
+----------
+
+.. raw:: html
+
+    <table  border=0 cellpadding=0 class="documentation-table">
+        <tr>
+            <th colspan="1">Parameter</th>
+            <th>Choices/<font color="blue">Defaults</font></th>
+            <th width="100%">Comments</th>
+        </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="parameter-"></div>
+                    <b>binary_path</b>
+                    <a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
+                    <div style="font-size: small">
+                        <span style="color: purple">path</span>
+                    </div>
+                </td>
+                <td>
+                </td>
+                <td>
+                        <div>The path of a helm binary to use.</div>
+                </td>
+            </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="parameter-"></div>
+                    <b>ca_file</b>
+                    <a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
+                    <div style="font-size: small">
+                        <span style="color: purple">path</span>
+                    </div>
+                </td>
+                <td>
+                </td>
+                <td>
+                        <div>Path to the CA certificate SSL file for verify registry server certificate.</div>
+                </td>
+            </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="parameter-"></div>
+                    <b>cert_file</b>
+                    <a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
+                    <div style="font-size: small">
+                        <span style="color: purple">path</span>
+                    </div>
+                </td>
+                <td>
+                </td>
+                <td>
+                        <div>Path to the client certificate SSL file for identify registry client using this certificate file.</div>
+                </td>
+            </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="parameter-"></div>
+                    <b>host</b>
+                    <a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
+                    <div style="font-size: small">
+                        <span style="color: purple">string</span>
+                         / <span style="color: red">required</span>
+                    </div>
+                </td>
+                <td>
+                </td>
+                <td>
+                        <div>Provide a URL for accessing the registry.</div>
+                        <div style="font-size: small; color: darkgreen"><br/>aliases: registry_url</div>
+                </td>
+            </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="parameter-"></div>
+                    <b>insecure</b>
+                    <a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
+                    <div style="font-size: small">
+                        <span style="color: purple">boolean</span>
+                    </div>
+                </td>
+                <td>
+                        <ul style="margin: 0; padding: 0"><b>Choices:</b>
+                                    <li><div style="color: blue"><b>no</b>&nbsp;&larr;</div></li>
+                                    <li>yes</li>
+                        </ul>
+                </td>
+                <td>
+                        <div>Allow connections to SSL sites without certs.</div>
+                </td>
+            </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="parameter-"></div>
+                    <b>key_file</b>
+                    <a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
+                    <div style="font-size: small">
+                        <span style="color: purple">path</span>
+                    </div>
+                </td>
+                <td>
+                </td>
+                <td>
+                        <div>Path to the client key SSL file for identify registry client using this key file.</div>
+                </td>
+            </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="parameter-"></div>
+                    <b>password</b>
+                    <a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
+                    <div style="font-size: small">
+                        <span style="color: purple">string</span>
+                    </div>
+                </td>
+                <td>
+                </td>
+                <td>
+                        <div>Password for the registry.</div>
+                        <div style="font-size: small; color: darkgreen"><br/>aliases: repo_password</div>
+                </td>
+            </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="parameter-"></div>
+                    <b>state</b>
+                    <a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
+                    <div style="font-size: small">
+                        <span style="color: purple">string</span>
+                    </div>
+                </td>
+                <td>
+                        <ul style="margin: 0; padding: 0"><b>Choices:</b>
+                                    <li><div style="color: blue"><b>present</b>&nbsp;&larr;</div></li>
+                                    <li>absent</li>
+                        </ul>
+                </td>
+                <td>
+                        <div>Desired state of the registry.</div>
+                        <div>If set to V(present) attempt to log in to the remote registry server using the URL specified in O(host).</div>
+                        <div>If set to V(absent) attempt to log out from the remote registry server using the URL specified in O(host).</div>
+                        <div>As helm &gt;= 3.18.0 reports successful logout even if the user is not logged in, this module will report a change regardless of the current state.</div>
+                </td>
+            </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="parameter-"></div>
+                    <b>username</b>
+                    <a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
+                    <div style="font-size: small">
+                        <span style="color: purple">string</span>
+                    </div>
+                </td>
+                <td>
+                </td>
+                <td>
+                        <div>Username for the registry.</div>
+                        <div style="font-size: small; color: darkgreen"><br/>aliases: repo_username</div>
+                </td>
+            </tr>
+    </table>
+    <br/>
+
+
+
+
+Examples
+--------
+
+.. code-block:: yaml
+
+    - name: Login to remote registry
+      kubernetes.core.helm_registry_auth:
+        username: admin
+        password: "sample_password"
+        host: localhost:5000
+
+    - name: Logout from remote registry
+      kubernetes.core.helm_registry_auth:
+        state: absent
+        host: localhost:5000
+
+
+
+Return Values
+-------------
+Common return values are documented `here <https://docs.ansible.com/projects/ansible/latest/reference_appendices/common_return_values.html#common-return-values>`_, the following are the fields unique to this module:
+
+.. raw:: html
+
+    <table border=0 cellpadding=0 class="documentation-table">
+        <tr>
+            <th colspan="1">Key</th>
+            <th>Returned</th>
+            <th width="100%">Description</th>
+        </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="return-"></div>
+                    <b>command</b>
+                    <a class="ansibleOptionLink" href="#return-" title="Permalink to this return value"></a>
+                    <div style="font-size: small">
+                      <span style="color: purple">string</span>
+                    </div>
+                </td>
+                <td>always</td>
+                <td>
+                            <div>Full <code>helm</code> command executed</div>
+                    <br/>
+                        <div style="font-size: smaller"><b>Sample:</b></div>
+                        <div style="font-size: smaller; color: blue; word-wrap: break-word; word-break: break-all;">/usr/local/bin/helm registry login oci-registry.domain.example --username=admin --password-stdin --insecure</div>
+                </td>
+            </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="return-"></div>
+                    <b>failed</b>
+                    <a class="ansibleOptionLink" href="#return-" title="Permalink to this return value"></a>
+                    <div style="font-size: small">
+                      <span style="color: purple">boolean</span>
+                    </div>
+                </td>
+                <td>always</td>
+                <td>
+                            <div>Indicate if the <code>helm</code> command failed</div>
+                    <br/>
+                </td>
+            </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="return-"></div>
+                    <b>stderr</b>
+                    <a class="ansibleOptionLink" href="#return-" title="Permalink to this return value"></a>
+                    <div style="font-size: small">
+                      <span style="color: purple">string</span>
+                    </div>
+                </td>
+                <td>always</td>
+                <td>
+                            <div>Full <code>helm</code> command stderr, in case you want to display it or examine the event log. Please be note that helm binnary may print messages to stderr even if the command is successful.</div>
+                    <br/>
+                        <div style="font-size: smaller"><b>Sample:</b></div>
+                        <div style="font-size: smaller; color: blue; word-wrap: break-word; word-break: break-all;">Login Succeeded\n</div>
+                </td>
+            </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="return-"></div>
+                    <b>stderr_lines</b>
+                    <a class="ansibleOptionLink" href="#return-" title="Permalink to this return value"></a>
+                    <div style="font-size: small">
+                      <span style="color: purple">list</span>
+                    </div>
+                </td>
+                <td>always</td>
+                <td>
+                            <div>Full <code>helm</code> command stderr, in case you want to display it or examine the event log</div>
+                    <br/>
+                </td>
+            </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="return-"></div>
+                    <b>stdout</b>
+                    <a class="ansibleOptionLink" href="#return-" title="Permalink to this return value"></a>
+                    <div style="font-size: small">
+                      <span style="color: purple">string</span>
+                    </div>
+                </td>
+                <td>always</td>
+                <td>
+                            <div>Full <code>helm</code> command stdout, in case you want to display it or examine the event log</div>
+                    <br/>
+                </td>
+            </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="return-"></div>
+                    <b>stout_lines</b>
+                    <a class="ansibleOptionLink" href="#return-" title="Permalink to this return value"></a>
+                    <div style="font-size: small">
+                      <span style="color: purple">list</span>
+                    </div>
+                </td>
+                <td>always</td>
+                <td>
+                            <div>Full <code>helm</code> command stdout, in case you want to display it or examine the event log</div>
+                    <br/>
+                </td>
+            </tr>
+    </table>
+    <br/><br/>
+
+
+Status
+------
+
+
+Authors
+~~~~~~~
+
+- Yuriy Novostavskiy (@yurnov)

docs/kubernetes.core.helm_repository_module.rst

@@ -143,6 +143,27 @@ Parameters
                         <div>Provide a URL for accessing the API. Can also be specified via <code>K8S_AUTH_HOST</code> environment variable.</div>
                 </td>
             </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="parameter-"></div>
+                    <b>insecure_skip_tls_verify</b>
+                    <a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
+                    <div style="font-size: small">
+                        <span style="color: purple">boolean</span>
+                    </div>
+                    <div style="font-style: italic; font-size: small; color: darkgreen">added in 5.3.0</div>
+                </td>
+                <td>
+                        <ul style="margin: 0; padding: 0"><b>Choices:</b>
+                                    <li><div style="color: blue"><b>no</b>&nbsp;&larr;</div></li>
+                                    <li>yes</li>
+                        </ul>
+                </td>
+                <td>
+                        <div>Skip tls certificate checks for the repository url.</div>
+                        <div style="font-size: small; color: darkgreen"><br/>aliases: skip_tls_certs_check</div>
+                </td>
+            </tr>
             <tr>
                 <td colspan="1">
                     <div class="ansibleOptionAnchor" id="parameter-"></div>

docs/kubernetes.core.helm_template_module.rst

@@ -158,6 +158,26 @@ Parameters
                         <div>Include custom resource descriptions in rendered templates.</div>
                 </td>
             </tr>
+            <tr>
+                <td colspan="2">
+                    <div class="ansibleOptionAnchor" id="parameter-"></div>
+                    <b>insecure_registry</b>
+                    <a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
+                    <div style="font-size: small">
+                        <span style="color: purple">boolean</span>
+                    </div>
+                    <div style="font-style: italic; font-size: small; color: darkgreen">added in 5.1.0</div>
+                </td>
+                <td>
+                        <ul style="margin: 0; padding: 0"><b>Choices:</b>
+                                    <li><div style="color: blue"><b>no</b>&nbsp;&larr;</div></li>
+                                    <li>yes</li>
+                        </ul>
+                </td>
+                <td>
+                        <div>Skip TLS certificate checks for the chart download</div>
+                </td>
+            </tr>
             <tr>
                 <td colspan="2">
                     <div class="ansibleOptionAnchor" id="parameter-"></div>

docs/kubernetes.core.k8s_cp_module.rst

@@ -512,6 +512,7 @@ Notes
 
 .. note::
    - the tar binary is required on the container when copying from local filesystem to pod.
+   - the (init) container has to be started before you copy files or directories to it.
    - To avoid SSL certificate validation errors when ``validate_certs`` is *True*, the full certificate chain for the API server must be provided via ``ca_cert`` or in the kubeconfig file.
 
 

docs/kubernetes.core.k8s_drain_module.rst

@@ -423,7 +423,7 @@ Parameters
                         <span style="color: purple">list</span>
                          / <span style="color: purple">elements=string</span>
                     </div>
-                    <div style="font-style: italic; font-size: small; color: darkgreen">added in 2.5.0</div>
+                    <div style="font-style: italic; font-size: small; color: darkgreen">added in 3.0.0</div>
                 </td>
                 <td>
                 </td>
@@ -595,7 +595,8 @@ Examples
       kubernetes.core.k8s_drain:
         state: drain
         name: foo
-        force: yes
+        delete_options:
+          force: yes
 
     - name: Drain node "foo", but abort if there are pods not managed by a ReplicationController, Job, or DaemonSet, and use a grace period of 15 minutes.
       kubernetes.core.k8s_drain:

docs/kubernetes.core.k8s_info_module.rst

@@ -168,14 +168,13 @@ Parameters
                         <span style="color: purple">list</span>
                          / <span style="color: purple">elements=string</span>
                     </div>
-                    <div style="font-style: italic; font-size: small; color: darkgreen">added in 2.5.0</div>
+                    <div style="font-style: italic; font-size: small; color: darkgreen">added in 3.0.0</div>
                 </td>
                 <td>
                 </td>
                 <td>
                         <div>Hide fields matching any of the field definitions in the result</div>
-                        <div>An example might be <code>hidden_fields=[metadata.managedFields]</code></div>
-                        <div>Only field definitions that don&#x27;t reference list items are supported (so V(spec.containers[0]) would not work)</div>
+                        <div>An example might be <code>hidden_fields=[metadata.managedFields]</code> or V(hidden_fields=[spec.containers[0].env[3].value]) or V(hidden_fields=[metadata.annotations[kubectl.kubernetes.io/last-applied-configuration]])</div>
                 </td>
             </tr>
             <tr>

docs/kubernetes.core.k8s_inventory.rst

@@ -17,7 +17,7 @@ DEPRECATED
 ----------
 :Removed in collection release after 
 :Why: As discussed in https://github.com/ansible-collections/kubernetes.core/issues/31, we decided to
-remove the k8s inventory plugin in release 4.0.0.
+remove the k8s inventory plugin in release 6.0.0.
 
 :Alternative: Use :ref:`kubernetes.core.k8s_info <kubernetes.core.k8s_info_module>` and :ref:`ansible.builtin.add_host <ansible.builtin.add_host_module>` instead.
 
@@ -357,7 +357,7 @@ Status
 ------
 
 
-- This inventory will be removed in version 4.0.0. *[deprecated]*
+- This inventory will be removed in version 6.0.0. *[deprecated]*
 - For more information see `DEPRECATED`_.
 
 

docs/kubernetes.core.k8s_module.rst

@@ -121,7 +121,7 @@ Parameters
                 <td>
                         <div><code>apply</code> compares the desired resource definition with the previously supplied resource definition, ignoring properties that are automatically generated</div>
                         <div><code>apply</code> works better with Services than &#x27;force=yes&#x27;</div>
-                        <div>mutually exclusive with <code>merge_type</code></div>
+                        <div>Mutually exclusive with <code>merge_type</code>.</div>
                 </td>
             </tr>
             <tr>
@@ -216,7 +216,7 @@ Parameters
                     <div style="font-size: small">
                         <span style="color: purple">boolean</span>
                     </div>
-                    <div style="font-style: italic; font-size: small; color: darkgreen">added in 2.5.0</div>
+                    <div style="font-style: italic; font-size: small; color: darkgreen">added in 3.0.0</div>
                 </td>
                 <td>
                         <ul style="margin: 0; padding: 0"><b>Choices:</b>
@@ -389,14 +389,13 @@ Parameters
                         <span style="color: purple">list</span>
                          / <span style="color: purple">elements=string</span>
                     </div>
-                    <div style="font-style: italic; font-size: small; color: darkgreen">added in 2.5.0</div>
+                    <div style="font-style: italic; font-size: small; color: darkgreen">added in 3.0.0</div>
                 </td>
                 <td>
                 </td>
                 <td>
                         <div>Hide fields matching this option in the result</div>
-                        <div>An example might be <code>hidden_fields=[metadata.managedFields]</code></div>
-                        <div>Only field definitions that don&#x27;t reference list items are supported (so V(spec.containers[0]) would not work)</div>
+                        <div>An example might be <code>hidden_fields=[metadata.managedFields]</code> or V(hidden_fields=[spec.containers[0].env[3].value]) or V(hidden_fields=[metadata.annotations[kubectl.kubernetes.io/last-applied-configuration]])</div>
                 </td>
             </tr>
             <tr>
@@ -513,18 +512,17 @@ Parameters
                 </td>
                 <td>
                         <ul style="margin: 0; padding: 0"><b>Choices:</b>
-                                    <li>json</li>
                                     <li>merge</li>
                                     <li>strategic-merge</li>
                         </ul>
                 </td>
                 <td>
                         <div>Whether to override the default patch merge approach with a specific type. By default, the strategic merge will typically be used.</div>
-                        <div>For example, Custom Resource Definitions typically aren&#x27;t updatable by the usual strategic merge. You may want to use <code>merge</code> if you see &quot;strategic merge patch format is not supported&quot;</div>
+                        <div>For example, Custom Resource Definitions typically aren&#x27;t updatable by the usual strategic merge. You may want to use <code>merge</code> if you see &quot;strategic merge patch format is not supported&quot;.</div>
                         <div>See <a href='https://kubernetes.io/docs/tasks/run-application/update-api-object-kubectl-patch/#use-a-json-merge-patch-to-update-a-deployment'>https://kubernetes.io/docs/tasks/run-application/update-api-object-kubectl-patch/#use-a-json-merge-patch-to-update-a-deployment</a></div>
                         <div>If more than one <code>merge_type</code> is given, the merge_types will be tried in order. This defaults to <code>[&#x27;strategic-merge&#x27;, &#x27;merge&#x27;]</code>, which is ideal for using the same parameters on resource kinds that combine Custom Resources and built-in resources.</div>
-                        <div>mutually exclusive with <code>apply</code></div>
-                        <div><em>merge_type=json</em> is deprecated and will be removed in version 3.0.0. Please use <span class='module'>kubernetes.core.k8s_json_patch</span> instead.</div>
+                        <div>Mutually exclusive with <code>apply</code>.</div>
+                        <div><em>merge_type=json</em> has been removed in version 4.0.0. Please use <span class='module'>kubernetes.core.k8s_json_patch</span> instead.</div>
                 </td>
             </tr>
             <tr>

docs/kubernetes.core.kubectl_connection.rst

@@ -211,6 +211,27 @@ Parameters
                         <div>The configuration can be provided as dictionary. Added in version 2.4.0.</div>
                 </td>
             </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="parameter-"></div>
+                    <b>kubectl_local_env_vars</b>
+                    <a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
+                    <div style="font-size: small">
+                        <span style="color: purple">dictionary</span>
+                    </div>
+                    <div style="font-style: italic; font-size: small; color: darkgreen">added in 3.1.0</div>
+                </td>
+                <td>
+                        <b>Default:</b><br/><div style="color: blue">{}</div>
+                </td>
+                    <td>
+                                <div>var: ansible_kubectl_local_env_vars</div>
+                    </td>
+                <td>
+                        <div>Local enviromantal variable to be passed locally to the kubectl command line.</div>
+                        <div>Please be aware that this passes information directly on the command line and it could expose sensitive data.</div>
+                </td>
+            </tr>
             <tr>
                 <td colspan="1">
                     <div class="ansibleOptionAnchor" id="parameter-"></div>
@@ -344,6 +365,82 @@ Parameters
 
 
 
+Examples
+--------
+
+.. code-block:: yaml
+
+    - name: Run a command in a pod using local kubectl with kubeconfig file ~/.kube/config
+      hosts: localhost
+      gather_facts: no
+      vars:
+        ansible_connection: kubernetes.core.kubectl
+        ansible_kubectl_namespace: my-namespace
+        ansible_kubectl_pod: my-pod
+        ansible_kubectl_container: my-container
+      tasks:
+        # be aware that the command is executed as the user that started the container
+        # and requires python to be installed in the image
+        - name: Run a command in a pod
+          ansible.builtin.command: echo "Hello, World!"
+
+    - name: Run a command in a pod using local kubectl with inventory variables
+      # Example inventory:
+      # k8s:
+      #   hosts:
+      #     foo.example.com:
+      #       ansible_connection: kubernetes.core.kubectl
+      #       ansible_kubectl_kubeconfig: /root/.kube/foo.example.com.config
+      #       ansible_kubectl_pod: my-foo-pod
+      #       ansible_kubectl_container: my-foo-container
+      #       ansible_kubectl_namespace: my-foo-namespace
+      #     bar.example.com:
+      #       ansible_connection: kubernetes.core.kubectl
+      #       ansible_kubectl_kubeconfig: /root/.kube/bar.example.com.config
+      #       ansible_kubectl_pod: my-bar-pod
+      #       ansible_kubectl_container: my-bar-container
+      #       ansible_kubectl_namespace: my-bar-namespace
+      hosts: k8s
+      gather_facts: no
+      tasks:
+        # be aware that the command is executed as the user that started the container
+        # and requires python to be installed in the image
+        - name: Run a command in a pod
+          ansible.builtin.command: echo "Hello, World!"
+
+    - name: Run a command in a pod using dynamic inventory
+      hosts: localhost
+      gather_facts: no
+      vars:
+        kubeconfig: /root/.kube/config
+        namespace: my-namespace
+        my_app: my-app
+      tasks:
+        - name: Get My App pod info based on label
+          kubernetes.core.k8s_info:
+            kubeconfig: "{{ kubeconfig }}"
+            namespace: "{{ namespace }}"
+            kind: Pod
+            label_selectors: app.kubernetes.io/name = "{{ my_app }}"
+          register: my_app_pod
+
+        - name: Get My App pod name
+          ansible.builtin.set_fact:
+            my_app_pod_name: "{{ my_app_pod.resources[0].metadata.name }}"
+
+        - name: Add My App pod to inventory
+          ansible.builtin.add_host:
+            name: "{{ my_app_pod_name }}"
+            ansible_connection: kubernetes.core.kubectl
+            ansible_kubectl_kubeconfig: "{{ kubeconfig }}"
+            ansible_kubectl_pod: "{{ my_app_pod_name }}"
+            ansible_kubectl_namespace: "{{ namespace }}"
+
+        - name: Run a command in My App pod
+          # be aware that the command is executed as the user that started the container
+          # and requires python to be installed in the image
+          ansible.builtin.command: echo "Hello, World!"
+          delegate_to: "{{ my_app_pod_name }}"
 
 
 

docs/kubernetes.core.kustomize_lookup.rst

@@ -77,6 +77,24 @@ Parameters
                         <div>If omitted, &#x27;.&#x27; is assumed.</div>
                 </td>
             </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="parameter-"></div>
+                    <b>enable_helm</b>
+                    <a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
+                    <div style="font-size: small">
+                        <span style="color: purple">-</span>
+                    </div>
+                </td>
+                <td>
+                        <b>Default:</b><br/><div style="color: blue">"False"</div>
+                </td>
+                    <td>
+                    </td>
+                <td>
+                        <div>Enable the helm chart inflation generator</div>
+                </td>
+            </tr>
             <tr>
                 <td colspan="1">
                     <div class="ansibleOptionAnchor" id="parameter-"></div>
@@ -112,17 +130,21 @@ Examples
 .. code-block:: yaml
 
     - name: Run lookup using kustomize
-      set_fact:
+      ansible.builtin.set_fact:
         resources: "{{ lookup('kubernetes.core.kustomize', binary_path='/path/to/kustomize') }}"
 
     - name: Run lookup using kubectl kustomize
-      set_fact:
+      ansible.builtin.set_fact:
         resources: "{{ lookup('kubernetes.core.kustomize', binary_path='/path/to/kubectl') }}"
 
     - name: Create kubernetes resources for lookup output
-      k8s:
+      kubernetes.core.k8s:
         definition: "{{ lookup('kubernetes.core.kustomize', dir='/path/to/kustomization') }}"
 
+    - name: Create kubernetes resources for lookup output with `--enable-helm` set
+      kubernetes.core.k8s:
+        definition: "{{ lookup('kubernetes.core.kustomize', dir='/path/to/kustomization', enable_helm=True) }}"
+
 
 
 Return Values

galaxy.yml

@@ -25,7 +25,7 @@ tags:
   - openshift
   - okd
   - cluster
-version: 3.0.0
+version: 5.4.2
 build_ignore:
   - .DS_Store
   - "*.tar.gz"

meta/runtime.yml

@@ -1,5 +1,5 @@
 ---
-requires_ansible: '>=2.14.0'
+requires_ansible: '>=2.15.0'
 
 action_groups:
   helm:
@@ -8,13 +8,16 @@ action_groups:
     - helm_repository
   k8s:
     - k8s
-    - k8s_exec
-    - k8s_info
-    - k8s_log
-    - k8s_scale
-    - k8s_service
+    - k8s_cluster_info
     - k8s_cp
     - k8s_drain
+    - k8s_exec
+    - k8s_info
+    - k8s_json_patch
+    - k8s_log
+    - k8s_rollback
+    - k8s_scale
+    - k8s_service
 
 plugin_routing:
   inventory:
@@ -22,10 +25,10 @@ plugin_routing:
       redirect: community.okd.openshift
     k8s:
       deprecation:
-        removal_version: 4.0.0
+        removal_version: 6.0.0
         warning_text: >-
           The k8s inventory plugin has been deprecated and
-          will be removed in release 4.0.0.
+          will be removed in release 6.0.0.
   modules:
     k8s_auth:
       redirect: community.okd.k8s_auth

plugins/action/k8s_info.py

@@ -22,33 +22,20 @@ from ansible.errors import (
 )
 from ansible.module_utils._text import to_bytes, to_native, to_text
 from ansible.module_utils.parsing.convert_bool import boolean
-from ansible.module_utils.six import iteritems, string_types
 from ansible.plugins.action import ActionBase
 
+try:
+    from ansible.template import trust_as_template
+except ImportError:
+    trust_as_template = None
 
-class RemoveOmit(object):
-    def __init__(self, buffer, omit_value):
-        try:
-            import yaml
-        except ImportError:
-            raise AnsibleError("Failed to import the required Python library (PyYAML).")
-        self.data = yaml.safe_load_all(buffer)
-        self.omit = omit_value
 
-    def remove_omit(self, data):
-        if isinstance(data, dict):
-            result = dict()
-            for key, value in iteritems(data):
-                if value == self.omit:
-                    continue
-                result[key] = self.remove_omit(value)
-            return result
-        if isinstance(data, list):
-            return [self.remove_omit(v) for v in data if v != self.omit]
-        return data
-
-    def output(self):
-        return [self.remove_omit(d) for d in self.data]
+def _from_yaml_to_definition(buffer):
+    try:
+        import yaml
+    except ImportError:
+        raise AnsibleError("Failed to import the required Python library (PyYAML).")
+    return list(yaml.safe_load_all(buffer))
 
 
 ENV_KUBECONFIG_PATH_SEPARATOR = ";" if platform.system() == "Windows" else ":"
@@ -112,7 +99,7 @@ class ActionModule(ActionBase):
             "trim_blocks": True,
             "lstrip_blocks": False,
         }
-        if isinstance(template, string_types):
+        if isinstance(template, str):
             # treat this as raw_params
             template_param["path"] = template
         elif isinstance(template, dict):
@@ -132,7 +119,7 @@ class ActionModule(ActionBase):
             ):
                 if s_type in template_args:
                     value = ensure_type(template_args[s_type], "string")
-                    if value is not None and not isinstance(value, string_types):
+                    if value is not None and not isinstance(value, str):
                         raise AnsibleActionFail(
                             "%s is expected to be a string, but got %s instead"
                             % (s_type, type(value))
@@ -207,9 +194,8 @@ class ActionModule(ActionBase):
                 "'template' is only a supported parameter for the 'k8s' module."
             )
 
-        omit_value = task_vars.get("omit")
         template_params = []
-        if isinstance(template, string_types) or isinstance(template, dict):
+        if isinstance(template, str) or isinstance(template, dict):
             template_params.append(self.get_template_args(template))
         elif isinstance(template, list):
             for element in template:
@@ -230,17 +216,18 @@ class ActionModule(ActionBase):
         old_vars = self._templar.available_variables
 
         default_environment = {}
-        for key in (
-            "newline_sequence",
-            "variable_start_string",
-            "variable_end_string",
-            "block_start_string",
-            "block_end_string",
-            "trim_blocks",
-            "lstrip_blocks",
-        ):
-            if hasattr(self._templar.environment, key):
-                default_environment[key] = getattr(self._templar.environment, key)
+        if trust_as_template is None:
+            for key in (
+                "newline_sequence",
+                "variable_start_string",
+                "variable_end_string",
+                "block_start_string",
+                "block_end_string",
+                "trim_blocks",
+                "lstrip_blocks",
+            ):
+                if hasattr(self._templar.environment, key):
+                    default_environment[key] = getattr(self._templar.environment, key)
         for template_item in template_params:
             # We need to convert unescaped sequences to proper escaped sequences for Jinja2
             newline_sequence = template_item["newline_sequence"]
@@ -257,26 +244,35 @@ class ActionModule(ActionBase):
             with self.get_template_data(template_item["path"]) as template_data:
                 # add ansible 'template' vars
                 temp_vars = copy.deepcopy(task_vars)
-                for key, value in iteritems(template_item):
+                overrides = {}
+                for key, value in template_item.items():
                     if hasattr(self._templar.environment, key):
                         if value is not None:
-                            setattr(self._templar.environment, key, value)
-                        else:
+                            overrides[key] = value
+                            if trust_as_template is None:
+                                setattr(self._templar.environment, key, value)
+                        elif trust_as_template is None:
                             setattr(
                                 self._templar.environment,
                                 key,
                                 default_environment.get(key),
                             )
                 self._templar.available_variables = temp_vars
-                result = self._templar.do_template(
-                    template_data,
-                    preserve_trailing_newlines=True,
-                    escape_backslashes=False,
-                )
-                if omit_value is not None:
-                    result_template.extend(RemoveOmit(result, omit_value).output())
+                if trust_as_template:
+                    template_data = trust_as_template(template_data)
+                    result = self._templar.template(
+                        template_data,
+                        preserve_trailing_newlines=True,
+                        escape_backslashes=False,
+                        overrides=overrides,
+                    )
                 else:
-                    result_template.append(result)
+                    result = self._templar.do_template(
+                        template_data,
+                        preserve_trailing_newlines=True,
+                        escape_backslashes=False,
+                    )
+                result_template.extend(_from_yaml_to_definition(result))
         self._templar.available_variables = old_vars
         resource_definition = self._task.args.get("definition", None)
         if not resource_definition:
@@ -306,7 +302,7 @@ class ActionModule(ActionBase):
             )
 
     def get_kubeconfig(self, kubeconfig, remote_transport, new_module_args):
-        if isinstance(kubeconfig, string_types):
+        if isinstance(kubeconfig, str):
             # find the kubeconfig in the expected search path
             if not remote_transport:
                 # kubeconfig is local

plugins/connection/kubectl.py

@@ -72,6 +72,15 @@ DOCUMENTATION = r"""
           - name: ansible_kubectl_extra_args
         env:
           - name: K8S_AUTH_EXTRA_ARGS
+      kubectl_local_env_vars:
+        description:
+          - Local enviromantal variable to be passed locally to the kubectl command line.
+          - Please be aware that this passes information directly on the command line and it could expose sensitive data.
+        default: {}
+        type: dict
+        version_added: 3.1.0
+        vars:
+          - name: ansible_kubectl_local_env_vars
       kubectl_kubeconfig:
         description:
           - Path to a kubectl config file. Defaults to I(~/.kube/config)
@@ -172,6 +181,81 @@ DOCUMENTATION = r"""
         aliases: [ kubectl_verify_ssl ]
 """
 
+EXAMPLES = r"""
+
+- name: Run a command in a pod using local kubectl with kubeconfig file ~/.kube/config
+  hosts: localhost
+  gather_facts: no
+  vars:
+    ansible_connection: kubernetes.core.kubectl
+    ansible_kubectl_namespace: my-namespace
+    ansible_kubectl_pod: my-pod
+    ansible_kubectl_container: my-container
+  tasks:
+    # be aware that the command is executed as the user that started the container
+    # and requires python to be installed in the image
+    - name: Run a command in a pod
+      ansible.builtin.command: echo "Hello, World!"
+
+- name: Run a command in a pod using local kubectl with inventory variables
+  # Example inventory:
+  # k8s:
+  #   hosts:
+  #     foo.example.com:
+  #       ansible_connection: kubernetes.core.kubectl
+  #       ansible_kubectl_kubeconfig: /root/.kube/foo.example.com.config
+  #       ansible_kubectl_pod: my-foo-pod
+  #       ansible_kubectl_container: my-foo-container
+  #       ansible_kubectl_namespace: my-foo-namespace
+  #     bar.example.com:
+  #       ansible_connection: kubernetes.core.kubectl
+  #       ansible_kubectl_kubeconfig: /root/.kube/bar.example.com.config
+  #       ansible_kubectl_pod: my-bar-pod
+  #       ansible_kubectl_container: my-bar-container
+  #       ansible_kubectl_namespace: my-bar-namespace
+  hosts: k8s
+  gather_facts: no
+  tasks:
+    # be aware that the command is executed as the user that started the container
+    # and requires python to be installed in the image
+    - name: Run a command in a pod
+      ansible.builtin.command: echo "Hello, World!"
+
+- name: Run a command in a pod using dynamic inventory
+  hosts: localhost
+  gather_facts: no
+  vars:
+    kubeconfig: /root/.kube/config
+    namespace: my-namespace
+    my_app: my-app
+  tasks:
+    - name: Get My App pod info based on label
+      kubernetes.core.k8s_info:
+        kubeconfig: "{{ kubeconfig }}"
+        namespace: "{{ namespace }}"
+        kind: Pod
+        label_selectors: app.kubernetes.io/name = "{{ my_app }}"
+      register: my_app_pod
+
+    - name: Get My App pod name
+      ansible.builtin.set_fact:
+        my_app_pod_name: "{{ my_app_pod.resources[0].metadata.name }}"
+
+    - name: Add My App pod to inventory
+      ansible.builtin.add_host:
+        name: "{{ my_app_pod_name }}"
+        ansible_connection: kubernetes.core.kubectl
+        ansible_kubectl_kubeconfig: "{{ kubeconfig }}"
+        ansible_kubectl_pod: "{{ my_app_pod_name }}"
+        ansible_kubectl_namespace: "{{ namespace }}"
+
+    - name: Run a command in My App pod
+      # be aware that the command is executed as the user that started the container
+      # and requires python to be installed in the image
+      ansible.builtin.command: echo "Hello, World!"
+      delegate_to: "{{ my_app_pod_name }}"
+"""
+
 import json
 import os
 import os.path
@@ -181,6 +265,7 @@ import tempfile
 
 from ansible.errors import AnsibleError, AnsibleFileNotFound
 from ansible.module_utils._text import to_bytes
+from ansible.module_utils.parsing.convert_bool import boolean
 from ansible.module_utils.six.moves import shlex_quote
 from ansible.parsing.yaml.loader import AnsibleLoader
 from ansible.plugins.connection import BUFSIZE, ConnectionBase
@@ -240,9 +325,12 @@ class Connection(ConnectionBase):
         # Build command options based on doc string
         doc_yaml = AnsibleLoader(self.documentation).get_single_data()
         for key in doc_yaml.get("options"):
-            if key.endswith("verify_ssl") and self.get_option(key) != "":
-                # Translate verify_ssl to skip_verify_ssl, and output as string
-                skip_verify_ssl = not self.get_option(key)
+            if key == "validate_certs" and self.get_option(key) != "":
+                # Translate validate_certs to --insecure-skip-tls-verify flag
+                # validate_certs=True means verify certs (don't skip verification)
+                # validate_certs=False means don't verify certs (skip verification)
+                validate_certs_value = boolean(self.get_option(key), strict=False)
+                skip_verify_ssl = not validate_certs_value
                 local_cmd.append(
                     "{0}={1}".format(
                         self.connection_options[key], str(skip_verify_ssl).lower()
@@ -301,6 +389,19 @@ class Connection(ConnectionBase):
 
         return local_cmd, censored_local_cmd
 
+    def _local_env(self):
+        """Return a dict of local environment variables to pass to the kubectl command"""
+        local_env = {}
+        local_local_env_vars_name = "{0}_local_env_vars".format(self.transport)
+        local_env_vars = self.get_option(local_local_env_vars_name)
+        if local_env_vars:
+            if isinstance(local_env_vars, dict):
+                local_env_vars = json.dumps(local_env_vars)
+            local_env = os.environ.copy()
+            local_env.update(json.loads(local_env_vars))
+            return local_env
+        return None
+
     def _connect(self, port=None):
         """Connect to the container. Nothing to do"""
         super(Connection, self)._connect()
@@ -329,6 +430,7 @@ class Connection(ConnectionBase):
             stdin=subprocess.PIPE,
             stdout=subprocess.PIPE,
             stderr=subprocess.PIPE,
+            env=self._local_env(),
         )
 
         stdout, stderr = p.communicate(in_data)
@@ -378,7 +480,11 @@ class Connection(ConnectionBase):
             args = [to_bytes(i, errors="surrogate_or_strict") for i in args]
             try:
                 p = subprocess.Popen(
-                    args, stdin=in_file, stdout=subprocess.PIPE, stderr=subprocess.PIPE
+                    args,
+                    stdin=in_file,
+                    stdout=subprocess.PIPE,
+                    stderr=subprocess.PIPE,
+                    env=self._local_env(),
                 )
             except OSError:
                 raise AnsibleError(
@@ -415,7 +521,11 @@ class Connection(ConnectionBase):
         ) as out_file:
             try:
                 p = subprocess.Popen(
-                    args, stdin=subprocess.PIPE, stdout=out_file, stderr=subprocess.PIPE
+                    args,
+                    stdin=subprocess.PIPE,
+                    stdout=out_file,
+                    stderr=subprocess.PIPE,
+                    env=self._local_env(),
                 )
             except OSError:
                 raise AnsibleError(

plugins/doc_fragments/helm_common_options.py

@@ -36,12 +36,12 @@ options:
     description:
     - Provide a URL for accessing the API. Can also be specified via C(K8S_AUTH_HOST) environment variable.
     type: str
-    version_added: "1.2.0"
+    version_added: 1.2.0
   api_key:
     description:
     - Token used to authenticate with the API. Can also be specified via C(K8S_AUTH_API_KEY) environment variable.
     type: str
-    version_added: "1.2.0"
+    version_added: 1.2.0
   validate_certs:
     description:
     - Whether or not to verify the API server's SSL certificates. Can also be specified via C(K8S_AUTH_VERIFY_SSL)
@@ -49,12 +49,12 @@ options:
     type: bool
     aliases: [ verify_ssl ]
     default: True
-    version_added: "1.2.0"
+    version_added: 1.2.0
   ca_cert:
     description:
     - Path to a CA certificate used to authenticate with the API. The full certificate chain must be provided to
       avoid certificate validation errors. Can also be specified via C(K8S_AUTH_SSL_CA_CERT) environment variable.
     type: path
     aliases: [ ssl_ca_cert ]
-    version_added: "1.2.0"
+    version_added: 1.2.0
 """

plugins/doc_fragments/k8s_delete_options.py

@@ -15,7 +15,7 @@ class ModuleDocFragment(object):
 options:
   delete_options:
     type: dict
-    version_added: '1.2.0'
+    version_added: 1.2.0
     description:
     - Configure behavior when deleting an object.
     - Only used when I(state=absent).

plugins/inventory/k8s.py

@@ -20,10 +20,10 @@ DOCUMENTATION = """
       - Uses k8s.(yml|yaml) YAML configuration file to set parameter values.
 
     deprecated:
-      removed_in: 4.0.0
+      removed_in: 6.0.0
       why: |
         As discussed in U(https://github.com/ansible-collections/kubernetes.core/issues/31), we decided to
-        remove the k8s inventory plugin in release 4.0.0.
+        remove the k8s inventory plugin in release 6.0.0.
       alternative: "Use M(kubernetes.core.k8s_info) and M(ansible.builtin.add_host) instead."
 
     options:
@@ -125,18 +125,18 @@ import json
 
 from ansible.errors import AnsibleError
 from ansible.plugins.inventory import BaseInventoryPlugin, Cacheable, Constructable
-from ansible_collections.kubernetes.core.plugins.module_utils.common import (
-    HAS_K8S_MODULE_HELPER,
-    k8s_import_exception,
-)
-from ansible_collections.kubernetes.core.plugins.module_utils.k8s.client import (
-    get_api_client,
-)
 
 try:
     from kubernetes.dynamic.exceptions import DynamicApiError
-except ImportError:
-    pass
+
+    HAS_K8S_MODULE_HELPER = True
+    k8s_import_exception = None
+except ImportError as e:
+    HAS_K8S_MODULE_HELPER = False
+    k8s_import_exception = e
+from ansible_collections.kubernetes.core.plugins.module_utils.k8s.client import (
+    get_api_client,
+)
 
 
 def format_dynamic_api_exc(exc):
@@ -164,8 +164,8 @@ class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
         super(InventoryModule, self).parse(inventory, loader, path)
 
         self.display.deprecated(
-            "The 'k8s' inventory plugin has been deprecated and will be removed in release 4.0.0",
-            version="4.0.0",
+            "The 'k8s' inventory plugin has been deprecated and will be removed in release 6.0.0",
+            version="6.0.0",
             collection_name="kubernetes.core",
         )
         cache_key = self._get_cache_prefix(path)

plugins/lookup/k8s.py

@@ -86,14 +86,48 @@ DOCUMENTATION = """
         description:
         - Provide a username for authenticating with the API. Can also be specified via K8S_AUTH_USERNAME environment
           variable.
+      no_proxy:
+        description:
+        - The comma separated list of hosts/domains/IP/CIDR that shouldn't go through proxy.
+          Can also be specified via K8S_AUTH_NO_PROXY environment variable.
+        - Please note that this module does not pick up typical proxy settings from the environment (e.g. NO_PROXY).
+        - This feature requires kubernetes>=19.15.0.
+          When kubernetes library is less than 19.15.0, it fails even if no_proxy is set correctly.
+        type: str
       password:
         description:
         - Provide a password for authenticating with the API. Can also be specified via K8S_AUTH_PASSWORD environment
           variable.
+      proxy:
+        description:
+        - The URL of an HTTP proxy to use for the connection. Can also be specified via K8S_AUTH_PROXY environment variable.
+        - Please note that this module does not pick up typical proxy settings from the environment (e.g. HTTP_PROXY).
+        type: str
+      proxy_headers:
+        description:
+        - The Header used for the HTTP proxy.
+        - Documentation can be found here
+          U(https://urllib3.readthedocs.io/en/latest/reference/urllib3.util.html?highlight=proxy_headers#urllib3.util.make_headers).
+        type: dict
+        suboptions:
+          proxy_basic_auth:
+            type: str
+            description:
+            - Colon-separated username:password for proxy basic authentication header.
+            - Can also be specified via K8S_AUTH_PROXY_HEADERS_PROXY_BASIC_AUTH environment.
+          basic_auth:
+            type: str
+            description:
+            - Colon-separated username:password for basic authentication header.
+            - Can also be specified via K8S_AUTH_PROXY_HEADERS_BASIC_AUTH environment.
+          user_agent:
+            type: str
+            description:
+            - String representing the user-agent you want, such as foo/1.0.
+            - Can also be specified via K8S_AUTH_PROXY_HEADERS_USER_AGENT environment.
       client_cert:
         description:
-        - Path to a certificate used to authenticate with the API. Can also be specified via K8S_AUTH_CERT_FILE
-          environment
+        - Path to a certificate used to authenticate with the API. Can also be specified via K8S_AUTH_CERT_FILE environment
           variable.
         aliases: [ cert_file ]
       client_key:

plugins/lookup/kustomize.py

@@ -8,7 +8,7 @@ DOCUMENTATION = """
 
     short_description: Build a set of kubernetes resources using a 'kustomization.yaml' file.
 
-    version_added: "2.2.0"
+    version_added: 2.2.0
 
     author:
       - Aubin Bikouo (@abikouo)
@@ -30,6 +30,10 @@ DOCUMENTATION = """
       opt_dirs:
         description:
         - An optional list of directories to search for the executable in addition to PATH.
+      enable_helm:
+        description:
+        - Enable the helm chart inflation generator
+        default: "False"
 
     requirements:
       - "python >= 3.6"
@@ -37,16 +41,20 @@ DOCUMENTATION = """
 
 EXAMPLES = """
 - name: Run lookup using kustomize
-  set_fact:
+  ansible.builtin.set_fact:
     resources: "{{ lookup('kubernetes.core.kustomize', binary_path='/path/to/kustomize') }}"
 
 - name: Run lookup using kubectl kustomize
-  set_fact:
+  ansible.builtin.set_fact:
     resources: "{{ lookup('kubernetes.core.kustomize', binary_path='/path/to/kubectl') }}"
 
 - name: Create kubernetes resources for lookup output
-  k8s:
+  kubernetes.core.k8s:
     definition: "{{ lookup('kubernetes.core.kustomize', dir='/path/to/kustomization') }}"
+
+- name: Create kubernetes resources for lookup output with `--enable-helm` set
+  kubernetes.core.k8s:
+    definition: "{{ lookup('kubernetes.core.kustomize', dir='/path/to/kustomization', enable_helm=True) }}"
 """
 
 RETURN = """
@@ -86,12 +94,20 @@ def get_binary_from_path(name, opt_dirs=None):
 
 def run_command(command):
     cmd = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-    return cmd.communicate()
+    stdout, stderr = cmd.communicate()
+    return cmd.returncode, stdout, stderr
 
 
 class LookupModule(LookupBase):
     def run(
-        self, terms, variables=None, dir=".", binary_path=None, opt_dirs=None, **kwargs
+        self,
+        terms,
+        variables=None,
+        dir=".",
+        binary_path=None,
+        opt_dirs=None,
+        enable_helm=False,
+        **kwargs
     ):
         executable_path = binary_path
         if executable_path is None:
@@ -122,9 +138,21 @@ class LookupModule(LookupBase):
                 )
             )
 
-        (out, err) = run_command(command)
-        if err:
-            raise AnsibleLookupError(
-                "kustomize command failed with: {0}".format(err.decode("utf-8"))
-            )
+        if enable_helm:
+            command += ["--enable-helm"]
+
+        (ret, out, err) = run_command(command)
+        if ret != 0:
+            if err:
+                raise AnsibleLookupError(
+                    "kustomize command failed. exit code: {0}, error: {1}".format(
+                        ret, err.decode("utf-8")
+                    )
+                )
+            else:
+                raise AnsibleLookupError(
+                    "kustomize command failed with unknown error. exit code: {0}".format(
+                        ret
+                    )
+                )
         return [out.decode("utf-8")]

plugins/module_utils/apply.py

@@ -149,6 +149,7 @@ def k8s_apply(resource, definition, **kwargs):
             force_conflicts=kwargs.get("force_conflicts"),
             field_manager=kwargs.get("field_manager"),
             dry_run=kwargs.get("dry_run"),
+            serialize=kwargs.get("serialize"),
         )
     if not existing:
         return resource.create(
@@ -158,6 +159,7 @@ def k8s_apply(resource, definition, **kwargs):
         return resource.get(
             name=definition["metadata"]["name"],
             namespace=definition["metadata"].get("namespace"),
+            **kwargs
         )
     return resource.patch(
         body=desired,

plugins/module_utils/args_common.py

@@ -1,16 +1,64 @@
 from __future__ import absolute_import, division, print_function
 
-from ansible.module_utils.six import string_types
-
 __metaclass__ = type
 
+import warnings
+
 
 def list_dict_str(value):
-    if isinstance(value, (list, dict, string_types)):
+    if isinstance(value, (list, dict, str)):
         return value
     raise TypeError
 
 
+def extract_sensitive_values_from_kubeconfig(kubeconfig_data):
+    """
+    Extract only sensitive string values from kubeconfig data for no_log_values.
+
+    :arg kubeconfig_data: Dictionary containing kubeconfig data
+    :returns: Set of sensitive string values to be added to no_log_values
+    """
+    values = set()
+    sensitive_fields = {
+        "token",
+        "password",
+        "secret",
+        "client-key-data",
+        "client-certificate-data",
+        "certificate-authority-data",
+        "api_key",
+        "access-token",
+        "refresh-token",
+    }
+
+    # Check API version and warn if not v1
+    if isinstance(kubeconfig_data, dict):
+        api_version = kubeconfig_data.get("apiVersion", "v1")
+        if api_version != "v1":
+            warnings.warn(
+                f"Kubeconfig API version '{api_version}' is not 'v1'. "
+                f"Sensitive field redaction is only guaranteed for API version 'v1'. "
+                f"Some sensitive data may not be properly redacted from the logs.",
+                UserWarning,
+            )
+
+    def _extract_recursive(data, current_path=""):
+        if isinstance(data, dict):
+            for key, value in data.items():
+                path = f"{current_path}.{key}" if current_path else key
+                if key in sensitive_fields:
+                    if isinstance(value, str):
+                        values.add(value)
+                else:
+                    _extract_recursive(value, path)
+        elif isinstance(data, list):
+            for i, item in enumerate(data):
+                _extract_recursive(item, f"{current_path}[{i}]")
+
+    _extract_recursive(kubeconfig_data)
+    return values
+
+
 AUTH_PROXY_HEADERS_SPEC = dict(
     proxy_basic_auth=dict(type="str", no_log=True),
     basic_auth=dict(type="str", no_log=True),

plugins/module_utils/client/discovery.py

@@ -113,7 +113,7 @@ class Discoverer(kubernetes.dynamic.discovery.Discoverer):
             filter(lambda resource: "/" in resource["name"], resources_response)
         )
         for subresource in subresources_raw:
-            resource, name = subresource["name"].split("/")
+            resource, name = subresource["name"].split("/", 1)
             subresources[resource][name] = subresource
 
         for resource in resources_raw:

plugins/module_utils/copy.py

@@ -96,7 +96,7 @@ class K8SCopy(metaclass=ABCMeta):
             return error, stdout, stderr
         except Exception as e:
             self.module.fail_json(
-                msg="Error while running/parsing from pod {1}/{2} command='{0}' : {3}".format(
+                msg="Error while running/parsing from pod {0}/{1} command='{2}' : {3}".format(
                     self.namespace, self.name, cmd, to_native(e)
                 )
             )
@@ -278,11 +278,15 @@ class K8SCopyFromPod(K8SCopy):
     def run(self):
         self.files_to_copy = self.list_remote_files()
         if self.files_to_copy == []:
+            # Using warn method instead of passing warnings to exit_json as it is
+            # deprecated in ansible-core>=2.19.0
+            self._module.warn(
+                "No file found from directory '{0}' into remote Pod.".format(
+                    self.remote_path
+                )
+            )
             self.module.exit_json(
                 changed=False,
-                warning="No file found from directory '{0}' into remote Pod.".format(
-                    self.remote_path
-                ),
             )
         self.copy()
 
@@ -435,11 +439,21 @@ def check_pod(svc):
 
     try:
         result = svc.client.get(resource, name=name, namespace=namespace)
-        containers = [
-            c["name"] for c in result.to_dict()["status"]["containerStatuses"]
-        ]
-        if container and container not in containers:
+        containers = dict(
+            {
+                c["name"]: c
+                for cl in ["initContainerStatuses", "containerStatuses"]
+                for c in result.to_dict()["status"].get(cl, [])
+            }
+        )
+        if container and container not in containers.keys():
             module.fail_json(msg="Pod has no container {0}".format(container))
-        return containers
+        if (
+            container
+            and container in containers
+            and not bool(containers[container].get("started", False))
+        ):
+            module.fail_json(msg="Pod container {0} is not started".format(container))
+        return containers.keys()
     except Exception as exc:
         _fail(exc)

plugins/module_utils/helm.py

@@ -15,7 +15,9 @@ import tempfile
 import traceback
 
 from ansible.module_utils.basic import AnsibleModule, missing_required_lib
-from ansible.module_utils.six import string_types
+from ansible_collections.kubernetes.core.plugins.module_utils.args_common import (
+    extract_sensitive_values_from_kubeconfig,
+)
 from ansible_collections.kubernetes.core.plugins.module_utils.version import (
     LooseVersion,
 )
@@ -77,7 +79,6 @@ def write_temp_kubeconfig(server, validate_certs=True, ca_cert=None, kubeconfig=
 
 
 class AnsibleHelmModule(object):
-
     """
     An Ansible module class for Kubernetes.core helm modules
     """
@@ -114,12 +115,19 @@ class AnsibleHelmModule(object):
         kubeconfig_content = None
         kubeconfig = self.params.get("kubeconfig")
         if kubeconfig:
-            if isinstance(kubeconfig, string_types):
-                with open(kubeconfig) as fd:
+            if isinstance(kubeconfig, str):
+                with open(os.path.expanduser(kubeconfig)) as fd:
                     kubeconfig_content = yaml.safe_load(fd)
             elif isinstance(kubeconfig, dict):
                 kubeconfig_content = kubeconfig
 
+            # Redact sensitive fields from kubeconfig for logging purposes
+            if kubeconfig_content:
+                # Add original sensitive values to no_log_values to prevent them from appearing in logs
+                self._module.no_log_values.update(
+                    extract_sensitive_values_from_kubeconfig(kubeconfig_content)
+                )
+
         if self.params.get("ca_cert"):
             ca_cert = self.params.get("ca_cert")
             if LooseVersion(self.get_helm_version()) < LooseVersion("3.5.0"):
@@ -160,11 +168,13 @@ class AnsibleHelmModule(object):
             self.helm_env = self._prepare_helm_environment()
         return self.helm_env
 
-    def run_helm_command(self, command, fails_on_error=True):
+    def run_helm_command(self, command, fails_on_error=True, data=None):
         if not HAS_YAML:
             self.fail_json(msg=missing_required_lib("PyYAML"), exception=YAML_IMP_ERR)
 
-        rc, out, err = self.run_command(command, environ_update=self.env_update)
+        rc, out, err = self.run_command(
+            command, environ_update=self.env_update, data=data
+        )
         if fails_on_error and rc != 0:
             self.fail_json(
                 msg="Failure when executing Helm command. Exited {0}.\nstdout: {1}\nstderr: {2}".format(
@@ -184,14 +194,32 @@ class AnsibleHelmModule(object):
     def get_helm_version(self):
         command = self.get_helm_binary() + " version"
         rc, out, err = self.run_command(command)
-        m = re.match(r'version.BuildInfo{Version:"v([0-9\.]*)",', out)
+        m = re.match(r'version.BuildInfo{Version:"v(.*?)",', out)
         if m:
             return m.group(1)
-        m = re.match(r'Client: &version.Version{SemVer:"v([0-9\.]*)", ', out)
+        m = re.match(r'Client: &version.Version{SemVer:"v(.*?)", ', out)
         if m:
             return m.group(1)
         return None
 
+    def validate_helm_version(self):
+        """
+        Validate that Helm version is >=3.0.0 and <4.0.0.
+        Helm 4 is not yet supported.
+        """
+        helm_version = self.get_helm_version()
+        if helm_version is None:
+            self.fail_json(msg="Unable to determine Helm version")
+
+        if (LooseVersion(helm_version) < LooseVersion("3.0.0")) or (
+            LooseVersion(helm_version) >= LooseVersion("4.0.0")
+        ):
+            self.fail_json(
+                msg="Helm version must be >=3.0.0,<4.0.0, current version is {0}".format(
+                    helm_version
+                )
+            )
+
     def get_values(self, release_name, get_all=False):
         """
         Get Values from deployed release

plugins/module_utils/k8s/client.py

@@ -5,7 +5,6 @@ import hashlib
 import os
 from typing import Any, Dict, List, Optional
 
-from ansible.module_utils.six import iteritems, string_types
 from ansible_collections.kubernetes.core.plugins.module_utils.args_common import (
     AUTH_ARG_MAP,
     AUTH_ARG_SPEC,
@@ -115,7 +114,7 @@ def _load_config(auth: Dict) -> None:
         "persist_config": auth.get("persist_config"),
     }
     if kubeconfig:
-        if isinstance(kubeconfig, string_types):
+        if isinstance(kubeconfig, str):
             kubernetes.config.load_kube_config(config_file=kubeconfig, **optional_arg)
         elif isinstance(kubeconfig, dict):
             kubernetes.config.load_kube_config_from_dict(
@@ -163,7 +162,7 @@ def _create_configuration(auth: Dict):
     except AttributeError:
         configuration = kubernetes.client.Configuration()
 
-    for key, value in iteritems(auth):
+    for key, value in auth.items():
         if key in AUTH_ARG_MAP.keys() and value is not None:
             if key == "api_key":
                 setattr(

plugins/module_utils/k8s/core.py

@@ -3,6 +3,9 @@ from typing import Optional
 
 from ansible.module_utils.basic import AnsibleModule, missing_required_lib
 from ansible.module_utils.common.text.converters import to_text
+from ansible_collections.kubernetes.core.plugins.module_utils.args_common import (
+    extract_sensitive_values_from_kubeconfig,
+)
 from ansible_collections.kubernetes.core.plugins.module_utils.version import (
     LooseVersion,
 )
@@ -33,6 +36,15 @@ class AnsibleK8SModule:
 
         self._module = self.settings["module_class"](**kwargs)
 
+        # Apply kubeconfig redaction for logging purposes
+        if hasattr(self._module, "params") and hasattr(self._module, "no_log_values"):
+            kubeconfig = self._module.params.get("kubeconfig")
+            if kubeconfig and isinstance(kubeconfig, dict):
+                # Add sensitive values to no_log_values to prevent them from appearing in logs
+                self._module.no_log_values.update(
+                    extract_sensitive_values_from_kubeconfig(kubeconfig)
+                )
+
         if self.settings["check_k8s"]:
             self.requires("kubernetes")
             self.has_at_least("kubernetes", "24.2.0", warn=True)

plugins/module_utils/k8s/resource.py

@@ -4,7 +4,6 @@
 import os
 from typing import Dict, Iterable, List, Optional, Union, cast
 
-from ansible.module_utils.six import string_types
 from ansible.module_utils.urls import Request
 
 try:
@@ -78,11 +77,11 @@ def create_definitions(params: Dict) -> List[ResourceDefinition]:
 def from_yaml(definition: Union[str, List, Dict]) -> Iterable[Dict]:
     """Load resource definitions from a yaml definition."""
     definitions: List[Dict] = []
-    if isinstance(definition, string_types):
+    if isinstance(definition, str):
         definitions += yaml.safe_load_all(definition)
     elif isinstance(definition, list):
         for item in definition:
-            if isinstance(item, string_types):
+            if isinstance(item, str):
                 definitions += yaml.safe_load_all(item)
             else:
                 definitions.append(item)

plugins/module_utils/k8s/runner.py

@@ -139,6 +139,7 @@ def perform_action(svc, definition: Dict, params: Dict) -> Dict:
 
     result = {"changed": False, "result": {}}
     instance = {}
+    warnings = []
 
     resource = svc.find_resource(kind, api_version, fail=True)
     definition["kind"] = resource.kind
@@ -172,7 +173,7 @@ def perform_action(svc, definition: Dict, params: Dict) -> Dict:
                 return result
 
         if params.get("apply"):
-            instance = svc.apply(resource, definition, existing)
+            instance, warnings = svc.apply(resource, definition, existing)
             result["method"] = "apply"
         elif not existing:
             if state == "patched":
@@ -183,16 +184,19 @@ def perform_action(svc, definition: Dict, params: Dict) -> Dict:
                     )
                 )
                 return result
-            instance = svc.create(resource, definition)
+            instance, warnings = svc.create(resource, definition)
             result["method"] = "create"
             result["changed"] = True
         elif params.get("force", False):
-            instance = svc.replace(resource, definition, existing)
+            instance, warnings = svc.replace(resource, definition, existing)
             result["method"] = "replace"
         else:
-            instance = svc.update(resource, definition, existing)
+            instance, warnings = svc.update(resource, definition, existing)
             result["method"] = "update"
 
+    if warnings:
+        result["warnings"] = warnings
+
     # If needed, wait and/or create diff
     success = True
 

plugins/module_utils/k8s/service.py

@@ -2,7 +2,9 @@
 # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
 
 import copy
-from typing import Any, Dict, List, Optional, Tuple
+from json import loads
+from re import compile
+from typing import Any, Dict, List, Optional, Tuple, Union
 
 from ansible.module_utils.common.dict_transformations import dict_merge
 from ansible_collections.kubernetes.core.plugins.module_utils.hashes import (
@@ -142,18 +144,12 @@ class K8sService:
         name: str,
         namespace: str,
         merge_type: str = None,
-    ) -> Dict:
-        if merge_type == "json":
-            self.module.deprecate(
-                msg="json as a merge_type value is deprecated. Please use the k8s_json_patch module instead.",
-                version="4.0.0",
-                collection_name="kubernetes.core",
-            )
+    ) -> Tuple[Dict, List[str]]:
         try:
-            params = dict(name=name, namespace=namespace)
+            params = dict(name=name, namespace=namespace, serialize=False)
             if merge_type:
                 params["content_type"] = "application/{0}-patch+json".format(merge_type)
-            return self.client.patch(resource, definition, **params).to_dict()
+            return decode_response(self.client.patch(resource, definition, **params))
         except Exception as e:
             reason = e.body if hasattr(e, "body") else e
             msg = "Failed to patch object: {0}".format(reason)
@@ -330,123 +326,124 @@ class K8sService:
             result["resources"].append(hide_fields(res, hidden_fields))
         return result
 
-    def create(self, resource: Resource, definition: Dict) -> Dict:
+    def create(self, resource: Resource, definition: Dict) -> Tuple[Dict, List[str]]:
         namespace = definition["metadata"].get("namespace")
         name = definition["metadata"].get("name")
 
         if self._client_side_dry_run:
-            k8s_obj = _encode_stringdata(definition)
-        else:
-            try:
-                k8s_obj = self.client.create(
-                    resource, definition, namespace=namespace
-                ).to_dict()
-            except ConflictError:
-                # Some resources, like ProjectRequests, can't be created multiple times,
-                # because the resources that they create don't match their kind
-                # In this case we'll mark it as unchanged and warn the user
-                self.module.warn(
-                    "{0} was not found, but creating it returned a 409 Conflict error. This can happen \
-                            if the resource you are creating does not directly create a resource of the same kind.".format(
-                        name
-                    )
+            return _encode_stringdata(definition), []
+
+        try:
+            return decode_response(
+                self.client.create(
+                    resource, definition, namespace=namespace, serialize=False
                 )
-                return dict()
-            except Exception as e:
-                reason = e.body if hasattr(e, "body") else e
-                msg = "Failed to create object: {0}".format(reason)
-                raise CoreException(msg) from e
-        return k8s_obj
+            )
+        except ConflictError:
+            # Some resources, like ProjectRequests, can't be created multiple times,
+            # because the resources that they create don't match their kind
+            # In this case we'll mark it as unchanged and warn the user
+            self.module.warn(
+                "{0} was not found, but creating it returned a 409 Conflict error. This can happen \
+                        if the resource you are creating does not directly create a resource of the same kind.".format(
+                    name
+                )
+            )
+            return dict(), []
+        except Exception as e:
+            reason = e.body if hasattr(e, "body") else e
+            msg = "Failed to create object: {0}".format(reason)
+            raise CoreException(msg) from e
 
     def apply(
         self,
         resource: Resource,
         definition: Dict,
         existing: Optional[ResourceInstance] = None,
-    ) -> Dict:
+    ) -> Tuple[Dict, List[str]]:
         namespace = definition["metadata"].get("namespace")
 
         server_side_apply = self.module.params.get("server_side_apply")
         if server_side_apply:
             requires("kubernetes", "19.15.0", reason="to use server side apply")
+
         if self._client_side_dry_run:
             ignored, patch = apply_object(resource, _encode_stringdata(definition))
             if existing:
-                k8s_obj = dict_merge(existing.to_dict(), patch)
+                return dict_merge(existing.to_dict(), patch), []
             else:
-                k8s_obj = patch
-        else:
-            try:
-                params = {}
-                if server_side_apply:
-                    params["server_side"] = True
-                    params.update(server_side_apply)
-                k8s_obj = self.client.apply(
-                    resource, definition, namespace=namespace, **params
-                ).to_dict()
-            except Exception as e:
-                reason = e.body if hasattr(e, "body") else e
-                msg = "Failed to apply object: {0}".format(reason)
-                raise CoreException(msg) from e
-        return k8s_obj
+                return patch, []
+
+        try:
+            params = {}
+            if server_side_apply:
+                params["server_side"] = True
+                params.update(server_side_apply)
+            return decode_response(
+                self.client.apply(
+                    resource, definition, namespace=namespace, serialize=False, **params
+                )
+            )
+        except Exception as e:
+            reason = e.body if hasattr(e, "body") else e
+            msg = "Failed to apply object: {0}".format(reason)
+            raise CoreException(msg) from e
 
     def replace(
         self,
         resource: Resource,
         definition: Dict,
         existing: ResourceInstance,
-    ) -> Dict:
+    ) -> Tuple[Dict, List[str]]:
         append_hash = self.module.params.get("append_hash", False)
         name = definition["metadata"].get("name")
         namespace = definition["metadata"].get("namespace")
 
         if self._client_side_dry_run:
-            k8s_obj = _encode_stringdata(definition)
-        else:
-            try:
-                k8s_obj = self.client.replace(
+            return _encode_stringdata(definition), []
+
+        try:
+            return decode_response(
+                self.client.replace(
                     resource,
                     definition,
                     name=name,
                     namespace=namespace,
                     append_hash=append_hash,
-                ).to_dict()
-            except Exception as e:
-                reason = e.body if hasattr(e, "body") else e
-                msg = "Failed to replace object: {0}".format(reason)
-                raise CoreException(msg) from e
-        return k8s_obj
+                    serialize=False,
+                )
+            )
+        except Exception as e:
+            reason = e.body if hasattr(e, "body") else e
+            msg = "Failed to replace object: {0}".format(reason)
+            raise CoreException(msg) from e
 
     def update(
         self, resource: Resource, definition: Dict, existing: ResourceInstance
-    ) -> Dict:
+    ) -> Tuple[Dict, List[str]]:
         name = definition["metadata"].get("name")
         namespace = definition["metadata"].get("namespace")
 
         if self._client_side_dry_run:
-            k8s_obj = dict_merge(existing.to_dict(), _encode_stringdata(definition))
-        else:
-            exception = None
-            for merge_type in self.module.params.get("merge_type") or [
-                "strategic-merge",
-                "merge",
-            ]:
-                try:
-                    k8s_obj = self.patch_resource(
-                        resource,
-                        definition,
-                        name,
-                        namespace,
-                        merge_type=merge_type,
-                    )
-                    exception = None
-                except CoreException as e:
-                    exception = e
-                    continue
-                break
-            if exception:
-                raise exception
-        return k8s_obj
+            return dict_merge(existing.to_dict(), _encode_stringdata(definition)), []
+
+        exception = None
+        for merge_type in self.module.params.get("merge_type") or [
+            "strategic-merge",
+            "merge",
+        ]:
+            try:
+                return self.patch_resource(
+                    resource,
+                    definition,
+                    name,
+                    namespace,
+                    merge_type=merge_type,
+                )
+            except CoreException as e:
+                exception = e
+                continue
+        raise exception
 
     def delete(
         self,
@@ -476,7 +473,7 @@ class K8sService:
         if label_selectors:
             params["label_selector"] = ",".join(label_selectors)
 
-        if delete_options:
+        if delete_options and not self.module.check_mode:
             body = {
                 "apiVersion": "v1",
                 "kind": "DeleteOptions",
@@ -501,45 +498,214 @@ def diff_objects(
     if not diff:
         return True, result
 
-    result["before"] = diff[0]
-    result["after"] = diff[1]
+    result["before"] = hide_fields(diff[0], hidden_fields)
+    result["after"] = hide_fields(diff[1], hidden_fields)
 
-    if list(result["after"].keys()) != ["metadata"] or list(
+    if list(result["after"].keys()) == ["metadata"] and list(
         result["before"].keys()
-    ) != ["metadata"]:
-        return False, result
+    ) == ["metadata"]:
+        # If only metadata.generation and metadata.resourceVersion changed, ignore it
+        ignored_keys = set(["generation", "resourceVersion"])
 
-    # If only metadata.generation and metadata.resourceVersion changed, ignore it
-    ignored_keys = set(["generation", "resourceVersion"])
+        if set(result["after"]["metadata"].keys()).issubset(ignored_keys) and set(
+            result["before"]["metadata"].keys()
+        ).issubset(ignored_keys):
+            return True, result
 
-    if not set(result["after"]["metadata"].keys()).issubset(ignored_keys):
-        return False, result
-    if not set(result["before"]["metadata"].keys()).issubset(ignored_keys):
-        return False, result
-
-    result["before"] = hide_fields(result["before"], hidden_fields)
-    result["after"] = hide_fields(result["after"], hidden_fields)
-
-    return True, result
+    return False, result
 
 
-def hide_fields(definition: dict, hidden_fields: Optional[list]) -> dict:
-    if not hidden_fields:
-        return definition
-    result = copy.deepcopy(definition)
-    for hidden_field in hidden_fields:
-        result = hide_field(result, hidden_field)
+def hide_field_tree(hidden_field: str) -> List[str]:
+    result = []
+    key, rest = hide_field_split2(hidden_field)
+    result.append(key)
+    while rest:
+        key, rest = hide_field_split2(rest)
+        result.append(key)
+
     return result
 
 
-# hide_field is not hugely sophisticated and designed to cope
-# with e.g. status or metadata.managedFields rather than e.g.
-# spec.template.spec.containers[0].env[3].value
-def hide_field(definition: dict, hidden_field: str) -> dict:
-    split = hidden_field.split(".", 1)
-    if split[0] in definition:
-        if len(split) == 2:
-            definition[split[0]] = hide_field(definition[split[0]], split[1])
-        else:
-            del definition[split[0]]
+def build_hidden_field_tree(hidden_fields: List[str]) -> Dict[str, Any]:
+    """Group hidden field targeting the same json key
+    Example:
+        Input: ['env[3]', 'env[0]']
+        Output: {'env': [0, 3]}
+    """
+    output = {}
+    for hidden_field in hidden_fields:
+        current = output
+        tree = hide_field_tree(hidden_field)
+        for idx, key in enumerate(tree):
+            if current.get(key, "") is None:
+                break
+            if idx == (len(tree) - 1):
+                current[key] = None
+            elif key not in current:
+                current[key] = {}
+            current = current[key]
+    return output
+
+
+# hide_field should be able to cope with simple or more complicated
+# field definitions
+# e.g. status or metadata.managedFields or
+# spec.template.spec.containers[0].env[3].value or
+# metadata.annotations[kubectl.kubernetes.io/last-applied-configuration]
+def hide_field(
+    definition: Union[Dict[str, Any], List[Any]], hidden_field: Dict[str, Any]
+) -> Dict[str, Any]:
+    def dict_contains_key(obj: Dict[str, Any], key: str) -> bool:
+        return key in obj
+
+    def list_contains_key(obj: List[Any], key: str) -> bool:
+        return int(key) < len(obj)
+
+    hidden_keys = list(hidden_field.keys())
+    field_contains_key = dict_contains_key
+    field_get_key = str
+    if isinstance(definition, list):
+        # Sort with reverse=true so that when we delete an item from the list, the order is not changed
+        hidden_keys = sorted(
+            [k for k in hidden_field.keys() if k.isdecimal()], reverse=True
+        )
+        field_contains_key = list_contains_key
+        field_get_key = int
+
+    for key in hidden_keys:
+        if field_contains_key(definition, key):
+            value = hidden_field.get(key)
+            convert_key = field_get_key(key)
+            if value is None:
+                del definition[convert_key]
+            else:
+                definition[convert_key] = hide_field(definition[convert_key], value)
+                if (
+                    definition[convert_key] == dict()
+                    or definition[convert_key] == list()
+                ):
+                    del definition[convert_key]
+
     return definition
+
+
+def hide_fields(
+    definition: Dict[str, Any], hidden_fields: Optional[List[str]]
+) -> Dict[str, Any]:
+    if not hidden_fields:
+        return definition
+    result = copy.deepcopy(definition)
+    hidden_field_tree = build_hidden_field_tree(hidden_fields)
+    return hide_field(result, hidden_field_tree)
+
+
+def decode_response(resp) -> Tuple[Dict, List[str]]:
+    """
+    This function decodes unserialized responses from the Kubernetes python
+    client and decodes the RFC2616 14.46 warnings found in the response
+    headers.
+    """
+    obj = ResourceInstance(None, loads(resp.data.decode("utf8"))).to_dict()
+    warnings = []
+    if (
+        resp.headers is not None
+        and "warning" in resp.headers
+        and resp.headers["warning"] is not None
+    ):
+        warnings = resp.headers["warning"].split(", ")
+    return obj, decode_warnings(warnings)
+
+
+def decode_warnings(warnings: str) -> List[str]:
+    """
+    This function decodes RFC2616 14.46 warnings in a simplified way, where
+    only the warn-texts are returned in a list.
+    """
+    p = compile('\\d{3} .+ (".+")')
+
+    decoded = []
+    for warning in warnings:
+        m = p.match(warning)
+        if m:
+            try:
+                parsed, unused = parse_quoted_string(m.group(1))
+                decoded.append(parsed)
+            except ValueError:
+                continue
+
+    return decoded
+
+
+def parse_quoted_string(quoted_string: str) -> Tuple[str, str]:
+    """
+    This function was adapted from:
+    https://github.com/kubernetes/apimachinery/blob/bb8822152cabfb4f34dbc26270f874ce53db50de/pkg/util/net/http.go#L609
+    """
+    if len(quoted_string) == 0:
+        raise ValueError("invalid quoted string: 0-length")
+
+    if quoted_string[0] != '"':
+        raise ValueError("invalid quoted string: missing initial quote")
+
+    quoted_string = quoted_string[1:]
+    remainder = ""
+    escaping = False
+    closed_quote = False
+    result = []
+
+    for i, b in enumerate(quoted_string):
+        if b == '"':
+            if escaping:
+                result.append(b)
+                escaping = False
+            else:
+                closed_quote = True
+                remainder_start = i + 1
+                remainder = quoted_string[remainder_start:].strip()
+                break
+        elif b == "\\":
+            if escaping:
+                result.append(b)
+                escaping = False
+            else:
+                escaping = True
+        else:
+            result.append(b)
+            escaping = False
+
+    if not closed_quote:
+        raise ValueError("invalid quoted string: missing closing quote")
+
+    return "".join(result), remainder
+
+
+# hide_field_split2 returns the first key in hidden_field and the rest of the hidden_field
+# We expect the first key to either be in brackets, to be terminated by the start of a left
+# bracket, or to be terminated by a dot.
+
+# examples would be:
+# field.another.next -> (field, another.next)
+# field[key].value -> (field, [key].value)
+# [key].value -> (key, value)
+# [one][two] -> (one, [two])
+
+
+def hide_field_split2(hidden_field: str) -> Tuple[str, str]:
+    lbracket = hidden_field.find("[")
+    rbracket = hidden_field.find("]")
+    dot = hidden_field.find(".")
+
+    if lbracket == 0:
+        # skip past right bracket and any following dot
+        rest = hidden_field[rbracket + 1 :]  # noqa: E203
+        if rest and rest[0] == ".":
+            rest = rest[1:]
+        return (hidden_field[lbracket + 1 : rbracket], rest)  # noqa: E203
+
+    if lbracket != -1 and (dot == -1 or lbracket < dot):
+        return (hidden_field[:lbracket], hidden_field[lbracket:])
+
+    split = hidden_field.split(".", 1)
+    if len(split) == 1:
+        return split[0], ""
+    return split

plugins/module_utils/k8s/waiter.py

@@ -51,7 +51,7 @@ def daemonset_ready(daemonset: ResourceInstance) -> bool:
     return bool(
         daemonset.status
         and daemonset.status.desiredNumberScheduled is not None
-        and daemonset.status.updatedNumberScheduled
+        and (daemonset.status.updatedNumberScheduled or 0)
         == daemonset.status.desiredNumberScheduled
         and daemonset.status.numberReady == daemonset.status.desiredNumberScheduled
         and daemonset.status.observedGeneration == daemonset.metadata.generation
@@ -117,11 +117,34 @@ def exists(resource: Optional[ResourceInstance]) -> bool:
     return bool(resource) and not empty_list(resource)
 
 
+def cluster_operator_ready(resource: ResourceInstance) -> bool:
+    """
+    Predicate to check if a single ClusterOperator is healthy.
+    Returns True if:
+      - "Available" is True
+      - "Degraded" is False
+      - "Progressing" is False
+    """
+    if not resource:
+        return False
+
+    # Extract conditions from the resource's status
+    conditions = resource.get("status", {}).get("conditions", [])
+
+    status = {x.get("type", ""): x.get("status") for x in conditions}
+    return (
+        (status.get("Degraded") == "False")
+        and (status.get("Progressing") == "False")
+        and (status.get("Available") == "True")
+    )
+
+
 RESOURCE_PREDICATES = {
     "DaemonSet": daemonset_ready,
     "Deployment": deployment_ready,
     "Pod": pod_ready,
     "StatefulSet": statefulset_ready,
+    "ClusterOperator": cluster_operator_ready,
 }
 
 

plugins/modules/helm.py

@@ -14,7 +14,7 @@ module: helm
 
 short_description: Manages Kubernetes packages with the Helm package manager
 
-version_added: "0.11.0"
+version_added: 0.11.0
 
 author:
   - Lucas Boisserie (@LucasBoisserie)
@@ -61,7 +61,7 @@ options:
     default: false
     type: bool
     aliases: [ dep_up ]
-    version_added: "2.4.0"
+    version_added: 2.4.0
   release_name:
     description:
       - Release name to manage.
@@ -99,7 +99,7 @@ options:
     default: []
     type: list
     elements: str
-    version_added: '1.1.0'
+    version_added: 1.1.0
   update_repo_cache:
     description:
       - Run C(helm repo update) before the operation. Can be run as part of the package installation or as a separate step (see Examples).
@@ -129,7 +129,7 @@ options:
           - string
           - json
           - file
-    version_added: '2.4.0'
+    version_added: 2.4.0
   reuse_values:
     description:
       - When upgrading package, specifies wether to reuse the last release's values and merge in any overrides from parameters I(release_values),
@@ -137,14 +137,24 @@ options:
       - If I(reset_values) is set to C(True), this is ignored.
     type: bool
     required: false
-    version_added: '2.5.0'
+    version_added: 3.0.0
   reset_values:
     description:
       - When upgrading package, reset the values to the ones built into the chart.
     type: bool
     required: false
     default: True
-    version_added: '2.5.0'
+    version_added: 3.0.0
+  reset_then_reuse_values:
+    description:
+      - When upgrading package, reset the values to the ones built into the chart, apply the last release's values and merge in any overrides from
+        parameters O(release_values), O(values_files) or O(set_values).
+      - If O(reset_values) or O(reuse_values) is set to V(True), this is ignored.
+      - This feature requires helm diff >= 3.9.12.
+    type: bool
+    required: false
+    default: False
+    version_added: 6.0.0
 
 #Helm options
   disable_hook:
@@ -181,7 +191,7 @@ options:
       - similar to C(wait_timeout) but does not required C(wait) to be activated.
       - Mutually exclusive with C(wait_timeout).
     type: str
-    version_added: "2.3.0"
+    version_added: 2.3.0
   atomic:
     description:
       - If set, the installation process deletes the installation on failure.
@@ -192,12 +202,12 @@ options:
       - Create the release namespace if not present.
     type: bool
     default: False
-    version_added: "0.11.1"
+    version_added: 0.11.1
   post_renderer:
     description:
       - Path to an executable to be used for post rendering.
     type: str
-    version_added: "2.4.0"
+    version_added: 2.4.0
   replace:
     description:
       - Reuse the given name, only if that name is a deleted release which remains in the history.
@@ -205,19 +215,28 @@ options:
       - mutually exclusive with with C(history_max).
     type: bool
     default: False
-    version_added: "1.11.0"
+    version_added: 1.11.0
   skip_crds:
     description:
       - Skip custom resource definitions when installing or upgrading.
     type: bool
     default: False
-    version_added: "1.2.0"
+    version_added: 1.2.0
   history_max:
     description:
       - Limit the maximum number of revisions saved per release.
       - mutually exclusive with with C(replace).
     type: int
-    version_added: "2.2.0"
+    version_added: 2.2.0
+  insecure_skip_tls_verify:
+    description:
+      - Skip tls certificate checks for the chart download.
+      - Do not confuse with the C(validate_certs) option.
+      - This option is only available for helm >= 3.16.0.
+    type: bool
+    default: False
+    aliases: [ skip_tls_certs_check ]
+    version_added: 5.3.0
 extends_documentation_fragment:
   - kubernetes.core.helm_common_options
 """
@@ -373,9 +392,18 @@ status:
       returned: always
       description: The Date of last update
     values:
-      type: str
+      type: dict
       returned: always
-      description: Dict of Values used to deploy
+      description:
+        - Dict of Values used to deploy.
+        - This return value has been deprecated and will be removed in a release after
+          2027-01-08. Use RV(status.release_values) instead.
+    release_values:
+      type: dict
+      returned: always
+      description:
+        - Dict of Values used to deploy.
+      version_added: 6.3.0
 stdout:
   type: str
   description: Full `helm` command stdout, in case you want to display it or examine the event log
@@ -455,7 +483,8 @@ def get_release_status(module, release_name, all_status=False):
     if release is None:  # not install
         return None
 
-    release["values"] = module.get_values(release_name)
+    release["release_values"] = module.get_values(release_name)
+    release["values"] = release["release_values"]
 
     return release
 
@@ -476,12 +505,15 @@ def run_dep_update(module, chart_ref):
     rc, out, err = module.run_helm_command(dep_update)
 
 
-def fetch_chart_info(module, command, chart_ref):
+def fetch_chart_info(module, command, chart_ref, insecure_skip_tls_verify=False):
     """
     Get chart info
     """
     inspect_command = command + f" show chart '{chart_ref}'"
 
+    if insecure_skip_tls_verify:
+        inspect_command += " --insecure-skip-tls-verify"
+
     rc, out, err = module.run_helm_command(inspect_command)
 
     return yaml.safe_load(out)
@@ -509,6 +541,8 @@ def deploy(
     set_value_args=None,
     reuse_values=None,
     reset_values=True,
+    reset_then_reuse_values=False,
+    insecure_skip_tls_verify=False,
 ):
     """
     Install/upgrade/rollback release chart
@@ -526,6 +560,17 @@ def deploy(
     if reuse_values is not None:
         deploy_command += " --reuse-values=" + str(reuse_values)
 
+    if reset_then_reuse_values:
+        helm_version = module.get_helm_version()
+        if LooseVersion(helm_version) < LooseVersion("3.14.0"):
+            module.fail_json(
+                msg="reset_then_reuse_values requires helm >= 3.14.0, current version is {0}".format(
+                    helm_version
+                )
+            )
+        else:
+            deploy_command += " --reset-then-reuse-values"
+
     if wait:
         deploy_command += " --wait"
         if wait_timeout is not None:
@@ -549,6 +594,17 @@ def deploy(
     if create_namespace:
         deploy_command += " --create-namespace"
 
+    if insecure_skip_tls_verify:
+        helm_version = module.get_helm_version()
+        if LooseVersion(helm_version) < LooseVersion("3.16.0"):
+            module.fail_json(
+                msg="insecure_skip_tls_verify requires helm >= 3.16.0, current version is {0}".format(
+                    helm_version
+                )
+            )
+        else:
+            deploy_command += " --insecure-skip-tls-verify"
+
     if values_files:
         for value_file in values_files:
             deploy_command += " --values=" + value_file
@@ -639,6 +695,11 @@ def helmdiff_check(
     replace=False,
     chart_repo_url=None,
     post_renderer=False,
+    set_value_args=None,
+    reuse_values=None,
+    reset_values=True,
+    reset_then_reuse_values=False,
+    insecure_skip_tls_verify=False,
 ):
     """
     Use helm diff to determine if a release would change by upgrading a chart.
@@ -652,10 +713,14 @@ def helmdiff_check(
     if chart_version is not None:
         cmd += " " + "--version=" + chart_version
     if not replace:
-        cmd += " " + "--reset-values"
+        cmd += " " + "--reset-values=" + str(reset_values)
     if post_renderer:
         cmd += " --post-renderer=" + post_renderer
 
+    if values_files:
+        for value_file in values_files:
+            cmd += " --values=" + value_file
+
     if release_values != {}:
         fd, path = tempfile.mkstemp(suffix=".yml")
         with open(path, "w") as yaml_file:
@@ -663,9 +728,32 @@ def helmdiff_check(
         cmd += " -f=" + path
         module.add_cleanup_file(path)
 
-    if values_files:
-        for values_file in values_files:
-            cmd += " -f=" + values_file
+    if set_value_args:
+        cmd += " " + set_value_args
+
+    if reuse_values:
+        cmd += " --reuse-values"
+
+    if reset_then_reuse_values:
+        helm_diff_version = get_plugin_version("diff")
+        helm_version = module.get_helm_version()
+        fail_msg = ""
+        if LooseVersion(helm_diff_version) < LooseVersion("3.9.12"):
+            fail_msg = "reset_then_reuse_values requires helm diff >= 3.9.12, current version is {0}\n".format(
+                helm_diff_version
+            )
+        if LooseVersion(helm_version) < LooseVersion("3.14.0"):
+            fail_msg += "reset_then_reuse_values requires helm >= 3.14.0, current version is {0}\n".format(
+                helm_version
+            )
+
+        if fail_msg:
+            module.fail_json(msg=fail_msg)
+        else:
+            cmd += " --reset-then-reuse-values"
+
+    if insecure_skip_tls_verify:
+        cmd += " --insecure-skip-tls-verify"
 
     rc, out, err = module.run_helm_command(cmd)
     return (len(out.strip()) > 0, out.strip())
@@ -726,6 +814,10 @@ def argument_spec():
             set_values=dict(type="list", elements="dict"),
             reuse_values=dict(type="bool"),
             reset_values=dict(type="bool", default=True),
+            reset_then_reuse_values=dict(type="bool", default=False),
+            insecure_skip_tls_verify=dict(
+                type="bool", default=False, aliases=["skip_tls_certs_check"]
+            ),
         )
     )
     return arg_spec
@@ -750,6 +842,9 @@ def main():
     if not IMP_YAML:
         module.fail_json(msg=missing_required_lib("yaml"), exception=IMP_YAML_ERR)
 
+    # Validate Helm version >=3.0.0,<4.0.0
+    module.validate_helm_version()
+
     changed = False
 
     chart_ref = module.params.get("chart_ref")
@@ -778,6 +873,8 @@ def main():
     set_values = module.params.get("set_values")
     reuse_values = module.params.get("reuse_values")
     reset_values = module.params.get("reset_values")
+    reset_then_reuse_values = module.params.get("reset_then_reuse_values")
+    insecure_skip_tls_verify = module.params.get("insecure_skip_tls_verify")
 
     if update_repo_cache:
         run_repo_update(module)
@@ -815,7 +912,9 @@ def main():
             helm_cmd += " --repo=" + chart_repo_url
 
         # Fetch chart info to have real version and real name for chart_ref from archive, folder or url
-        chart_info = fetch_chart_info(module, helm_cmd, chart_ref)
+        chart_info = fetch_chart_info(
+            module, helm_cmd, chart_ref, insecure_skip_tls_verify
+        )
 
         if dependency_update:
             if chart_info.get("dependencies"):
@@ -847,11 +946,11 @@ def main():
                     "Please consider add dependencies block or disable dependency_update to remove this warning."
                 )
 
-        if release_status is None:  # Not installed
-            set_value_args = None
-            if set_values:
-                set_value_args = module.get_helm_set_values_args(set_values)
+        set_value_args = None
+        if set_values:
+            set_value_args = module.get_helm_set_values_args(set_values)
 
+        if release_status is None:  # Not installed
             helm_cmd = deploy(
                 module,
                 helm_cmd,
@@ -874,6 +973,8 @@ def main():
                 set_value_args=set_value_args,
                 reuse_values=reuse_values,
                 reset_values=reset_values,
+                reset_then_reuse_values=reset_then_reuse_values,
+                insecure_skip_tls_verify=insecure_skip_tls_verify,
             )
             changed = True
 
@@ -896,6 +997,11 @@ def main():
                     replace,
                     chart_repo_url,
                     post_renderer,
+                    set_value_args,
+                    reuse_values=reuse_values,
+                    reset_values=reset_values,
+                    reset_then_reuse_values=reset_then_reuse_values,
+                    insecure_skip_tls_verify=insecure_skip_tls_verify,
                 )
                 if would_change and module._diff:
                     opt_result["diff"] = {"prepared": prepared}
@@ -909,10 +1015,6 @@ def main():
                 )
 
             if force or would_change:
-                set_value_args = None
-                if set_values:
-                    set_value_args = module.get_helm_set_values_args(set_values)
-
                 helm_cmd = deploy(
                     module,
                     helm_cmd,
@@ -935,14 +1037,21 @@ def main():
                     set_value_args=set_value_args,
                     reuse_values=reuse_values,
                     reset_values=reset_values,
+                    reset_then_reuse_values=reset_then_reuse_values,
+                    insecure_skip_tls_verify=insecure_skip_tls_verify,
                 )
                 changed = True
 
     if module.check_mode:
-        check_status = {"values": {"current": {}, "declared": {}}}
+        check_status = {
+            "values": {"current": {}, "declared": {}},
+            "release_values": {"current": {}, "declared": {}},
+        }
         if release_status:
-            check_status["values"]["current"] = release_status["values"]
+            check_status["values"]["current"] = release_status["release_values"]
             check_status["values"]["declared"] = release_status
+            check_status["release_values"]["current"] = release_status["release_values"]
+            check_status["release_values"]["declared"] = release_status
 
         module.exit_json(
             changed=changed,

plugins/modules/helm_info.py

@@ -14,7 +14,7 @@ module: helm_info
 
 short_description: Get information from Helm package deployed inside the cluster
 
-version_added: "0.11.0"
+version_added: 0.11.0
 
 author:
   - Lucas Boisserie (@LucasBoisserie)
@@ -53,7 +53,7 @@ options:
     type: list
     elements: str
     default: []
-    version_added: "2.3.0"
+    version_added: 2.3.0
   get_all_values:
     description:
       - Set to C(True) if you want to get all (computed) values of the release.
@@ -61,7 +61,7 @@ options:
     required: false
     default: false
     type: bool
-    version_added: "2.4.0"
+    version_added: 2.4.0
 extends_documentation_fragment:
   - kubernetes.core.helm_common_options
 """
@@ -115,26 +115,35 @@ status:
       returned: always
       description: The Date of last update
     values:
-      type: str
+      type: dict
       returned: always
-      description: Dict of Values used to deploy
+      description:
+        - Dict of Values used to deploy
+        - This return value has been deprecated and will be removed in a release after
+          2027-01-08. Use RV(status.release_values) instead.
+    release_values:
+      type: dict
+      returned: always
+      description:
+        - Dict of Values used to deploy.
+      version_added: 6.3.0
     hooks:
       type: list
       elements: dict
       description: Hooks of the release
       returned: always
-      version_added: "2.4.0"
+      version_added: 2.4.0
     notes:
       type: str
       description: Notes of the release
       returned: always
-      version_added: "2.4.0"
+      version_added: 2.4.0
     manifest:
       type: list
       elements: dict
       description: Manifest of the release
       returned: always
-      version_added: "2.4.0"
+      version_added: 2.4.0
 """
 
 import copy
@@ -202,7 +211,8 @@ def get_release_status(module, release_name, release_state, get_all_values=False
     if release is None:  # not install
         return None
 
-    release["values"] = module.get_values(release_name, get_all_values)
+    release["release_values"] = module.get_values(release_name, get_all_values)
+    release["values"] = release["release_values"]
     release["manifest"] = module.get_manifest(release_name)
     release["notes"] = module.get_notes(release_name)
     release["hooks"] = module.get_hooks(release_name)
@@ -235,6 +245,9 @@ def main():
     if not IMP_YAML:
         module.fail_json(msg=missing_required_lib("yaml"), exception=IMP_YAML_ERR)
 
+    # Validate Helm version >=3.0.0,<4.0.0
+    module.validate_helm_version()
+
     release_name = module.params.get("release_name")
     release_state = module.params.get("release_state")
     get_all_values = module.params.get("get_all_values")

plugins/modules/helm_plugin.py

@@ -12,7 +12,7 @@ DOCUMENTATION = r"""
 ---
 module: helm_plugin
 short_description: Manage Helm plugins
-version_added: "1.0.0"
+version_added: 1.0.0
 author:
   - Abhijeet Kasurde (@Akasurde)
 requirements:
@@ -47,7 +47,7 @@ options:
       - Ignored when C(state=absent) or C(state=latest).
     required: false
     type: str
-    version_added: "2.3.0"
+    version_added: 2.3.0
 extends_documentation_fragment:
   - kubernetes.core.helm_common_options
 """
@@ -161,6 +161,9 @@ def main():
         mutually_exclusive=mutually_exclusive(),
     )
 
+    # Validate Helm version >=3.0.0,<4.0.0
+    module.validate_helm_version()
+
     state = module.params.get("state")
 
     helm_cmd_common = module.get_helm_binary() + " plugin"

plugins/modules/helm_plugin_info.py

@@ -12,7 +12,7 @@ DOCUMENTATION = r"""
 ---
 module: helm_plugin_info
 short_description: Gather information about Helm plugins
-version_added: "1.0.0"
+version_added: 1.0.0
 author:
   - Abhijeet Kasurde (@Akasurde)
 requirements:
@@ -98,6 +98,9 @@ def main():
         supports_check_mode=True,
     )
 
+    # Validate Helm version >=3.0.0,<4.0.0
+    module.validate_helm_version()
+
     plugin_name = module.params.get("plugin_name")
 
     plugin_list = []

plugins/modules/helm_pull.py

@@ -12,7 +12,7 @@ DOCUMENTATION = r"""
 ---
 module: helm_pull
 short_description: download a chart from a repository and (optionally) unpack it in local directory.
-version_added: "2.4.0"
+version_added: 2.4.0
 author:
   - Aubin Bikouo (@abikouo)
 description:
@@ -21,7 +21,7 @@ description:
   - There are options for unpacking the chart after download.
 
 requirements:
-  - "helm >= 3.0 (https://github.com/helm/helm/releases)"
+  - "helm >= 3.0, <4.0.0 (https://github.com/helm/helm/releases)"
 
 options:
   chart_ref:
@@ -75,9 +75,10 @@ options:
   skip_tls_certs_check:
     description:
     - Whether or not to check tls certificate for the chart download.
-    - Requires helm >= 3.3.0.
+    - Requires helm >= 3.3.0. Alias C(insecure_skip_tls_verify) added in 5.3.0.
     type: bool
     default: False
+    aliases: [ insecure_skip_tls_verify ]
   chart_devel:
     description:
     - Use development versions, too. Equivalent to version '>0.0.0-0'.
@@ -88,6 +89,14 @@ options:
     - if set to true, will untar the chart after downloading it.
     type: bool
     default: False
+  force:
+    description:
+    - Force download of the chart even if it already exists in the destination directory.
+    - By default, the module will skip downloading if the chart with the same version already exists for idempotency.
+    - When used with O(untar_chart=true), will remove any existing chart directory before extracting.
+    type: bool
+    default: False
+    version_added: 6.3.0
   destination:
     description:
     - location to write the chart.
@@ -144,6 +153,23 @@ EXAMPLES = r"""
     destination: /path/to/chart
     username: myuser
     password: mypassword123
+
+- name: Download Chart (force re-download even if exists)
+  kubernetes.core.helm_pull:
+    chart_ref: redis
+    repo_url: https://charts.bitnami.com/bitnami
+    chart_version: '17.0.0'
+    destination: /path/to/chart
+    force: yes
+
+- name: Download and untar chart (force re-extraction even if directory exists)
+  kubernetes.core.helm_pull:
+    chart_ref: redis
+    repo_url: https://charts.bitnami.com/bitnami
+    chart_version: '17.0.0'
+    destination: /path/to/chart
+    untar_chart: yes
+    force: yes
 """
 
 RETURN = r"""
@@ -162,6 +188,11 @@ command:
   description: Full `helm pull` command built by this module, in case you want to re-run the command outside the module or debug a problem.
   returned: always
   sample: helm pull --repo test ...
+msg:
+  type: str
+  description: A message indicating the result of the operation.
+  returned: when chart already exists
+  sample: Chart redis version 17.0.0 already exists in destination directory
 rc:
   type: int
   description: Helm pull command return code
@@ -169,6 +200,18 @@ rc:
   sample: 1
 """
 
+import os
+import shutil
+import tarfile
+import uuid
+
+try:
+    import yaml
+
+    HAS_YAML = True
+except ImportError:
+    HAS_YAML = False
+
 from ansible_collections.kubernetes.core.plugins.module_utils.helm import (
     AnsibleHelmModule,
 )
@@ -177,6 +220,115 @@ from ansible_collections.kubernetes.core.plugins.module_utils.version import (
 )
 
 
+def extract_chart_name(chart_ref):
+    """
+    Extract chart name from chart reference.
+
+    Args:
+        chart_ref (str): Chart reference (name, URL, or OCI reference)
+
+    Returns:
+        str: Extracted chart name
+    """
+    chart_name = chart_ref.split("/")[-1]
+    # Remove any query parameters or fragments from URL-based refs
+    if "?" in chart_name:
+        chart_name = chart_name.split("?")[0]
+    if "#" in chart_name:
+        chart_name = chart_name.split("#")[0]
+    # Remove .tgz extension if present
+    if chart_name.endswith(".tgz"):
+        chart_name = chart_name[:-4]
+    return chart_name
+
+
+def chart_exists(destination, chart_ref, chart_version, untar_chart):
+    """
+    Check if the chart already exists in the destination directory.
+
+    For untarred charts: check if directory exists with Chart.yaml matching version
+    For tarred charts: check if .tgz file exists and contains matching version
+
+    Args:
+        destination (str): Destination directory path
+        chart_ref (str): Chart reference (name or URL)
+        chart_version (str): Chart version to check for
+        untar_chart (bool): Whether to check for untarred or tarred chart
+
+    Returns:
+        bool: True if chart with matching version exists, False otherwise
+    """
+    # YAML is required for version checking
+    if not HAS_YAML:
+        return False
+
+    # Without version, we can't reliably check
+    if not chart_version:
+        return False
+
+    # Extract chart name from chart_ref using shared helper
+    chart_name = extract_chart_name(chart_ref)
+
+    if untar_chart:
+        # Check for extracted directory
+        chart_dir = os.path.join(destination, chart_name)
+        chart_yaml_path = os.path.join(chart_dir, "Chart.yaml")
+
+        if os.path.isdir(chart_dir) and os.path.isfile(chart_yaml_path):
+            try:
+                with open(chart_yaml_path, "r", encoding="utf-8") as chart_file:
+                    chart_metadata = yaml.safe_load(chart_file)
+                    # Ensure chart_metadata is a dict and has a version that matches
+                    if (
+                        chart_metadata
+                        and isinstance(chart_metadata, dict)
+                        and chart_metadata.get("version") == chart_version
+                        and chart_metadata.get("name") == chart_name
+                    ):
+                        return True
+            except (yaml.YAMLError, IOError, OSError, TypeError):
+                # If we can't read or parse the file, treat as non-existent
+                pass
+    else:
+        # Check for .tgz file
+        chart_file = os.path.join(destination, f"{chart_name}-{chart_version}.tgz")
+
+        if os.path.isfile(chart_file):
+            try:
+                # Verify it's a valid tarball with matching version
+                with tarfile.open(chart_file, "r:gz") as tar:
+                    # Try to extract Chart.yaml to verify version
+                    # Look for Chart.yaml at the expected path: <chart-name>/Chart.yaml
+                    expected_chart_yaml = f"{chart_name}/Chart.yaml"
+                    try:
+                        member = tar.getmember(expected_chart_yaml)
+                        chart_yaml_file = tar.extractfile(member)
+                        if chart_yaml_file:
+                            try:
+                                chart_metadata = yaml.safe_load(chart_yaml_file)
+                                # Ensure chart_metadata is a dict and has a version that matches
+                                if (
+                                    chart_metadata
+                                    and isinstance(chart_metadata, dict)
+                                    and chart_metadata.get("version") == chart_version
+                                    and chart_metadata.get("name") == chart_name
+                                ):
+                                    return True
+                            except (yaml.YAMLError, TypeError):
+                                # If we can't parse the YAML, treat as non-existent
+                                pass
+                            finally:
+                                chart_yaml_file.close()
+                    except KeyError:
+                        # Chart.yaml not found at expected path
+                        pass
+            except (tarfile.TarError, yaml.YAMLError, IOError, OSError, TypeError):
+                # If we can't read or parse the tarball, treat as non-existent
+                pass
+
+    return False
+
+
 def main():
     argspec = dict(
         chart_ref=dict(type="str", required=True),
@@ -189,10 +341,13 @@ def main():
         repo_password=dict(
             type="str", no_log=True, aliases=["password", "chart_repo_password"]
         ),
-        pass_credentials=dict(type="bool", default=False),
-        skip_tls_certs_check=dict(type="bool", default=False),
+        pass_credentials=dict(type="bool", default=False, no_log=False),
+        skip_tls_certs_check=dict(
+            type="bool", default=False, aliases=["insecure_skip_tls_verify"]
+        ),
         chart_devel=dict(type="bool"),
         untar_chart=dict(type="bool", default=False),
+        force=dict(type="bool", default=False),
         destination=dict(type="path", required=True),
         chart_ca_cert=dict(type="path"),
         chart_ssl_cert_file=dict(type="path"),
@@ -209,13 +364,10 @@ def main():
         mutually_exclusive=[("chart_version", "chart_devel")],
     )
 
+    # Validate Helm version >=3.0.0,<4.0.0
+    module.validate_helm_version()
+
     helm_version = module.get_helm_version()
-    if LooseVersion(helm_version) < LooseVersion("3.0.0"):
-        module.fail_json(
-            msg="This module requires helm >= 3.0.0, current version is {0}".format(
-                helm_version
-            )
-        )
 
     helm_pull_opt_versionning = dict(
         skip_tls_certs_check="3.3.0",
@@ -273,8 +425,72 @@ def main():
         module.params.get("chart_ref"),
         " ".join(helm_pull_opts),
     )
+
+    # Check if chart already exists (idempotency)
+    if module.params.get("chart_version") and not module.params.get("force"):
+        chart_exists_locally = chart_exists(
+            module.params.get("destination"),
+            module.params.get("chart_ref"),
+            module.params.get("chart_version"),
+            module.params.get("untar_chart"),
+        )
+
+        if chart_exists_locally:
+            module.exit_json(
+                failed=False,
+                changed=False,
+                msg="Chart {0} version {1} already exists in destination directory".format(
+                    module.params.get("chart_ref"), module.params.get("chart_version")
+                ),
+                command="",
+                stdout="",
+                stderr="",
+                rc=0,
+            )
+
+    # When both untar_chart and force are enabled, we need to remove the existing chart directory
+    # BEFORE running helm pull to prevent helm's "directory already exists" error.
+    # We do this by:
+    # 1. Renaming the existing directory to a temporary name (if it exists)
+    # 2. Running helm pull
+    # 3. On success: remove the temporary directory
+    # 4. On failure: restore the temporary directory and report the error
+    chart_dir_renamed = False
+    chart_dir = None
+    chart_dir_backup = None
+
+    if module.params.get("untar_chart") and module.params.get("force"):
+        chart_name = extract_chart_name(module.params.get("chart_ref"))
+        chart_dir = os.path.join(module.params.get("destination"), chart_name)
+
+        # Check if directory exists and contains a Chart.yaml (to be safe)
+        if os.path.isdir(chart_dir):
+            chart_yaml_path = os.path.join(chart_dir, "Chart.yaml")
+            # Only rename if it looks like a Helm chart directory (have Chart.yaml)
+            if os.path.isfile(chart_yaml_path):
+                if not module.check_mode:
+                    # Rename to temporary backup name using uuid for uniqueness
+                    backup_suffix = uuid.uuid4().hex[:8]
+                    chart_dir_backup = os.path.join(
+                        module.params.get("destination"),
+                        f".{chart_name}_backup_{backup_suffix}",
+                    )
+                    os.rename(chart_dir, chart_dir_backup)
+                    chart_dir_renamed = True
+
     if not module.check_mode:
         rc, out, err = module.run_helm_command(helm_cmd_common, fails_on_error=False)
+
+        # Handle cleanup/restore based on helm command result
+        if chart_dir_renamed:
+            if rc == 0:
+                # Success: remove the backup directory
+                if os.path.isdir(chart_dir_backup):
+                    shutil.rmtree(chart_dir_backup)
+            else:
+                # Failure: restore the backup directory
+                if os.path.isdir(chart_dir_backup) and not os.path.exists(chart_dir):
+                    os.rename(chart_dir_backup, chart_dir)
     else:
         rc, out, err = (0, "", "")
 

plugins/modules/helm_registry_auth.py

@@ -0,0 +1,252 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Copyright: © Ericsson AB 2024
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+
+DOCUMENTATION = r"""
+---
+module: helm_registry_auth
+
+short_description: Helm registry authentication module
+
+version_added: 5.1.0
+
+author:
+  - Yuriy Novostavskiy (@yurnov)
+
+requirements:
+  - "helm (https://github.com/helm/helm/releases) >= 3.8.0, <4.0.0"
+
+description:
+  -  Helm registry authentication module allows you to login C(helm registry login) and logout C(helm registry logout) from a Helm registry.
+
+options:
+  state:
+    description:
+      - Desired state of the registry.
+      - If set to V(present) attempt to log in to the remote registry server using the URL specified in O(host).
+      - If set to V(absent) attempt to log out from the remote registry server using the URL specified in O(host).
+      - As helm >= 3.18.0 reports successful logout even if the user is not logged in, this module will report a change regardless of the current state.
+    required: false
+    default: present
+    choices: ['present', 'absent']
+    type: str
+  host:
+    description:
+      - Provide a URL for accessing the registry.
+    required: true
+    aliases: [ registry_url ]
+    type: str
+  insecure:
+    description:
+      - Allow connections to SSL sites without certs.
+    required: false
+    default: false
+    type: bool
+  username:
+    description:
+      - Username for the registry.
+    required: false
+    type: str
+    aliases: [ repo_username ]
+  password:
+    description:
+      - Password for the registry.
+    required: false
+    type: str
+    aliases: [ repo_password ]
+  key_file:
+    description:
+      - Path to the client key SSL file for identify registry client using this key file.
+    required: false
+    type: path
+  cert_file:
+    description:
+      - Path to the client certificate SSL file for identify registry client using this certificate file.
+    required: false
+    type: path
+  ca_file:
+    description:
+      - Path to the CA certificate SSL file for verify registry server certificate.
+    required: false
+    type: path
+  binary_path:
+    description:
+      - The path of a helm binary to use.
+    required: false
+    type: path
+"""
+
+EXAMPLES = r"""
+- name: Login to remote registry
+  kubernetes.core.helm_registry_auth:
+    username: admin
+    password: "sample_password"
+    host: localhost:5000
+
+- name: Logout from remote registry
+  kubernetes.core.helm_registry_auth:
+    state: absent
+    host: localhost:5000
+"""
+
+RETURN = r"""
+stdout:
+  type: str
+  description: Full C(helm) command stdout, in case you want to display it or examine the event log
+  returned: always
+stout_lines:
+  type: list
+  description: Full C(helm) command stdout, in case you want to display it or examine the event log
+  returned: always
+stderr:
+  type: str
+  description: >-
+    Full C(helm) command stderr, in case you want to display it or examine the event log.
+    Please be note that helm binnary may print messages to stderr even if the command is successful.
+  returned: always
+  sample: 'Login Succeeded\n'
+stderr_lines:
+  type: list
+  description: Full C(helm) command stderr, in case you want to display it or examine the event log
+  returned: always
+command:
+  type: str
+  description: Full C(helm) command executed
+  returned: always
+  sample: '/usr/local/bin/helm registry login oci-registry.domain.example --username=admin --password-stdin --insecure'
+failed:
+  type: bool
+  description: Indicate if the C(helm) command failed
+  returned: always
+  sample: false
+"""
+
+from ansible_collections.kubernetes.core.plugins.module_utils.helm import (
+    AnsibleHelmModule,
+)
+from ansible_collections.kubernetes.core.plugins.module_utils.version import (
+    LooseVersion,
+)
+
+
+def arg_spec():
+    return dict(
+        binary_path=dict(type="path", required=False),
+        host=dict(type="str", aliases=["registry_url"], required=True),
+        state=dict(default="present", choices=["present", "absent"], required=False),
+        insecure=dict(type="bool", default=False, required=False),
+        username=dict(type="str", aliases=["repo_username"], required=False),
+        password=dict(
+            type="str", aliases=["repo_password"], no_log=True, required=False
+        ),
+        key_file=dict(type="path", required=False),
+        cert_file=dict(type="path", required=False),
+        ca_file=dict(type="path", required=False),
+    )
+
+
+def login(
+    command,
+    host,
+    insecure,
+    username,
+    password,
+    key_file,
+    cert_file,
+    ca_file,
+):
+    login_command = command + " registry login " + host
+
+    if username is not None and password is not None:
+        login_command += " --username=" + username + " --password-stdin"
+
+    if insecure:
+        login_command += " --insecure"
+
+    if key_file is not None:
+        login_command += " --key-file=" + key_file
+
+    if cert_file is not None:
+        login_command += " --cert-file=" + cert_file
+
+    if ca_file is not None:
+        login_command += " --ca-file=" + ca_file
+
+    return login_command
+
+
+def logout(command, host):
+    return command + " registry logout " + host
+
+
+def main():
+    global module
+
+    module = AnsibleHelmModule(
+        argument_spec=arg_spec(),
+        required_together=[["username", "password"]],
+        supports_check_mode=True,
+    )
+
+    # Validate Helm version >=3.0.0,<4.0.0
+    module.validate_helm_version()
+
+    changed = False
+
+    host = module.params.get("host")
+    state = module.params.get("state")
+    insecure = module.params.get("insecure")
+    username = module.params.get("username")
+    password = module.params.get("password")
+    key_file = module.params.get("key_file")
+    cert_file = module.params.get("cert_file")
+    ca_file = module.params.get("ca_file")
+
+    helm_cmd = module.get_helm_binary()
+
+    if state == "absent":
+        helm_cmd = logout(helm_cmd, host)
+        changed = True
+    elif state == "present":
+        helm_cmd = login(
+            helm_cmd, host, insecure, username, password, key_file, cert_file, ca_file
+        )
+        changed = True
+
+    if module.check_mode:
+        module.exit_json(changed=changed, command=helm_cmd)
+
+    rc, out, err = module.run_helm_command(
+        helm_cmd, data=password, fails_on_error=False
+    )
+
+    if rc != 0:
+        if state == "absent" and "Error: not logged in" in err:
+            changed = False
+        else:
+            module.fail_json(
+                msg="Failure when executing Helm command. Exited {0}.\nstdout: {1}\nstderr: {2}".format(
+                    rc, out, err
+                ),
+                stderr=err,
+                command=helm_cmd,
+            )
+
+    helm_version = module.get_helm_version()
+    if LooseVersion(helm_version) >= LooseVersion("3.18.0") and state == "absent":
+        # https://github.com/ansible-collections/kubernetes.core/issues/944
+        module.warn(
+            "The helm_registry_auth is not idempotent with helm >= 3.18.0, always report a change."
+        )
+
+    module.exit_json(changed=changed, stdout=out, stderr=err, command=helm_cmd)
+
+
+if __name__ == "__main__":
+    main()

plugins/modules/helm_repository.py

@@ -14,7 +14,7 @@ module: helm_repository
 
 short_description: Manage Helm repositories.
 
-version_added: "0.11.0"
+version_added: 0.11.0
 
 author:
   - Lucas Boisserie (@LucasBoisserie)
@@ -76,12 +76,12 @@ options:
     description:
     - Provide a URL for accessing the API. Can also be specified via C(K8S_AUTH_HOST) environment variable.
     type: str
-    version_added: "2.3.0"
+    version_added: 2.3.0
   api_key:
     description:
     - Token used to authenticate with the API. Can also be specified via C(K8S_AUTH_API_KEY) environment variable.
     type: str
-    version_added: "2.3.0"
+    version_added: 2.3.0
   validate_certs:
     description:
     - Whether or not to verify the API server's SSL certificates. Can also be specified via C(K8S_AUTH_VERIFY_SSL)
@@ -89,21 +89,21 @@ options:
     type: bool
     aliases: [ verify_ssl ]
     default: True
-    version_added: "2.3.0"
+    version_added: 2.3.0
   ca_cert:
     description:
     - Path to a CA certificate used to authenticate with the API. The full certificate chain must be provided to
       avoid certificate validation errors. Can also be specified via C(K8S_AUTH_SSL_CA_CERT) environment variable.
     type: path
     aliases: [ ssl_ca_cert ]
-    version_added: "2.3.0"
+    version_added: 2.3.0
   context:
     description:
       - Helm option to specify which kubeconfig context to use.
       - If the value is not specified in the task, the value of environment variable C(K8S_AUTH_CONTEXT) will be used instead.
     type: str
     aliases: [ kube_context ]
-    version_added: "2.4.0"
+    version_added: 2.4.0
   kubeconfig:
     description:
       - Helm option to specify kubeconfig path to use.
@@ -111,14 +111,21 @@ options:
       - The configuration can be provided as dictionary.
     type: raw
     aliases: [ kubeconfig_path ]
-    version_added: "2.4.0"
+    version_added: 2.4.0
   force_update:
     description:
     - Whether or not to replace (overwrite) the repo if it already exists.
     type: bool
     aliases: [ force ]
     default: False
-    version_added: "2.4.0"
+    version_added: 2.4.0
+  insecure_skip_tls_verify:
+    description:
+      - Skip tls certificate checks for the repository url.
+    type: bool
+    default: False
+    aliases: [ skip_tls_certs_check ]
+    version_added: "5.3.0"
 """
 
 EXAMPLES = r"""
@@ -226,6 +233,7 @@ def install_repository(
     repository_password,
     pass_credentials,
     force_update,
+    insecure_skip_tls_verify,
 ):
     install_command = command + " repo add " + repository_name + " " + repository_url
 
@@ -239,6 +247,9 @@ def install_repository(
     if force_update:
         install_command += " --force-update"
 
+    if insecure_skip_tls_verify:
+        install_command += " --insecure-skip-tls-verify"
+
     return install_command
 
 
@@ -262,6 +273,9 @@ def argument_spec():
             ),
             pass_credentials=dict(type="bool", default=False, no_log=True),
             force_update=dict(type="bool", default=False, aliases=["force"]),
+            insecure_skip_tls_verify=dict(
+                type="bool", default=False, aliases=["skip_tls_certs_check"]
+            ),
         )
     )
     return arg_spec
@@ -281,6 +295,9 @@ def main():
     if not IMP_YAML:
         module.fail_json(msg=missing_required_lib("yaml"), exception=IMP_YAML_ERR)
 
+    # Validate Helm version >=3.0.0,<4.0.0
+    module.validate_helm_version()
+
     changed = False
 
     repo_name = module.params.get("repo_name")
@@ -290,6 +307,7 @@ def main():
     repo_state = module.params.get("repo_state")
     pass_credentials = module.params.get("pass_credentials")
     force_update = module.params.get("force_update")
+    insecure_skip_tls_verify = module.params.get("insecure_skip_tls_verify")
 
     helm_cmd = module.get_helm_binary()
 
@@ -308,6 +326,7 @@ def main():
                 repo_password,
                 pass_credentials,
                 force_update,
+                insecure_skip_tls_verify,
             )
             changed = True
         elif repository_status["url"] != repo_url:

plugins/modules/helm_template.py

@@ -53,7 +53,7 @@ options:
     default: false
     type: bool
     aliases: [ dep_up ]
-    version_added: "2.4.0"
+    version_added: 2.4.0
   disable_hook:
     description:
       - Prevent hooks from running during install.
@@ -72,6 +72,13 @@ options:
       - If the directory already exists, it will be overwritten.
     required: false
     type: path
+  insecure_registry:
+    description:
+      - Skip TLS certificate checks for the chart download
+    required: false
+    type: bool
+    default: false
+    version_added: 5.1.0
   release_name:
     description:
       - Release name to use in rendered templates.
@@ -139,7 +146,7 @@ options:
           - string
           - json
           - file
-    version_added: '2.4.0'
+    version_added: 2.4.0
 """
 
 EXAMPLES = r"""
@@ -221,6 +228,7 @@ def template(
     dependency_update=None,
     disable_hook=None,
     output_dir=None,
+    insecure_registry=None,
     show_only=None,
     release_name=None,
     release_namespace=None,
@@ -251,6 +259,9 @@ def template(
     if output_dir:
         cmd += " --output-dir=" + output_dir
 
+    if insecure_registry:
+        cmd += " --insecure-skip-tls-verify"
+
     if show_only:
         for template in show_only:
             cmd += " -s " + template
@@ -289,6 +300,7 @@ def main():
             include_crds=dict(type="bool", default=False),
             release_name=dict(type="str", aliases=["name"]),
             output_dir=dict(type="path"),
+            insecure_registry=dict(type="bool", default=False),
             release_namespace=dict(type="str"),
             release_values=dict(type="dict", default={}, aliases=["values"]),
             show_only=dict(type="list", default=[], elements="str"),
@@ -308,6 +320,7 @@ def main():
     include_crds = module.params.get("include_crds")
     release_name = module.params.get("release_name")
     output_dir = module.params.get("output_dir")
+    insecure_registry = module.params.get("insecure_registry")
     show_only = module.params.get("show_only")
     release_namespace = module.params.get("release_namespace")
     release_values = module.params.get("release_values")
@@ -318,6 +331,9 @@ def main():
     if not IMP_YAML:
         module.fail_json(msg=missing_required_lib("yaml"), exception=IMP_YAML_ERR)
 
+    # Validate Helm version >=3.0.0,<4.0.0
+    module.validate_helm_version()
+
     helm_cmd = module.get_helm_binary()
 
     if update_repo_cache:
@@ -337,6 +353,7 @@ def main():
         disable_hook=disable_hook,
         release_name=release_name,
         output_dir=output_dir,
+        insecure_registry=insecure_registry,
         release_namespace=release_namespace,
         release_values=release_values,
         show_only=show_only,

plugins/modules/k8s.py

@@ -57,15 +57,14 @@ options:
     - Whether to override the default patch merge approach with a specific type. By default, the strategic
       merge will typically be used.
     - For example, Custom Resource Definitions typically aren't updatable by the usual strategic merge. You may
-      want to use C(merge) if you see "strategic merge patch format is not supported"
+      want to use C(merge) if you see "strategic merge patch format is not supported".
     - See U(https://kubernetes.io/docs/tasks/run-application/update-api-object-kubectl-patch/#use-a-json-merge-patch-to-update-a-deployment)
     - If more than one C(merge_type) is given, the merge_types will be tried in order. This defaults to
       C(['strategic-merge', 'merge']), which is ideal for using the same parameters on resource kinds that
       combine Custom Resources and built-in resources.
-    - mutually exclusive with C(apply)
-    - I(merge_type=json) is deprecated and will be removed in version 3.0.0. Please use M(kubernetes.core.k8s_json_patch) instead.
+    - Mutually exclusive with C(apply).
+    - I(merge_type=json) has been removed in version 4.0.0. Please use M(kubernetes.core.k8s_json_patch) instead.
     choices:
-    - json
     - merge
     - strategic-merge
     type: list
@@ -101,7 +100,7 @@ options:
     - C(apply) compares the desired resource definition with the previously supplied resource definition,
       ignoring properties that are automatically generated
     - C(apply) works better with Services than 'force=yes'
-    - mutually exclusive with C(merge_type)
+    - Mutually exclusive with C(merge_type).
     default: False
     type: bool
   template:
@@ -182,17 +181,18 @@ options:
     - This parameter can be used with C(label_selectors) to restrict the resources to be deleted.
     type: bool
     default: false
-    version_added: 2.5.0
+    version_added: 3.0.0
     aliases:
     - all
   hidden_fields:
     description:
       - Hide fields matching this option in the result
       - An example might be C(hidden_fields=[metadata.managedFields])
-      - Only field definitions that don't reference list items are supported (so V(spec.containers[0]) would not work)
+        or V(hidden_fields=[spec.containers[0].env[3].value])
+        or V(hidden_fields=[metadata.annotations[kubectl.kubernetes.io/last-applied-configuration]])
     type: list
     elements: str
-    version_added: 2.5.0
+    version_added: 3.0.0
 
 requirements:
   - "python >= 3.9"
@@ -383,28 +383,24 @@ result:
   contains:
      api_version:
        description: The versioned schema of this representation of an object.
-       returned: success
+       returned: when O(resource_definition) or O(src) contains a single object.
        type: str
      kind:
        description: Represents the REST resource this object represents.
-       returned: success
+       returned: when O(resource_definition) or O(src) contains a single object.
        type: str
      metadata:
        description: Standard object metadata. Includes name, namespace, annotations, labels, etc.
-       returned: success
+       returned: when O(resource_definition) or O(src) contains a single object.
        type: complex
      spec:
        description: Specific attributes of the object. Will vary based on the I(api_version) and I(kind).
-       returned: success
+       returned: when O(resource_definition) or O(src) contains a single object.
        type: complex
      status:
        description: Current status details for the object.
-       returned: success
+       returned: when O(resource_definition) or O(src) contains a single object.
        type: complex
-     items:
-       description: Returned only when multiple yaml documents are passed to src or resource_definition
-       returned: when resource_definition or src contains list of objects
-       type: list
      duration:
        description: elapsed time of task in seconds
        returned: when C(wait) is true
@@ -414,6 +410,46 @@ result:
        description: error while trying to create/delete the object.
        returned: error
        type: complex
+     results:
+       description: An array of created, patched, or otherwise present objects.
+       returned: when O(resource_definition) or O(src) contains a list of objects.
+       type: complex
+       contains:
+         api_version:
+           description: The versioned schema of this representation of an object.
+           returned: when O(resource_definition) or O(src) contains a single object.
+           type: str
+         kind:
+           description: Represents the REST resource this object represents.
+           returned: when O(resource_definition) or O(src) contains a single object.
+           type: str
+         metadata:
+           description: Standard object metadata. Includes name, namespace, annotations, labels, etc.
+           returned: when O(resource_definition) or O(src) contains a single object.
+           type: complex
+         spec:
+           description: Specific attributes of the object. Will vary based on the I(api_version) and I(kind).
+           returned: when O(resource_definition) or O(src) contains a single object.
+           type: complex
+         status:
+           description: Current status details for the object.
+           returned: when O(resource_definition) or O(src) contains a single object.
+           type: complex
+         duration:
+           description: elapsed time of task in seconds
+           returned: when C(wait) is true
+           type: int
+           sample: 48
+         error:
+           description: error while trying to create/delete the object.
+           returned: error
+           type: complex
+method:
+  description:
+  - The method used to deploy the resource.
+  returned: success
+  type: str
+  sample: create
 """
 
 import copy
@@ -460,7 +496,7 @@ def argspec():
     argument_spec.update(copy.deepcopy(AUTH_ARG_SPEC))
     argument_spec.update(copy.deepcopy(WAIT_ARG_SPEC))
     argument_spec["merge_type"] = dict(
-        type="list", elements="str", choices=["json", "merge", "strategic-merge"]
+        type="list", elements="str", choices=["merge", "strategic-merge"]
     )
     argument_spec["validate"] = dict(type="dict", default=None, options=validate_spec())
     argument_spec["append_hash"] = dict(type="bool", default=False)

plugins/modules/k8s_cluster_info.py

@@ -11,7 +11,7 @@ __metaclass__ = type
 DOCUMENTATION = r"""
 module: k8s_cluster_info
 
-version_added: "0.11.1"
+version_added: 0.11.1
 
 short_description: Describe Kubernetes (K8s) cluster, APIs available and their respective versions
 

plugins/modules/k8s_cp.py

@@ -14,7 +14,7 @@ module: k8s_cp
 
 short_description: Copy files and directories to and from pod.
 
-version_added: "2.2.0"
+version_added: 2.2.0
 
 author:
     - Aubin Bikouo (@abikouo)
@@ -79,6 +79,7 @@ options:
 
 notes:
     - the tar binary is required on the container when copying from local filesystem to pod.
+    - the (init) container has to be started before you copy files or directories to it.
 """
 
 EXAMPLES = r"""

plugins/modules/k8s_drain.py

@@ -15,7 +15,7 @@ module: k8s_drain
 
 short_description: Drain, Cordon, or Uncordon node in k8s cluster
 
-version_added: "2.2.0"
+version_added: 2.2.0
 
 author: Aubin Bikouo (@abikouo)
 
@@ -47,7 +47,7 @@ options:
       - This option has effect only when C(state) is set to I(drain).
     type: list
     elements: str
-    version_added: 2.5.0
+    version_added: 3.0.0
     aliases:
     - label_selectors
   delete_options:
@@ -106,7 +106,8 @@ EXAMPLES = r"""
   kubernetes.core.k8s_drain:
     state: drain
     name: foo
-    force: yes
+    delete_options:
+      force: yes
 
 - name: Drain node "foo", but abort if there are pods not managed by a ReplicationController, Job, or DaemonSet, and use a grace period of 15 minutes.
   kubernetes.core.k8s_drain:
@@ -143,6 +144,7 @@ result:
 """
 
 import copy
+import json
 import time
 import traceback
 from datetime import datetime
@@ -187,6 +189,17 @@ except ImportError:
         HAS_EVICTION_API = False
 
 
+def format_dynamic_api_exc(exc):
+    if exc.body:
+        if exc.headers and exc.headers.get("Content-Type") == "application/json":
+            message = json.loads(exc.body).get("message")
+            if message:
+                return message
+        return exc.body
+    else:
+        return "%s Reason: %s" % (exc.status, exc.reason)
+
+
 def filter_pods(pods, force, ignore_daemonset, delete_emptydir_data):
     k8s_kind_mirror = "kubernetes.io/config.mirror"
     daemonSet, unmanaged, mirror, localStorage, to_delete = [], [], [], [], []
@@ -291,16 +304,19 @@ class K8sDrainAnsible(object):
             return (datetime.now() - start).seconds
 
         response = None
-        pod = pods.pop()
+        pod = None
         while (_elapsed_time() < wait_timeout or wait_timeout == 0) and pods:
             if not pod:
-                pod = pods.pop()
+                pod = pods[-1]
             try:
                 response = self._api_instance.read_namespaced_pod(
                     namespace=pod[0], name=pod[1]
                 )
-                if not response:
+                if not response or response.spec.node_name != self._module.params.get(
+                    "name"
+                ):
                     pod = None
+                    del pods[-1]
                 time.sleep(wait_sleep)
             except ApiException as exc:
                 if exc.reason != "Not Found":
@@ -308,6 +324,7 @@ class K8sDrainAnsible(object):
                         msg="Exception raised: {0}".format(exc.reason)
                     )
                 pod = None
+                del pods[-1]
             except Exception as e:
                 self._module.fail_json(msg="Exception raised: {0}".format(to_native(e)))
         if not pods:
@@ -334,7 +351,7 @@ class K8sDrainAnsible(object):
                 if exc.reason != "Not Found":
                     self._module.fail_json(
                         msg="Failed to delete pod {0}/{1} due to: {2}".format(
-                            namespace, name, exc.reason
+                            namespace, name, to_native(format_dynamic_api_exc(exc))
                         )
                     )
             except Exception as exc:
@@ -424,7 +441,8 @@ class K8sDrainAnsible(object):
                     warnings.append(warn)
             result.append("{0} Pod(s) deleted from node.".format(number_pod))
         if warnings:
-            return dict(result=" ".join(result), warnings=warnings)
+            for warning in warnings:
+                self._module.warn(warning)
         return dict(result=" ".join(result))
 
     def patch_node(self, unschedulable):

plugins/modules/k8s_exec.py

@@ -15,7 +15,7 @@ module: k8s_exec
 
 short_description: Execute command in Pod
 
-version_added: "0.10.0"
+version_added: 0.10.0
 
 author: "Tristan de Cacqueray (@tristanC)"
 
@@ -135,7 +135,7 @@ from ansible.module_utils._text import to_native
 from ansible_collections.kubernetes.core.plugins.module_utils.ansiblemodule import (
     AnsibleModule,
 )
-from ansible_collections.kubernetes.core.plugins.module_utils.common import (
+from ansible_collections.kubernetes.core.plugins.module_utils.args_common import (
     AUTH_ARG_SPEC,
 )
 from ansible_collections.kubernetes.core.plugins.module_utils.k8s.client import (
@@ -219,12 +219,6 @@ def execute_module(module, client):
     else:
         rc = int(err["details"]["causes"][0]["message"])
 
-    module.deprecate(
-        "The 'return_code' return key is being renamed to 'rc'. "
-        "Both keys are being returned for now to allow users to migrate their automation.",
-        version="4.0.0",
-        collection_name="kubernetes.core",
-    )
     module.exit_json(
         # Some command might change environment, but ultimately failing at end
         changed=True,

plugins/modules/k8s_info.py

@@ -48,10 +48,11 @@ options:
     description:
       - Hide fields matching any of the field definitions in the result
       - An example might be C(hidden_fields=[metadata.managedFields])
-      - Only field definitions that don't reference list items are supported (so V(spec.containers[0]) would not work)
+        or V(hidden_fields=[spec.containers[0].env[3].value])
+        or V(hidden_fields=[metadata.annotations[kubectl.kubernetes.io/last-applied-configuration]])
     type: list
     elements: str
-    version_added: 2.5.0
+    version_added: 3.0.0
 
 extends_documentation_fragment:
   - kubernetes.core.k8s_auth_options

plugins/modules/k8s_log.py

@@ -14,7 +14,7 @@ module: k8s_log
 
 short_description: Fetch logs from Kubernetes resources
 
-version_added: "0.10.0"
+version_added: 0.10.0
 
 author:
     - "Fabian von Feilitzsch (@fabianvf)"
@@ -61,26 +61,26 @@ options:
     - A relative time in seconds before the current time from which to show logs.
     required: no
     type: str
-    version_added: '2.2.0'
+    version_added: 2.2.0
   previous:
     description:
     - If C(true), print the logs for the previous instance of the container in a pod if it exists.
     required: no
     type: bool
     default: False
-    version_added: '2.4.0'
+    version_added: 2.4.0
   tail_lines:
     description:
     - A number of lines from the end of the logs to retrieve.
     required: no
     type: int
-    version_added: '2.4.0'
+    version_added: 2.4.0
   all_containers:
     description:
     - If set to C(true), retrieve all containers' logs in the pod(s).
     - mutually exclusive with C(container).
     type: bool
-    version_added: '2.4.0'
+    version_added: 2.4.0
 
 requirements:
   - "python >= 3.9"

plugins/modules/k8s_rollback.py

@@ -12,7 +12,7 @@ __metaclass__ = type
 DOCUMENTATION = r"""
 module: k8s_rollback
 short_description: Rollback Kubernetes (K8S) Deployments and DaemonSets
-version_added: "1.0.0"
+version_added: 1.0.0
 author:
     - "Julien Huon (@julienhuon)"
 description:
@@ -168,7 +168,9 @@ def perform_action(svc, resource):
             module.params["kind"],
             resource["metadata"]["name"],
         )
-        result = {"changed": False, "warnings": [warn]}
+        if warn:
+            module.warn(warn)
+        result = {"changed": False}
         return result
 
     if module.params["kind"] == "Deployment":

plugins/modules/k8s_scale.py

@@ -243,10 +243,12 @@ def execute_module(client, module):
             module.fail_json(msg=error, **return_attributes)
 
     def _continue_or_exit(warn):
+        if warn:
+            module.warn(warn)
         if multiple_scale:
-            return_attributes["results"].append({"warning": warn, "changed": False})
+            return_attributes["results"].append({"changed": False})
         else:
-            module.exit_json(warning=warn, **return_attributes)
+            module.exit_json(**return_attributes)
 
     for existing in existing_items:
         if kind.lower() == "job":

plugins/modules/k8s_taint.py

@@ -13,7 +13,7 @@ __metaclass__ = type
 DOCUMENTATION = r"""
 module: k8s_taint
 short_description: Taint a node in a Kubernetes/OpenShift cluster
-version_added: "2.3.0"
+version_added: 2.3.0
 author: Alina Buzachis (@alinabuzachis)
 description:
     - Taint allows a node to refuse Pod to be scheduled unless that Pod has a matching toleration.

tests/integration/targets/helm/defaults/main.yml

@@ -3,6 +3,7 @@ helm_default_archive_name: "helm-{{ helm_version }}-{{ ansible_system | lower }}
 helm_binary: "/tmp/helm/{{ ansible_system | lower }}-amd64/helm"
 
 chart_test: "ingress-nginx"
+chart_test_oci: "oci://registry-1.docker.io/bitnamicharts/redis"
 chart_test_local_path: "nginx-ingress"
 chart_test_version: 4.2.4
 chart_test_version_local_path: 1.32.0
@@ -26,3 +27,5 @@ test_namespace:
   - "helm-from-url"
   - "helm-reuse-values"
   - "helm-chart-with-space-into-name"
+  - "helm-reset-then-reuse-values"
+  - "helm-insecure"

tests/integration/targets/helm/tasks/main.yml

@@ -4,4 +4,7 @@
   loop_control:
     loop_var: helm_version
   with_items:
-    - "v3.7.0"
+    - "v3.15.4"
+    - "v3.16.0"
+    - "v3.17.0"
+    - "v4.0.0"

tests/integration/targets/helm/tasks/run_test.yml

@@ -13,33 +13,47 @@
   include_role:
     name: install_helm
 
-- name: "Ensure we honor the environment variables"
-  include_tasks: test_read_envvars.yml
+- name: Main helm tests with Helm v3
+  when: helm_version != "v4.0.0"
+  block:
 
-- name: Deploy charts
-  include_tasks: "tests_chart/{{ test_chart_type }}.yml"
-  loop_control:
-    loop_var: test_chart_type
-  with_items:
-    - from_local_path
-    - from_repository
-    - from_url
+    - name: "Ensure we honor the environment variables"
+      include_tasks: test_read_envvars.yml
+      when: helm_version != "v4.0.0"
 
-- name: test helm upgrade with reuse_values
-  include_tasks: test_helm_reuse_values.yml
+    - name: Deploy charts
+      include_tasks: "tests_chart/{{ test_chart_type }}.yml"
+      loop_control:
+        loop_var: test_chart_type
+      with_items:
+        - from_local_path
+        - from_repository
+        - from_url
 
-- name: test helm dependency update
-  include_tasks: test_up_dep.yml
+    - name: test helm upgrade with reuse_values
+      include_tasks: test_helm_reuse_values.yml
 
-- name: Test helm uninstall
-  include_tasks: test_helm_uninstall.yml
+    - name: test helm upgrade with reset_then_reuse_values
+      include_tasks: test_helm_reset_then_reuse_values.yml
 
-- name: Test helm install with chart name containing space
-  include_tasks: test_helm_with_space_into_chart_name.yml
+    - name: test helm dependency update
+      include_tasks: test_up_dep.yml
 
-# https://github.com/ansible-collections/community.kubernetes/issues/296
-- name: Test Skip CRDS feature in helm chart install
-  include_tasks: test_crds.yml
+    - name: Test helm uninstall
+      include_tasks: test_helm_uninstall.yml
+
+    - name: Test helm install with chart name containing space
+      include_tasks: test_helm_with_space_into_chart_name.yml
+
+    # https://github.com/ansible-collections/community.kubernetes/issues/296
+    - name: Test Skip CRDS feature in helm chart install
+      include_tasks: test_crds.yml
+
+    - name: Test insecure registry flag feature
+      include_tasks: test_helm_insecure.yml
+
+- name: Test helm version
+  include_tasks: test_helm_version.yml
 
 - name: Clean helm install
   file:

tests/integration/targets/helm/tasks/test_crds.yml

@@ -3,78 +3,89 @@
   vars:
     test_chart: "test-crds"
     helm_namespace: "{{ test_namespace[0] }}"
+    helm_binary: helm
   block:
     - name: Create namespace
       k8s:
         kind: Namespace
         name: "{{ helm_namespace }}"
 
-    - name: Copy test chart
-      copy:
-        src: "{{ test_chart }}"
-        dest: "/tmp/helm_test_crds/"
-
-    - name: Install chart while skipping CRDs
-      helm:
-        binary_path: "{{ helm_binary }}"
-        chart_ref: "/tmp/helm_test_crds/{{ test_chart }}"
-        namespace: "{{ helm_namespace }}"
-        name: test-crds
-        skip_crds: true
-      register: install
-
-    - assert:
-        that:
-          - install is changed
-          - install.status.name == "test-crds"
-
-    - name: Fail to create custom resource
-      k8s:
-        definition:
-          apiVersion: ansible.com/v1
-          kind: Foo
-          metadata:
-            namespace: "{{ helm_namespace }}"
-            name: test-foo
-          foobar: footest
+    - name: Check if CRD resource is already present
+      k8s_info:
+        namespace: default
+        kind: Foo
+        api_version: ansible.com/v1
       ignore_errors: true
-      register: result
+      register: crd_check
 
-    - assert:
-        that:
-          - result is failed
-          - "result.msg.startswith('Failed to find exact match for ansible.com/v1.Foo')"
+    - when: crd_check is failed
+      block:
+        - name: Copy test chart
+          copy:
+            src: "{{ test_chart }}"
+            dest: "/tmp/helm_test_crds/"
 
-    # Helm won't install CRDs into an existing release, so we need to delete this, first
-    - name: Uninstall chart
-      helm:
-        binary_path: "{{ helm_binary }}"
-        namespace: "{{ helm_namespace }}"
-        name: test-crds
-        state: absent
-
-    - name: Install chart with CRDs
-      helm:
-        binary_path: "{{ helm_binary }}"
-        chart_ref: "/tmp/helm_test_crds/{{ test_chart }}"
-        namespace: "{{ helm_namespace }}"
-        name: test-crds
-
-    - name: Create custom resource
-      k8s:
-        definition:
-          apiVersion: ansible.com/v1
-          kind: Foo
-          metadata:
+        - name: Install chart while skipping CRDs
+          helm:
+            binary_path: "{{ helm_binary }}"
+            chart_ref: "/tmp/helm_test_crds/{{ test_chart }}"
             namespace: "{{ helm_namespace }}"
-            name: test-foo
-          foobar: footest
-      register: result
+            name: test-crds
+            skip_crds: true
+          register: install
 
-    - assert:
-        that:
-          - result is changed
-          - result.result.foobar == "footest"
+        - assert:
+            that:
+              - install is changed
+              - install.status.name == "test-crds"
+
+        - name: Fail to create custom resource
+          k8s:
+            definition:
+              apiVersion: ansible.com/v1
+              kind: Foo
+              metadata:
+                namespace: "{{ helm_namespace }}"
+                name: test-foo
+              foobar: footest
+          ignore_errors: true
+          register: result
+
+        - assert:
+            that:
+              - result is failed
+              - "result.msg.startswith('Failed to find exact match for ansible.com/v1.Foo')"
+
+        # Helm won't install CRDs into an existing release, so we need to delete this, first
+        - name: Uninstall chart
+          helm:
+            binary_path: "{{ helm_binary }}"
+            namespace: "{{ helm_namespace }}"
+            name: test-crds
+            state: absent
+
+        - name: Install chart with CRDs
+          helm:
+            binary_path: "{{ helm_binary }}"
+            chart_ref: "/tmp/helm_test_crds/{{ test_chart }}"
+            namespace: "{{ helm_namespace }}"
+            name: test-crds
+
+        - name: Create custom resource
+          k8s:
+            definition:
+              apiVersion: ansible.com/v1
+              kind: Foo
+              metadata:
+                namespace: "{{ helm_namespace }}"
+                name: test-foo
+              foobar: footest
+          register: result
+
+        - assert:
+            that:
+              - result is changed
+              - result.result.foobar == "footest"
 
   always:
     - name: Remove chart

tests/integration/targets/helm/tasks/test_helm_insecure.yml

@@ -0,0 +1,52 @@
+---
+- name: Test helm insecure
+  vars:
+    helm_namespace: "{{ test_namespace[12] }}"
+  block:
+
+    - name: Initial chart installation (no flag set)
+      helm:
+        binary_path: "{{ helm_binary }}"
+        chart_ref: "{{ chart_test_oci }}"
+        release_name: test-secure
+        release_namespace: "{{ helm_namespace }}"
+        create_namespace: true
+      register: install
+
+    - name: Validate that insecure flag is not set
+      assert:
+        that:
+          - install is changed
+          - '"--insecure-skip-tls-verify" not in install.command'
+
+    - name: Initial chart installation (insecure flag set)
+      helm:
+        binary_path: "{{ helm_binary }}"
+        chart_ref: "{{ chart_test_oci }}"
+        release_name: test-insecure
+        release_namespace: "{{ helm_namespace }}"
+        insecure_skip_tls_verify: true
+      register: install
+      ignore_errors: true
+
+    - name: Validate that insecure flag IS set if helm version is >= 3.16.0
+      assert:
+        that:
+          - install is changed
+          - '"--insecure-skip-tls-verify" in install.command'
+      when: '"v3.16.0" <= helm_version'
+
+    - name: Validate that feature fails for helm < 3.16.0
+      assert:
+        that:
+          - install is failed
+          - '"insecure_skip_tls_verify requires helm >= 3.16.0" in install.msg'
+      when: 'helm_version < "v3.16.0"'
+
+  always:
+    - name: Remove helm namespace
+      k8s:
+        api_version: v1
+        kind: Namespace
+        name: "{{ helm_namespace }}"
+        state: absent

tests/integration/targets/helm/tasks/test_helm_not_installed.yml

@@ -13,3 +13,11 @@
     that:
       - helm_missing_binary is failed
       - "'No such file or directory' in helm_missing_binary.msg"
+  when: ansible_version.full is version('2.20', '<')
+
+- name: Assert that helm is not installed (ansible 2.20+)
+  assert:
+    that:
+      - helm_missing_binary is failed
+      - "'Error executing command' in helm_missing_binary.msg"
+  when: ansible_version.full is version('2.20', '>=')

tests/integration/targets/helm/tasks/test_helm_reset_then_reuse_values.yml

@@ -0,0 +1,75 @@
+---
+- name: Test helm reset_then_reuse_values
+  vars:
+    helm_namespace: "{{ test_namespace[11] }}"
+    chart_release_values:
+      replica:
+        replicaCount: 3
+      master:
+        count: 1
+        kind: Deployment
+    chart_reset_then_reuse_values:
+      replica:
+        replicaCount: 1
+      master:
+        count: 3
+  block:
+    - name: Initial chart installation
+      helm:
+        binary_path: "{{ helm_binary }}"
+        chart_ref: oci://registry-1.docker.io/bitnamicharts/redis
+        release_name: test-redis
+        release_namespace: "{{ helm_namespace }}"
+        create_namespace: true
+        release_values: "{{ chart_release_values }}"
+      register: install
+
+    - name: Get value set as string
+      helm_info:
+        binary_path: "{{ helm_binary }}"
+        release_name: test-redis
+        release_namespace: "{{ helm_namespace }}"
+      register: release_value
+
+    - name: Validate that chart values are as expected
+      assert:
+        that:
+          - install is changed
+          - '"--reset-then-reuse-values" not in install.command'
+          - release_value["status"]["release_values"] == chart_release_values
+
+    - name: Upgrade chart using reset_then_reuse_values=true
+      helm:
+        binary_path: "{{ helm_binary }}"
+        chart_ref: oci://registry-1.docker.io/bitnamicharts/redis
+        release_name: test-redis
+        release_namespace: "{{ helm_namespace }}"
+        reuse_values: false
+        reset_values: false
+        reset_then_reuse_values: true
+        release_values: "{{ chart_reset_then_reuse_values }}"
+      register: upgrade
+
+    - name: Get value set as string
+      helm_info:
+        binary_path: "{{ helm_binary }}"
+        release_name: test-redis
+        release_namespace: "{{ helm_namespace }}"
+      register: release_value
+
+    - name: Validate that chart values are as expected
+      assert:
+        that:
+          - upgrade is changed
+          - '"--reset-then-reuse-values" in upgrade.command'
+          - '"--reuse-values " not in upgrade.command'
+          - '"--reset-values" not in upgrade.command'
+          - release_value["status"]["release_values"] == chart_release_values | combine(chart_reset_then_reuse_values, recursive=true)
+
+  always:
+    - name: Remove helm namespace
+      k8s:
+        api_version: v1
+        kind: Namespace
+        name: "{{ helm_namespace }}"
+        state: absent

tests/integration/targets/helm/tasks/test_helm_reuse_values.yml

@@ -17,8 +17,7 @@
     - name: Initial chart installation
       helm:
         binary_path: "{{ helm_binary }}"
-        chart_ref: redis
-        chart_repo_url: https://charts.bitnami.com/bitnami
+        chart_ref: oci://registry-1.docker.io/bitnamicharts/redis
         release_name: test-redis
         release_namespace: "{{ helm_namespace }}"
         create_namespace: true
@@ -37,13 +36,12 @@
         that:
           - install is changed
           - '"--reuse-values=True" not in install.command'
-          - release_value["status"]["values"] == chart_release_values
+          - release_value["status"]["release_values"] == chart_release_values
 
     - name: Upgrade chart using reuse_values=true
       helm:
         binary_path: "{{ helm_binary }}"
-        chart_ref: redis
-        chart_repo_url: https://charts.bitnami.com/bitnami
+        chart_ref: oci://registry-1.docker.io/bitnamicharts/redis
         release_name: test-redis
         release_namespace: "{{ helm_namespace }}"
         reuse_values: true
@@ -64,7 +62,7 @@
           - upgrade is changed
           - '"--reuse-values=True" in upgrade.command'
           - '"--reset-values" not in upgrade.command'
-          - release_value["status"]["values"] == chart_release_values | combine(chart_reuse_values, recursive=true)
+          - release_value["status"]["release_values"] == chart_release_values | combine(chart_reuse_values, recursive=true)
 
   always:
     - name: Remove helm namespace

tests/integration/targets/helm/tasks/test_helm_version.yml

@@ -0,0 +1,47 @@
+---
+- name: Test helm reuse_values
+  vars:
+    helm_namespace: "{{ test_namespace[12] }}"
+    chart_release_values:
+      replica:
+        replicaCount: 3
+      master:
+        count: 1
+        kind: Deployment
+    chart_reuse_values:
+      replica:
+        replicaCount: 1
+      master:
+        count: 3
+  block:
+    - name: Initial chart installation
+      helm:
+        binary_path: "{{ helm_binary }}"
+        chart_ref: oci://registry-1.docker.io/bitnamicharts/redis
+        release_name: test-redis
+        release_namespace: "{{ helm_namespace }}"
+        create_namespace: true
+        release_values: "{{ chart_release_values }}"
+      register: install
+      ignore_errors: true
+      when: helm_version == "v4.0.0"
+
+    - name: Debug install result
+      debug:
+        var: install
+      when: helm_version == "v4.0.0"
+
+    - name: Ensure helm installation was failed for v4.0.0
+      assert:
+        that:
+          - install is failed
+          - "'Helm version must be >=3.0.0,<4.0.0' in install.msg"
+      when: helm_version == "v4.0.0"
+
+  always:
+    - name: Remove helm namespace
+      k8s:
+        api_version: v1
+        kind: Namespace
+        name: "{{ helm_namespace }}"
+        state: absent

tests/integration/targets/helm/tasks/tests_chart.yml

@@ -57,7 +57,7 @@
         that:
           - install_check_mode is changed
           - install_check_mode.status is defined
-          - install_check_mode.status.values is defined
+          - install_check_mode.status.release_values is defined
 
     - name: "Install {{ chart_test }} from {{ source }}"
       helm:
@@ -73,7 +73,7 @@
       assert:
         that:
           - install is changed
-          - install.status.chart == "{{ chart_test }}-{{ chart_test_version }}"
+          - install.status.chart == chart_test+"-"+chart_test_version
           - install.status.status | lower == 'deployed'
 
     - name: Check helm_info content
@@ -95,7 +95,7 @@
     - name: "Assert that {{ chart_test }} is installed from {{ source }} with helm_info"
       assert:
         that:
-          - content_info.status.chart == "{{ chart_test }}-{{ chart_test_version }}"
+          - content_info.status.chart == chart_test+"-"+chart_test_version
           - content_info.status.status | lower == 'deployed'
           - release_state_content_info.status.status | lower == 'deployed'
 
@@ -112,7 +112,7 @@
       assert:
         that:
           - install is not changed
-          - install.status.chart == "{{ chart_test }}-{{ chart_test_version }}"
+          - install.status.chart == chart_test+"-"+chart_test_version
           - install.status.status | lower == 'deployed'
 
     - name: "Add vars to {{ chart_test }} from {{ source }}"
@@ -130,8 +130,8 @@
         that:
           - install is changed
           - install.status.status | lower == 'deployed'
-          - install.status.chart == "{{ chart_test }}-{{ chart_test_version }}"
-          - "install.status['values'].revisionHistoryLimit == 0"
+          - install.status.chart == chart_test+"-"+chart_test_version
+          - "install.status['release_values'].revisionHistoryLimit == 0"
 
     - name: Check idempotency after adding vars
       helm:
@@ -148,8 +148,8 @@
         that:
           - install is not changed
           - install.status.status | lower == 'deployed'
-          - install.status.chart == "{{ chart_test }}-{{ chart_test_version }}"
-          - "install.status['values'].revisionHistoryLimit == 0"
+          - install.status.chart == chart_test+"-"+chart_test_version
+          - "install.status['release_values'].revisionHistoryLimit == 0"
 
     - name: "Remove Vars to {{ chart_test }} from {{ source }}"
       helm:
@@ -165,8 +165,8 @@
         that:
           - install is changed
           - install.status.status | lower == 'deployed'
-          - install.status.chart == "{{ chart_test }}-{{ chart_test_version }}"
-          - install.status['values'] == {}
+          - install.status.chart == chart_test+"-"+chart_test_version
+          - install.status['release_values'] == {}
 
     - name: Check idempotency after removing vars
       helm:
@@ -182,8 +182,8 @@
         that:
           - install is not changed
           - install.status.status | lower == 'deployed'
-          - install.status.chart == "{{ chart_test }}-{{ chart_test_version }}"
-          - install.status['values'] == {}
+          - install.status.chart == chart_test+"-"+chart_test_version
+          - install.status['release_values'] == {}
 
     - name: "Upgrade {{ chart_test }} from {{ source }}"
       helm:
@@ -199,7 +199,7 @@
         that:
           - install is changed
           - install.status.status | lower == 'deployed'
-          - install.status.chart == "{{ chart_test }}-{{ chart_test_version_upgrade }}"
+          - install.status.chart == chart_test+"-"+chart_test_version_upgrade
 
     - name: Check idempotency after upgrade
       helm:
@@ -215,7 +215,7 @@
         that:
           - install is not changed
           - install.status.status | lower == 'deployed'
-          - install.status.chart == "{{ chart_test }}-{{ chart_test_version_upgrade }}"
+          - install.status.chart == chart_test+"-"+chart_test_version_upgrade
 
     - name: "Remove {{ chart_test }} from {{ source }}"
       helm:
@@ -316,8 +316,8 @@
         that:
           - install is changed
           - install.status.status | lower == 'deployed'
-          - install.status.chart == "{{ chart_test }}-{{ chart_test_version }}"
-          - "install.status['values'].revisionHistoryLimit == 0"
+          - install.status.chart == chart_test+"-"+chart_test_version
+          - "install.status['release_values'].revisionHistoryLimit == 0"
 
     - name: "Install {{ chart_test }} from {{ source }} with values_files (again)"
       helm:
@@ -357,7 +357,7 @@
           - result is changed
           - result is not failed
           - result.rc == 0
-          - result.command is match("{{ helm_binary }} template {{ chart_source }}")
+          - result.command is match(helm_binary+" template "+chart_source)
 
     - name: Check templates created
       stat:
@@ -374,8 +374,8 @@
         chart_ref: "{{ chart_source }}"
         chart_version: "{{ chart_source_version | default(omit) }}"
         disable_hook: True
-        release_name: "MyRelease"
-        release_namespace: "MyReleaseNamespace"
+        release_name: "myrelease"
+        release_namespace: "myreleasenamespace"
         show_only:
           - "templates/configmap.yaml"
         release_values:
@@ -388,7 +388,7 @@
           - result is changed
           - result is not failed
           - result.rc == 0
-          - result.command is match("{{ helm_binary }} template MyRelease {{ chart_source }}")
+          - result.command is match(helm_binary+" template myrelease "+chart_source)
           - result.stdout is search("ThisValue")
       when: chart_source is search("test-chart")
       # limit assertion of test result to controlled (local) chart_source
@@ -402,7 +402,7 @@
         namespace: "{{ helm_namespace }}"
         create_namespace: true
         context: does-not-exist
-      ignore_errors: yes
+      ignore_errors: true
       register: result
 
     - name: Assert that release fails with non-existent context

tests/integration/targets/helm_diff/files/test-chart-deployment-time/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: test-chart-deployment-time
+description: A chart with a config map containing the deployment time in data
+type: application
+version: 0.1.0
+appVersion: "default"

tests/integration/targets/helm_diff/files/test-chart-deployment-time/templates/configmap.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ default "ansible-configmap" .Values.myConfigmapName }}
+data:
+  myValue: {{ default "test" .Values.myValue }}
+  deploymentTime: {{ now }}

tests/integration/targets/helm_diff/files/test-chart-reuse-values/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: chart-reuse-values
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

tests/integration/targets/helm_diff/files/test-chart-reuse-values/templates/configmap.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cmap
+data:
+  ansible_version: {{ .Values.ansible_version }}
+  phase: {{ .Values.phase }}

tests/integration/targets/helm_diff/files/test-chart-reuse-values/values.yaml

@@ -0,0 +1,2 @@
+ansible_version: milestone
+phase: uat

tests/integration/targets/helm_diff/meta/main.yml

@@ -2,3 +2,4 @@
 dependencies:
   - remove_namespace
   - install_helm
+  - setup_helm_registry

tests/integration/targets/helm_diff/tasks/main.yml

@@ -2,7 +2,6 @@
 - name: Test helm diff functionality
   vars:
     test_chart_ref: "/tmp/test-chart"
-    redis_chart_version: '17.0.5'
 
   block:
 
@@ -11,7 +10,7 @@
         binary_path: "{{ helm_binary }}"
         state: present
         plugin_path: https://github.com/databus23/helm-diff
-        plugin_version: 3.4.0
+        plugin_version: 3.9.13
 
     - name: Copy test chart
       copy:
@@ -24,7 +23,7 @@
         name: test-chart
         namespace: "{{ helm_namespace }}"
         chart_ref: "{{ test_chart_ref }}"
-        create_namespace: yes
+        create_namespace: true
       register: install
 
     - assert:
@@ -49,8 +48,8 @@
         name: test-chart
         namespace: "{{ helm_namespace }}"
         chart_ref: "{{ test_chart_ref }}"
-      check_mode: yes
-      diff: yes
+      check_mode: true
+      diff: true
       register: diff_result
 
     - name: Check if helm diff check is correct
@@ -79,7 +78,7 @@
         namespace: "{{ helm_namespace }}"
         chart_ref: "{{ test_chart_ref }}"
       check_mode: yes
-      diff: yes
+      diff: true
       register: diff_result
 
     - name: Check if no diff in check mode when no change
@@ -101,7 +100,7 @@
 
     - name: Modify values
       blockinfile:
-        create: yes
+        create: true
         path: "{{ test_chart_ref }}/values.yml"
         block: |
           ---
@@ -143,6 +142,8 @@
         chart_ref: "{{ test_chart_ref }}"
         values:
           foo: gaz
+        values_files:
+          - "{{ test_chart_ref }}/values.yml"
       register: install
 
     - assert:
@@ -157,6 +158,46 @@
         chart_ref: "{{ test_chart_ref }}"
         values:
           foo: gaz
+        values_files:
+          - "{{ test_chart_ref }}/values.yml"
+      register: install
+
+    - assert:
+        that:
+          - install is not changed
+
+    - name: Upgrade with set_values
+      helm:
+        binary_path: "{{ helm_binary }}"
+        name: test-chart
+        namespace: "{{ helm_namespace }}"
+        chart_ref: "{{ test_chart_ref }}"
+        values:
+          foo: gaz
+        values_files:
+          - "{{ test_chart_ref }}/values.yml"
+        set_values:
+          - value: foo=qux
+            value_type: string
+      register: install
+
+    - assert:
+        that:
+          - install is changed
+
+    - name: Upgrade with set_values idempotency check
+      helm:
+        binary_path: "{{ helm_binary }}"
+        name: test-chart
+        namespace: "{{ helm_namespace }}"
+        chart_ref: "{{ test_chart_ref }}"
+        values:
+          foo: gaz
+        values_files:
+          - "{{ test_chart_ref }}/values.yml"
+        set_values:
+          - value: foo=qux
+            value_type: string
       register: install
 
     - assert:
@@ -164,52 +205,76 @@
           - install is not changed
 
     # Test helm diff with chart_repo_url
-    - name: Define Redis chart values
-      set_fact:
-        redis_chart_values:
-          commonLabels:
-            phase: testing
-            company: RedHat
-          image:
-            tag: 6.2.6-debian-10-r135
-          architecture: standalone
-
-    - name: Install Redis chart
-      helm:
-        binary_path: "{{ helm_binary }}"
-        chart_repo_url: https://charts.bitnami.com/bitnami
-        chart_ref: redis
-        namespace: "{{ helm_namespace }}"
-        name: redis-chart
-        chart_version: "{{ redis_chart_version }}"
-        release_values: "{{ redis_chart_values }}"
-
-    - name: Upgrade Redis chart
-      helm:
-        binary_path: "{{ helm_binary }}"
-        chart_repo_url: https://charts.bitnami.com/bitnami
-        chart_ref: redis
-        namespace: "{{ helm_namespace }}"
-        name: redis-chart
-        chart_version: "{{ redis_chart_version }}"
-        release_values: "{{ redis_chart_values }}"
-      check_mode: yes
-      register: redis_upgrade
-
-    - name: Assert that module raised a warning
-      assert:
-        that:
-          - not redis_upgrade.changed
-          - redis_upgrade.warnings is defined
-          - redis_upgrade.warnings | length == 1
-          - redis_upgrade.warnings[0] == "The default idempotency check can fail to report changes in certain cases. Install helm diff >= 3.4.1 for better results."
-
     - name: Uninstall helm diff
       helm_plugin:
         binary_path: "{{ helm_binary }}"
         state: absent
         plugin_name: diff
-      ignore_errors: yes
+      ignore_errors: true
+
+    - name: Define chart variables
+      set_fact:
+        test_chart_values:
+          myValue: 'Some ConfigMap data value'
+          myConfigmapName: 'ansible-config-from-url'
+        test_chart_version: 0.1.0
+        test_chart_ref_url: "oci://localhost:6035/testing/test-chart-deployment-time"
+
+    - name: Deploy chart to remote registry
+      block:
+        - name: Create local directory to copy chart in
+          ansible.builtin.tempfile:
+            suffix: .chart
+            state: directory
+          register: _tmpd
+
+        - name: Copy local registry
+          ansible.builtin.copy:
+            dest: "{{ _tmpd.path }}"
+            src: '{{ role_path }}/files/test-chart-deployment-time'
+
+        - name: Push chart to helm registry
+          ansible.builtin.include_role:
+            name: push_to_helm_registry
+          vars:
+            chart_local_path: '{{ _tmpd.path }}/test-chart-deployment-time'
+            chart_repo_path: 'testing'
+      always:
+        - name: Delete temporary directory
+          ansible.builtin.file:
+            state: absent
+            path: '{{ _tmpd.path }}'
+
+    - name: Log into Helm registry
+      ansible.builtin.command: "{{ helm_binary }} registry login -u testuser -p 'pass123!' localhost:6035"
+
+    - name: Install chart from remote URL
+      helm:
+        binary_path: "{{ helm_binary }}"
+        chart_ref: "{{ test_chart_ref_url }}"
+        chart_version: 0.1.0
+        namespace: "{{ helm_namespace }}"
+        name: another-chart
+        release_values: "{{ test_chart_values }}"
+
+    - name: Upgrade chart
+      helm:
+        binary_path: "{{ helm_binary }}"
+        chart_ref: "{{ test_chart_ref_url }}"
+        chart_version: 0.1.0
+        namespace: "{{ helm_namespace }}"
+        name: another-chart
+        release_values: "{{ test_chart_values }}"
+      check_mode: true
+      register: _upgrade
+
+    - name: Assert that module raised a warning
+      assert:
+        that:
+          - not _upgrade.changed
+          - _upgrade.warnings is defined
+          - _upgrade.warnings | length == 1
+          - _upgrade.warnings[0] == "The default idempotency check can fail to report changes in certain cases. Install helm diff >= 3.4.1 for better results."
 
     - name: Install helm diff (version=3.4.1)
       helm_plugin:
@@ -218,37 +283,36 @@
         plugin_path: https://github.com/databus23/helm-diff
         plugin_version: 3.4.1
 
-    - name: Upgrade Redis chart once again
+    - name: Upgrade chart once again
       helm:
         binary_path: "{{ helm_binary }}"
-        chart_repo_url: https://charts.bitnami.com/bitnami
-        chart_ref: redis
+        chart_ref: "{{ test_chart_ref_url }}"
+        chart_version: 0.1.0
         namespace: "{{ helm_namespace }}"
-        name: redis-chart
-        chart_version: "{{ redis_chart_version }}"
-        release_values: "{{ redis_chart_values }}"
-      check_mode: yes
-      register: redis_upgrade_2
+        name: another-chart
+        release_values: "{{ test_chart_values }}"
+      check_mode: true
+      register: _upgrade_2
 
     - name: Assert that module raised a warning
       assert:
         that:
-          - redis_upgrade_2.changed
-          - redis_upgrade_2.warnings is not defined
+          - _upgrade_2.changed
+          - _upgrade_2.warnings is not defined
 
   always:
     - name: Remove chart directory
       file:
         path: "{{ test_chart_ref }}"
         state: absent
-      ignore_errors: yes
+      ignore_errors: true
 
     - name: Uninstall helm diff
       helm_plugin:
         binary_path: "{{ helm_binary }}"
         state: absent
         plugin_name: diff
-      ignore_errors: yes
+      ignore_errors: true
 
     - name: Remove helm namespace
       k8s:
@@ -256,4 +320,9 @@
         kind: Namespace
         name: "{{ helm_namespace }}"
         state: absent
-      ignore_errors: yes
+        wait: true
+      ignore_errors: true
+
+- include_tasks: reuse_values.yml
+
+- include_tasks: reset_then_reuse_values.yml

tests/integration/targets/helm_diff/tasks/reset_then_reuse_values.yml

@@ -0,0 +1,189 @@
+---
+- name: Create temporary directory for helm chart
+  tempfile:
+    suffix: .helm
+    state: directory
+  register: helm_dir
+
+- name: Test helm diff functionality
+  vars:
+    test_chart_path: "{{ helm_dir.path }}/test-chart-reuse-values"
+    test_release_name: "myrelease"
+
+  block:
+    - name: Install helm diff
+      kubernetes.core.helm_plugin:
+        binary_path: "{{ helm_binary }}"
+        state: present
+        plugin_path: https://github.com/databus23/helm-diff
+        plugin_version: 3.9.14
+
+    - name: Copy test chart
+      ansible.builtin.copy:
+        src: "test-chart-reuse-values"
+        dest: "{{ helm_dir.path }}"
+
+    - name: Delete existing namespace
+      kubernetes.core.k8s:
+        state: absent
+        wait: true
+        kind: Namespace
+        name: "{{ helm_namespace }}"
+      ignore_errors: true
+
+    - name: Create helm release
+      kubernetes.core.helm:
+        state: present
+        binary_path: "{{ helm_binary }}"
+        chart_ref: "{{ test_chart_path }}"
+        release_name: "{{ test_release_name }}"
+        release_namespace: "{{ helm_namespace }}"
+        create_namespace: true
+        release_values:
+          ansible_version: devel
+          phase: ci
+        wait: true
+
+    - name: Upgrade helm release (reset_values=false and reuse_values=false and reset_then_reuse_values=true)
+      kubernetes.core.helm:
+        binary_path: "{{ helm_binary }}"
+        chart_ref: "{{ test_chart_path }}"
+        reset_values: false
+        reuse_values: false
+        reset_then_reuse_values: true
+        release_name: "{{ test_release_name }}"
+        release_namespace: "{{ helm_namespace }}"
+        values:
+          ansible_version: devel
+      register: helm_upgrade
+
+    - name: Ensure task did not reported change
+      assert:
+        that:
+          - helm_upgrade is not changed
+
+    - name: Upgrade helm release (reset_then_reuse_values=true with default value for reset_values and reuse_values=false)
+      kubernetes.core.helm:
+        binary_path: "{{ helm_binary }}"
+        chart_ref: "{{ test_chart_path }}"
+        reuse_values: false
+        reset_then_reuse_values: true
+        release_name: "{{ test_release_name }}"
+        release_namespace: "{{ helm_namespace }}"
+        values:
+          ansible_version: devel
+      register: helm_upgrade
+
+    - name: Ensure task reported change
+      assert:
+        that:
+          - helm_upgrade is changed
+
+    # Delete helm and helm diff to install older version
+    - name: Uninstall helm diff
+      helm_plugin:
+        binary_path: "{{ helm_binary }}"
+        state: absent
+        plugin_name: diff
+      ignore_errors: true
+
+    - name: Delete Helm folders
+      file:
+        path: /tmp/helm/
+        state: absent
+
+    - name: Init Helm folders
+      file:
+        path: /tmp/helm
+        state: directory
+
+    - name: Set Helm old version
+      set_fact:
+        helm_archive_name: "helm-v3.8.0-linux-amd64.tar.gz"
+        helm_diff_old_version: "3.8.0"
+
+    - name: Unarchive Helm binary
+      unarchive:
+        src: "https://get.helm.sh/{{ helm_archive_name | default(helm_default_archive_name) }}"
+        dest: /tmp/helm/
+        remote_src: yes
+      retries: 10
+      delay: 5
+      register: result
+      until: result is not failed
+
+    - name: Upgrade helm release (with reset_then_reuse_values=true)
+      kubernetes.core.helm:
+        binary_path: "{{ helm_binary }}"
+        chart_ref: "{{ test_chart_path }}"
+        reuse_values: false
+        reset_then_reuse_values: true
+        release_name: "{{ test_release_name }}"
+        release_namespace: "{{ helm_namespace }}"
+        values:
+          ansible_version: test
+      register: helm_upgrade
+      ignore_errors: true
+
+    - name: Debug
+      debug:
+        var: helm_upgrade
+
+    - name: Ensure warning for Helm version
+      assert:
+        that:
+          - helm_upgrade is failed
+          - '"reset_then_reuse_values requires helm >= 3.14.0, current version is" in helm_upgrade.msg'
+
+    - name: Install helm diff
+      helm_plugin:
+        binary_path: "{{ helm_binary }}"
+        state: present
+        plugin_path: https://github.com/databus23/helm-diff
+        plugin_version: "{{ helm_diff_old_version }}"
+
+    - name: Upgrade helm release (with reset_then_reuse_values=true)
+      kubernetes.core.helm:
+        binary_path: "{{ helm_binary }}"
+        chart_ref: "{{ test_chart_path }}"
+        reuse_values: false
+        reset_then_reuse_values: true
+        release_name: "{{ test_release_name }}"
+        release_namespace: "{{ helm_namespace }}"
+        values:
+          ansible_version: devel
+      register: helm_upgrade
+      ignore_errors: true
+
+    - name: Debug
+      debug:
+        var: helm_upgrade
+
+    - name: Ensure warning for Helm Diff version
+      assert:
+        that:
+          - helm_upgrade is failed
+          - '"reset_then_reuse_values requires helm diff >= 3.9.12, current version is" in helm_upgrade.msg'
+
+  always:
+    - name: Remove temporary directory
+      file:
+        path: "{{ helm_dir.path }}"
+        state: absent
+      ignore_errors: true
+
+    - name: Uninstall helm diff
+      kubernetes.core.helm_plugin:
+        binary_path: "{{ helm_binary }}"
+        state: absent
+        plugin_name: diff
+      ignore_errors: true
+
+    - name: Remove helm namespace
+      kubernetes.core.k8s:
+        api_version: v1
+        kind: Namespace
+        name: "{{ helm_namespace }}"
+        state: absent
+        wait: true
+      ignore_errors: true

tests/integration/targets/helm_diff/tasks/reuse_values.yml

@@ -0,0 +1,94 @@
+---
+- name: Create temporary directory for helm chart
+  tempfile:
+    suffix: .helm
+    state: directory
+  register: helm_dir
+
+- name: Test helm diff functionality
+  vars:
+    test_chart_path: "{{ helm_dir.path }}/test-chart-reuse-values"
+    test_release_name: "myrelease"
+
+  block:
+
+    - name: Install helm diff
+      kubernetes.core.helm_plugin:
+        binary_path: "{{ helm_binary }}"
+        state: present
+        plugin_path: https://github.com/databus23/helm-diff
+        plugin_version: 3.9.4
+
+    - name: Copy test chart
+      ansible.builtin.copy:
+        src: "test-chart-reuse-values"
+        dest: "{{ helm_dir.path }}"
+
+    - name: Create helm release
+      kubernetes.core.helm:
+        state: present
+        binary_path: "{{ helm_binary }}"
+        chart_ref: "{{ test_chart_path }}"
+        release_name: "{{ test_release_name }}"
+        release_namespace: "{{ helm_namespace }}"
+        create_namespace: true
+        release_values:
+          ansible_version: devel
+          phase: ci
+        wait: true
+
+    - name: Upgrade helm release (reset_values=false and reuse_values=true)
+      kubernetes.core.helm:
+        binary_path: "{{ helm_binary }}"
+        chart_ref: "{{ test_chart_path }}"
+        reset_values: false
+        reuse_values: true
+        release_name: "{{ test_release_name }}"
+        release_namespace: "{{ helm_namespace }}"
+        values:
+          ansible_version: devel
+      register: helm_upgrade
+
+    - name: Ensure task did not reported change
+      assert:
+        that:
+          - helm_upgrade is not changed
+
+    - name: Upgrade helm release (reuse_values=true with default value for reset_values)
+      kubernetes.core.helm:
+        binary_path: "{{ helm_binary }}"
+        chart_ref: "{{ test_chart_path }}"
+        reuse_values: true
+        release_name: "{{ test_release_name }}"
+        release_namespace: "{{ helm_namespace }}"
+        values:
+          ansible_version: devel
+      register: helm_upgrade
+
+    - name: Ensure task reported change
+      assert:
+        that:
+          - helm_upgrade is changed
+
+  always:
+    - name: Remove temporary directory
+      file:
+        path: "{{ helm_dir.path }}"
+        state: absent
+      ignore_errors: true
+
+    - name: Uninstall helm diff
+      kubernetes.core.helm_plugin:
+        binary_path: "{{ helm_binary }}"
+        state: absent
+        plugin_name: diff
+      ignore_errors: true
+
+    - name: Remove helm namespace
+      kubernetes.core.k8s:
+        api_version: v1
+        kind: Namespace
+        name: "{{ helm_namespace }}"
+        state: absent
+        wait: true
+      ignore_errors: true

tests/integration/targets/helm_kubeconfig/tasks/main.yml

@@ -1,6 +1,10 @@
 ---
 - name: Test helm with in-memory kubeconfig
   include_tasks: "from_in_memory_kubeconfig.yml"
+  loop_control:
+    loop_var: test_helm_version
+  with_items:
+    - "v3.10.3"
 
 - name: Test helm with custom kubeconfig and validate_certs=false
   include_tasks: "from_kubeconfig_with_validate_certs.yml"
@@ -8,12 +12,10 @@
     loop_var: test_helm_version
   with_items:
     - "v3.10.3"
-    - "v3.8.2"
 
 - name: Test helm with custom kubeconfig and ca_cert
   include_tasks: "from_kubeconfig_with_cacert.yml"
   loop_control:
     loop_var: test_helm_version
   with_items:
-    - "v3.5.1"
-    - "v3.4.2"
+    - "v3.10.3"

tests/integration/targets/helm_kubeconfig/tasks/tests_helm_auth.yml

@@ -18,7 +18,12 @@
 - set_fact:
     saved_kubeconfig_path: "{{ _dir.path }}/config"
 
-- block:
+- vars:
+    helm_repo_name: autoscaler
+    helm_repo_url: "https://kubernetes.github.io/autoscaler"
+    helm_release_name: "autoscaler"
+    helm_chart_name: "cluster-autoscaler"
+  block:
     - name: Copy default kubeconfig
       copy:
         remote_src: true
@@ -59,14 +64,14 @@
           - plugin_info.plugin_list != []
 
     # helm_repository, helm, helm_info
-    - name: Add test_bitnami chart repository
+    - name: 'Add "{{ helm_repo_name }}" chart repository'
       helm_repository:
         binary_path: "{{ helm_binary }}"
-        name: test_bitnami
+        name: "{{ helm_repo_name }}"
         kubeconfig: "{{ test_kubeconfig | default(omit) }}"
         validate_certs: "{{ test_validate_certs | default(omit) }}"
         ca_cert: "{{ test_ca_cert | default(omit) }}"
-        repo_url: https://charts.bitnami.com/bitnami
+        repo_url: "{{ helm_repo_url }}"
       register: repository
 
     - name: Assert that repository was added
@@ -77,8 +82,8 @@
     - name: Install chart from repository added before
       helm:
         binary_path: "{{ helm_binary }}"
-        name: rabbitmq
-        chart_ref: test_bitnami/rabbitmq
+        name: "{{ helm_release_name }}"
+        chart_ref: "{{ helm_repo_name }}/{{ helm_chart_name }}"
         namespace: "{{ helm_namespace }}"
         update_repo_cache: true
         kubeconfig: "{{ test_kubeconfig | default(omit) }}"
@@ -98,7 +103,7 @@
         kubeconfig: "{{ test_kubeconfig | default(omit) }}"
         validate_certs: "{{ test_validate_certs | default(omit) }}"
         ca_cert: "{{ test_ca_cert | default(omit) }}"
-        name: "rabbitmq"
+        name: "{{ helm_release_name }}"
         namespace: "{{ helm_namespace }}"
       register: chart_info
 
@@ -112,7 +117,7 @@
     - name: Remove chart
       helm:
         binary_path: "{{ helm_binary }}"
-        name: rabbitmq
+        name: "{{ helm_release_name }}"
         namespace: "{{ helm_namespace }}"
         kubeconfig: "{{ test_kubeconfig | default(omit) }}"
         validate_certs: "{{ test_validate_certs | default(omit) }}"
@@ -131,7 +136,7 @@
         kubeconfig: "{{ test_kubeconfig | default(omit) }}"
         validate_certs: "{{ test_validate_certs | default(omit) }}"
         ca_cert: "{{ test_ca_cert | default(omit) }}"
-        name: "rabbitmq"
+        name: "{{ helm_release_name }}"
         namespace: "{{ helm_namespace }}"
       register: chart_info
 
@@ -143,7 +148,7 @@
     - name: Remove chart repository
       helm_repository:
         binary_path: "{{ helm_binary }}"
-        name: test_bitnami
+        name: "{{ helm_repo_name }}"
         kubeconfig: "{{ test_kubeconfig | default(omit) }}"
         validate_certs: "{{ test_validate_certs | default(omit) }}"
         ca_cert: "{{ test_ca_cert | default(omit) }}"
@@ -192,6 +197,6 @@
     - name: Delete helm repository
       helm_repository:
         binary_path: "{{ helm_binary }}"
-        name: test_bitnami
+        name: "{{ helm_repo_name }}"
         state: absent
       ignore_errors: true

tests/integration/targets/helm_pull/tasks/main.yml

@@ -47,7 +47,7 @@
           assert:
             that:
               - _result is failed
-              - _result.msg == "This module requires helm >= 3.0.0, current version is 2.3.0"
+              - _result.msg == "Helm version must be >=3.0.0,<4.0.0, current version is 2.3.0"
 
       vars:
         helm_path: "{{ temp_dir }}/2.3.0/linux-amd64/helm"
@@ -180,6 +180,7 @@
               - '"--username ansible" in _result.command'
               - '"--password ***" in _result.command'
               - '"--keyring pubring.gpg" in _result.command'
+              - '"Module did not set no_log for pass_credentials" not in _result.stderr'
 
         - name: Download chart using chart_ref
           helm_pull:
@@ -203,9 +204,8 @@
         - name: Download chart using untar_chart
           helm_pull:
             binary_path: "{{ helm_path }}"
-            chart_ref: redis
+            chart_ref: "oci://registry-1.docker.io/bitnamicharts/redis"
             destination: "{{ destination }}"
-            repo_url: "https://charts.bitnami.com/bitnami"
             untar_chart: true
           register: _result
 
@@ -221,6 +221,101 @@
               - _chart.stat.exists
               - _chart.stat.isdir
 
+        # Test idempotency with tarred chart
+        - name: Download chart with version (first time)
+          helm_pull:
+            binary_path: "{{ helm_path }}"
+            chart_ref: "oci://registry-1.docker.io/bitnamicharts/redis"
+            destination: "{{ destination }}"
+            chart_version: "24.1.0"
+          register: _result_first
+
+        - name: Download chart with version (second time - should be idempotent)
+          helm_pull:
+            binary_path: "{{ helm_path }}"
+            chart_ref: "oci://registry-1.docker.io/bitnamicharts/redis"
+            destination: "{{ destination }}"
+            chart_version: "24.1.0"
+          register: _result_second
+
+        - name: Validate idempotency for tarred chart
+          assert:
+            that:
+              - _result_first is changed
+              - _result_second is not changed
+
+        # Test force parameter with tarred chart
+        - name: Download chart with force=true (should always download)
+          helm_pull:
+            binary_path: "{{ helm_path }}"
+            chart_ref: "oci://registry-1.docker.io/bitnamicharts/redis"
+            destination: "{{ destination }}"
+            chart_version: "24.1.0"
+            force: true
+          register: _result_force
+
+        - name: Validate force parameter causes download
+          assert:
+            that:
+              - _result_force is changed
+
+        # Test idempotency with untarred chart in the separate folder
+        - name: Create separate directory for untar test under {{ temp_dir }}
+          ansible.builtin.file:
+            path: "{{ destination }}/untar_test"
+            state: directory
+            mode: '0755'
+
+        - name: Download and untar chart (first time)
+          helm_pull:
+            binary_path: "{{ helm_path }}"
+            chart_ref: "oci://registry-1.docker.io/bitnamicharts/redis"
+            destination: "{{ destination }}/untar_test"
+            chart_version: "24.0.0"
+            untar_chart: true
+          register: _result_untar_first
+
+        - name: Download and untar chart (second time - should be idempotent)
+          helm_pull:
+            binary_path: "{{ helm_path }}"
+            chart_ref: "oci://registry-1.docker.io/bitnamicharts/redis"
+            destination: "{{ destination }}/untar_test"
+            chart_version: "24.0.0"
+            untar_chart: true
+          register: _result_untar_second
+
+        - name: Validate idempotency for untarred chart
+          assert:
+            that:
+              - _result_untar_first is changed
+              - _result_untar_second is not changed
+
+        - name: Download and untar chart with force=true (should remove existing directory and re-extract)
+          helm_pull:
+            binary_path: "{{ helm_path }}"
+            chart_ref: "oci://registry-1.docker.io/bitnamicharts/redis"
+            destination: "{{ destination }}/untar_test"
+            chart_version: "24.0.0"
+            untar_chart: true
+            force: true
+          register: _result_untar_force
+
+        - name: Validate first force extraction works
+          assert:
+            that:
+              - _result_untar_force is changed
+
+        - name: Verify chart directory still exists after force re-extraction
+          stat:
+            path: "{{ destination }}/untar_test/redis"
+          register: _chart_after_force
+
+        - name: Validate chart directory exists
+          assert:
+            that:
+              - _chart_after_force.stat.exists
+              - _chart_after_force.stat.isdir
+
       vars:
         helm_path: "{{ temp_dir }}/3.8.0/linux-amd64/helm"
 

tests/integration/targets/helm_registry_auth/aliases

@@ -0,0 +1,2 @@
+time=16
+helm_registry_auth

tests/integration/targets/helm_registry_auth/defaults/main.yaml

@@ -0,0 +1,9 @@
+---
+# Username and password for the registry
+# ../files/registry.password contains username and hashed password
+username: testuser
+password: testpassword
+wrong_password: 'WrongPassword'
+registry_name: oci_registry
+registry_port: 5000
+test_chart: https://github.com/grafana/helm-charts/releases/download/k8s-monitoring-1.6.8/k8s-monitoring-1.6.8.tgz

tests/integration/targets/helm_registry_auth/files/registry.password

@@ -0,0 +1 @@
+testuser:$2y$05$PmdUjSCJYdRUZlsYy8QGWuJDiwuHtWXa28YrELlN5haeHkZ1seZZG

tests/integration/targets/helm_registry_auth/meta/main.yml

@@ -0,0 +1,3 @@
+---
+dependencies:
+  - install_helm

tests/integration/targets/helm_registry_auth/playbook.yaml

@@ -0,0 +1,7 @@
+---
+- name: Test helm_registry_auth module
+  hosts: localhost
+  connection: local
+  gather_facts: true
+  roles:
+  - helm_registry_auth

tests/integration/targets/helm_registry_auth/runme.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -eux
+export ANSIBLE_CALLBACKS_ENABLED=profile_tasks
+export ANSIBLE_ROLES_PATH=../
+ansible-playbook playbook.yaml "$@"

tests/integration/targets/helm_registry_auth/tasks/main.yaml

@@ -0,0 +1,182 @@
+---
+- name: Run module test
+  # using a shell and command module to run the test as test can be non-idempotent
+  # and it allow to not install any additional dependencies
+  block:
+    - name: Ensure that helm is installed
+      ansible.builtin.shell: helm version --client --short | grep v3
+      register: _helm_version
+      failed_when: _helm_version.rc != 0
+
+    - name: Ensure that Docker demon is running
+      ansible.builtin.command: "docker info"
+      register: _docker_info
+      failed_when: _docker_info.rc != 0
+
+    - name: Create a tmpfile htpasswd directory
+      ansible.builtin.tempfile:
+        state: directory
+        suffix: .httppasswd
+      register: _tmpfile
+
+    - name: Copy htpasswd to the tmpfile directory
+      ansible.builtin.copy:
+        src: registry.password
+        dest: "{{ _tmpfile.path }}/registry.password"
+
+    - name: Setup the registry
+      ansible.builtin.command: >-
+        docker run -d --rm
+        -p {{ registry_port }}:5000
+        --name "{{ registry_name }}"
+        -v "{{ _tmpfile.path }}:/auth"
+        -e "REGISTRY_AUTH=htpasswd"
+        -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm"
+        -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/registry.password
+        registry:2
+      register: _setup_registry
+      failed_when: _setup_registry.rc != 0
+
+    - name: Ensure that the registry is running and rechable
+      ansible.builtin.wait_for:
+        host: localhost
+        port: "{{ registry_port }}"
+
+    - name: Test the registry with correct credentials to ensure that the registry is running
+      ansible.builtin.shell: >-
+        echo {{ password | quote }} | helm registry login localhost:{{ registry_port }}
+        -u {{ username }} --password-stdin
+      register: _login_correct
+      failed_when: _login_correct.rc != 0
+
+    - name: Clean up credentials to run test on clean environment
+      ansible.builtin.shell: >-
+        helm registry logout localhost:{{ registry_port }}
+      register: _logout
+      failed_when: _logout.rc != 0
+
+    - name: Create directory for helm chart
+      ansible.builtin.tempfile:
+        state: directory
+        suffix: ".helm"
+      register: _destination
+
+    - name: Pull test helm chart
+      ansible.builtin.uri:
+        url: "{{ test_chart }}"
+        dest: "{{ _destination.path }}/k8s-monitoring-1.6.8.tgz"
+        return_content: no
+        status_code: 200
+
+    - name: Test module helm_registry_auth with correct credentials
+      helm_registry_auth:
+        username: "{{ username }}"
+        password: "{{ password }}"
+        host: localhost:{{ registry_port }}
+        state: present
+      register: _helm_registry_auth_correct
+
+    - name: Assert that the registry is logged in
+      # Helm binary prints the message to stderr, refence: https://github.com/helm/helm/issues/13464
+      assert:
+        that:
+          - "'Login Succeeded' in _helm_registry_auth_correct.stderr"
+          - "'{{ password }}' not in _helm_registry_auth_correct.command"
+          - "'{{ password }}' not in _helm_registry_auth_correct.stdout"
+          - "'{{ password }}' not in _helm_registry_auth_correct.stderr"
+
+    - name: Ensure that push to the registry is working
+      ansible.builtin.shell: >-
+        helm push "{{ _destination.path }}/k8s-monitoring-1.6.8.tgz"  oci://localhost:{{ registry_port }}/test/
+      register: _save_chart
+      failed_when: _save_chart.rc != 0
+
+    - name: Assert that the chart is saved
+      # Helm binary prints the message to stderr, refence: https://github.com/helm/helm/issues/13464
+      assert:
+        that: "'Pushed: localhost:{{ registry_port }}/test/k8s-monitoring' in _save_chart.stderr"
+
+
+    - name: Test logout
+      helm_registry_auth:
+        host: localhost:{{ registry_port }}
+        state: absent
+      register: _helm_registry_auth_logout
+
+    - name: Assert logout
+      # Helm binary prints the message to stderr
+      assert:
+        that: "'Removing login credentials' in _helm_registry_auth_logout.stderr"
+
+    - name: Test idempotency of logout with helm < 3.18.0
+      when: _helm_version.stdout is ansible.builtin.version('v3.18.0', '<')
+      block:
+
+        - name: Test logout idempotency
+          helm_registry_auth:
+            host: localhost:{{ registry_port }}
+            state: absent
+          register: _helm_registry_auth_logout_idempotency
+
+        - name: Assert logout operation did not report change
+          ansible.builtin.assert:
+            that: _helm_registry_auth_logout_idempotency is not changed
+
+    - name: Ensure that not able to push to the registry
+      ansible.builtin.shell: >-
+        helm push "{{ _destination.path }}/k8s-monitoring-1.6.8.tgz"  oci://localhost:{{ registry_port }}/test/
+      register: _save_chart
+      failed_when: _save_chart.rc == 0
+
+    - name: Read content of ~/.config/helm/registry/config.json
+      ansible.builtin.slurp:
+        src: ~/.config/helm/registry/config.json
+      register: _config_json
+
+    - name: Assert that auth data is remove and the chart is not saved
+      # Helm binary prints the message to stderr
+      ansible.builtin.assert:
+        that:
+          - "'push access denied' in _save_chart.stderr or 'basic credential not found' in _save_chart.stderr"
+          - "_save_chart.rc != 0"
+          - "'localhost:{{ registry_port }}' not in _config_json.content | b64decode"
+
+    - name: Test module helm_registry_auth with wrong credentials
+      helm_registry_auth:
+        username: "{{ username }}"
+        password: "{{ wrong_password }}"
+        host: localhost:{{ registry_port }}
+        state: present
+      register: _helm_registry_auth_wrong
+      ignore_errors: true
+
+    - name: Read content of ~/.config/helm/registry/config.json
+      ansible.builtin.slurp:
+        src: ~/.config/helm/registry/config.json
+      register: _config_json
+
+    - name: Assert that the registry is not logged in and auth data is not saved
+      ansible.builtin.assert:
+        that:
+          - "'401' in _helm_registry_auth_wrong.stderr"
+          - "'unauthorized' in _helm_registry_auth_wrong.stderr | lower"
+          - "'{{ wrong_password }}' not in _helm_registry_auth_correct.command"
+          - "'{{ wrong_password }}' not in _helm_registry_auth_correct.stdout"
+          - "'{{ wrong_password }}' not in _helm_registry_auth_correct.stderr"
+          - "'localhost:{{ registry_port }}' not in _config_json.content | b64decode"
+
+  # Clean up
+  always:
+    - name: Stop and remove the registry
+      ansible.builtin.command: docker stop {{ registry_name }}
+      ignore_errors: true
+
+    - name: Remove the tmpfile
+      ansible.builtin.file:
+        state: absent
+        path: "{{ item }}"
+        force: true
+      loop:
+        - "{{ _tmpfile.path }}"
+        - "{{ _destination.path }}"
+      ignore_errors: true

tests/integration/targets/helm_repository/meta/main.yml

@@ -1,3 +1,5 @@
 ---
+collections:
+  - kubernetes.core
 dependencies:
   - install_helm

tests/integration/targets/helm_repository/tasks/main.yml

@@ -16,6 +16,7 @@
   assert:
     that:
       - repository is changed
+      - '"--insecure-skip-tls-verify" not in repository.command'
 
 - name: Check idempotency
   helm_repository:
@@ -78,3 +79,23 @@
   assert:
     that:
       - repository is not changed
+
+- name: Add test_helm_repo chart repository as insecure
+  helm_repository:
+    binary_path: "{{ helm_binary }}"
+    name: test_helm_repo
+    repo_url: "{{ chart_test_repo }}"
+    insecure_skip_tls_verify: true
+  register: repository
+
+- name: Assert that repository added and flag set
+  assert:
+    that:
+      - repository is changed
+      - '"--insecure-skip-tls-verify" in repository.command'
+
+- name: Clean test_helm_repo chart repository
+  helm_repository:
+    binary_path: "{{ helm_binary }}"
+    name: test_helm_repo
+    state: absent

tests/integration/targets/helm_set_values/tasks/main.yml

@@ -1,8 +1,7 @@
 - name: Install helm using set_values parameters
   helm:
     binary_path: "{{ helm_binary }}"
-    chart_ref: mariadb
-    chart_repo_url: https://charts.bitnami.com/bitnami
+    chart_ref: oci://registry-1.docker.io/bitnamicharts/mariadb
     release_name: test-mariadb
     release_namespace: "{{ helm_namespace }}"
     create_namespace: true
@@ -21,10 +20,10 @@
 - name: Assert that release was created with user-defined variables
   assert:
     that:
-    - '"phase" in user_values.status["values"]'
-    - '"versioned" in user_values.status["values"]'
-    - user_values.status["values"]["phase"] == "integration"
-    - user_values.status["values"]["versioned"] is false
+    - '"phase" in user_values.status["release_values"]'
+    - '"versioned" in user_values.status["release_values"]'
+    - user_values.status["release_values"]["phase"] == "integration"
+    - user_values.status["release_values"]["versioned"] is false
 
 # install chart using set_values and release_values
 - name: Install helm binary (> 3.10.0) requires to use set-json
@@ -36,8 +35,7 @@
 - name: Install helm using set_values parameters
   helm:
     binary_path: "{{ helm_binary }}"
-    chart_ref: apache
-    chart_repo_url: https://charts.bitnami.com/bitnami
+    chart_ref: oci://registry-1.docker.io/bitnamicharts/apache
     release_name: test-apache
     release_namespace: "{{ helm_namespace }}"
     create_namespace: true
@@ -57,10 +55,10 @@
 - name: Assert that release was created with user-defined variables
   assert:
     that:
-    - values.status["values"].replicaCount == 3
-    - values.status["values"].master.image.registry == "docker.io"
-    - values.status["values"].master.image.repository == "bitnami/apache"
-    - values.status["values"].master.image.tag == "2.4.54-debian-11-r74"
+    - values.status["release_values"].replicaCount == 3
+    - values.status["release_values"].master.image.registry == "docker.io"
+    - values.status["release_values"].master.image.repository == "bitnami/apache"
+    - values.status["release_values"].master.image.tag == "2.4.54-debian-11-r74"
 
 # install chart using set_values and values_files
 - name: create temporary file to save values in
@@ -79,8 +77,7 @@
   - name: Install helm using set_values parameters
     helm:
       binary_path: "{{ helm_binary }}"
-      chart_ref: minio
-      chart_repo_url: https://charts.bitnami.com/bitnami
+      chart_ref: oci://registry-1.docker.io/bitnamicharts/minio
       release_name: test-minio
       release_namespace: "{{ helm_namespace }}"
       create_namespace: true
@@ -99,11 +96,19 @@
   - name: Assert that release was created with user-defined variables
     assert:
       that:
-      - values.status["values"].mode == "distributed"
-      - values.status["values"].disableWebUI is true
+      - values.status["release_values"].mode == "distributed"
+      - values.status["release_values"].disableWebUI is true
 
   always:
   - name: Delete temporary file
     file:
       state: absent
       path: "{{ ymlfile.path }}"
+    ignore_errors: true
+
+  - name: Delete namespace
+    k8s:
+      state: absent
+      kind: namespace
+      name: "{{ helm_namespace }}"
+    ignore_errors: true

tests/integration/targets/install_helm/defaults/main.yml

@@ -1,4 +1,4 @@
 ---
-helm_version: v3.7.0
+helm_version: v3.16.4
 helm_install_path: /tmp/helm
 helm_default_archive_name: "helm-{{ helm_version }}-{{ ansible_system | lower }}-amd64.tar.gz"

tests/integration/targets/k8s_apply/defaults/main.yml

@@ -1,42 +1,4 @@
 ---
-k8s_pod_metadata:
-  labels:
-    app: "{{ k8s_pod_name }}"
-
-k8s_pod_spec:
-  serviceAccount: "{{ k8s_pod_service_account }}"
-  containers:
-    - image: "{{ k8s_pod_image }}"
-      imagePullPolicy: Always
-      name: "{{ k8s_pod_name }}"
-      command: "{{ k8s_pod_command }}"
-      readinessProbe:
-        initialDelaySeconds: 15
-        exec:
-          command:
-            - /bin/true
-      resources: "{{ k8s_pod_resources }}"
-      ports: "{{ k8s_pod_ports }}"
-      env: "{{ k8s_pod_env }}"
-
-
-k8s_pod_service_account: default
-
-k8s_pod_resources:
-  limits:
-    cpu: "100m"
-    memory: "100Mi"
-
-k8s_pod_command: []
-
-k8s_pod_ports: []
-
-k8s_pod_env: []
-
-k8s_pod_template:
-  metadata: "{{ k8s_pod_metadata }}"
-  spec: "{{ k8s_pod_spec }}"
-
 test_namespace: "apply"
 
 k8s_wait_timeout: 240

tests/integration/targets/k8s_apply/tasks/main.yml

@@ -26,7 +26,8 @@
       assert:
         that:
           - k8s_configmap is changed
-          - k8s_configmap.result.metadata.annotations|default(False)
+          - '"annotations" in k8s_configmap.result.metadata'
+          - k8s_configmap.result.metadata.annotations != {}
 
     - name: Add same configmap again
       k8s:
@@ -291,36 +292,34 @@
 
     - name: Add a deployment
       k8s:
+        namespace: "{{ test_namespace }}"
         definition:
+          definition:
           apiVersion: apps/v1
           kind: Deployment
           metadata:
             name: apply-deploy
-            namespace: "{{ test_namespace }}"
+            labels:
+              app: apply-deploy
           spec:
             replicas: 1
             selector:
               matchLabels:
-                app: "{{ k8s_pod_name }}"
-            template: "{{ k8s_pod_template }}"
+                app: apply-deploy
+            template:
+              metadata:
+                labels:
+                  app: apply-deploy
+              spec:
+                serviceAccount: apply-deploy
+                containers:
+                  - name: nginx
+                    image: nginx:latest
+                    ports:
+                      - containerPort: 80
         wait: yes
         wait_timeout: "{{ k8s_wait_timeout | default(omit) }}"
         apply: yes
-      vars:
-        k8s_pod_name: apply-deploy
-        k8s_pod_image: gcr.io/kuar-demo/kuard-amd64:v0.10.0-green
-        k8s_pod_service_account: apply-deploy
-        k8s_pod_ports:
-          - containerPort: 8080
-            name: http
-            protocol: TCP
-        k8s_pod_resources:
-          requests:
-            cpu: 100m
-            memory: 100Mi
-          limits:
-            cpu: 100m
-            memory: 100Mi
 
     - name: Update the earlier deployment in check mode
       k8s:
@@ -334,33 +333,29 @@
             replicas: 1
             selector:
               matchLabels:
-                app: "{{ k8s_pod_name }}"
-            template: "{{ k8s_pod_template }}"
+                app: apply-deploy
+            template:
+              metadata:
+                labels:
+                  app: apply-deploy
+              spec:
+                serviceAccount: apply-deploy
+                containers:
+                  - name: nginx-2
+                    image: nginx:latest
+                    ports:
+                      - containerPort: 80
         wait: yes
         wait_timeout: "{{ k8s_wait_timeout | default(omit) }}"
         apply: yes
       check_mode: yes
-      vars:
-        k8s_pod_name: apply-deploy
-        k8s_pod_image: gcr.io/kuar-demo/kuard-amd64:v0.10.0-purple
-        k8s_pod_service_account: apply-deploy
-        k8s_pod_ports:
-          - containerPort: 8080
-            name: http
-            protocol: TCP
-        k8s_pod_resources:
-          requests:
-            cpu: 50m
-          limits:
-            cpu: 50m
-            memory: 50Mi
       register: update_deploy_check_mode
 
     - name: Ensure check mode change took
       assert:
         that:
           - update_deploy_check_mode is changed
-          - "update_deploy_check_mode.result.spec.template.spec.containers[0].image == 'gcr.io/kuar-demo/kuard-amd64:v0.10.0-purple'"
+          - "update_deploy_check_mode.result.spec.template.spec.containers[0].name == 'nginx-2'"
 
     - name: Update the earlier deployment
       k8s:
@@ -374,32 +369,28 @@
             replicas: 1
             selector:
               matchLabels:
-                app: "{{ k8s_pod_name }}"
-            template: "{{ k8s_pod_template }}"
+                app: apply-deploy
+            template:
+              metadata:
+                labels:
+                  app: apply-deploy
+              spec:
+                serviceAccount: apply-deploy
+                containers:
+                  - name: nginx-2
+                    image: nginx:latest
+                    ports:
+                      - containerPort: 80
         wait: yes
         wait_timeout: "{{ k8s_wait_timeout | default(omit) }}"
         apply: yes
-      vars:
-        k8s_pod_name: apply-deploy
-        k8s_pod_image: gcr.io/kuar-demo/kuard-amd64:v0.10.0-purple
-        k8s_pod_service_account: apply-deploy
-        k8s_pod_ports:
-          - containerPort: 8080
-            name: http
-            protocol: TCP
-        k8s_pod_resources:
-          requests:
-            cpu: 50m
-          limits:
-            cpu: 50m
-            memory: 50Mi
       register: update_deploy_for_real
 
     - name: Ensure change took
       assert:
         that:
           - update_deploy_for_real is changed
-          - "update_deploy_for_real.result.spec.template.spec.containers[0].image == 'gcr.io/kuar-demo/kuard-amd64:v0.10.0-purple'"
+          - "update_deploy_for_real.result.spec.template.spec.containers[0].name == 'nginx-2'"
 
     - name: Remove the serviceaccount
       k8s:
@@ -423,27 +414,23 @@
             replicas: 1
             selector:
               matchLabels:
-                app: "{{ k8s_pod_name }}"
-            template: "{{ k8s_pod_template }}"
+                app: apply-deploy
+            template:
+              metadata:
+                labels:
+                  app: apply-deploy
+              spec:
+                serviceAccount: apply-deploy
+                containers:
+                  - name: nginx-3
+                    image: nginx:latest
+                    ports:
+                      - containerPort: 80
         wait: yes
         wait_timeout: "{{ k8s_wait_timeout | default(omit) }}"
         apply: yes
-      vars:
-        k8s_pod_name: apply-deploy
-        k8s_pod_image: gcr.io/kuar-demo/kuard-amd64:v0.10.0-green
-        k8s_pod_service_account: apply-deploy
-        k8s_pod_ports:
-          - containerPort: 8080
-            name: http
-            protocol: TCP
-        k8s_pod_resources:
-          requests:
-            cpu: 50m
-          limits:
-            cpu: 50m
-            memory: 50Mi
+      ignore_errors: true
       register: deploy_after_serviceaccount_removal
-      ignore_errors: yes
 
     - name: Ensure that updating deployment after service account removal failed
       assert:
@@ -467,7 +454,7 @@
       assert:
         that:
           - k8s_secret is changed
-          - k8s_secret.result.data.foo
+          - k8s_secret.result.data.foo != ""
 
     - name: Add same secret
       k8s:
@@ -748,7 +735,7 @@
       assert:
         that:
           - _create is changed
-          - not _info.resources
+          - _info.resources | length == 0
 
     # server side apply over kubernetes client releases
     - name: Create temporary directory