Ignore force replace when server-side apply is enabled

ForceReplace (PUT) is incompatible with SSA (Apply) in the Helm SDK,
which rejects the combination. Since ForceReplace does not handle
immutable field updates anyway (it does a PUT, not delete+recreate),
it is safe to ignore when SSA is active.

Move ForceReplace assignment from the action constructors to after SSA
resolution, setting it only when SSA is disabled.

Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>

Author: matheuscscp

internal/action/rollback.go

@@ -91,6 +91,7 @@ func Rollback(config *helmaction.Configuration, obj *v2.HelmRelease,
 		rollback.ServerSideApply = fmt.Sprint(serverSideApply)
 	}
 	rollback.ForceConflicts = serverSideApply // We always force conflicts on server-side apply.
+	rollback.ForceReplace = obj.GetRollback().Force && !serverSideApply
 
 	return rollback.Run(releaseName)
 }
@@ -109,7 +110,6 @@ func newRollback(config *helmaction.Configuration, obj *v2.HelmRelease,
 	rollback.WaitStrategy = getWaitStrategy(obj.GetWaitStrategy(), obj.GetRollback())
 	rollback.WaitForJobs = !obj.GetRollback().DisableWaitForJobs
 	rollback.DisableHooks = obj.GetRollback().DisableHooks
-	rollback.ForceReplace = obj.GetRollback().Force
 	rollback.CleanupOnFail = obj.GetRollback().CleanupOnFail
 	rollback.MaxHistory = obj.GetMaxHistory()
 

internal/action/rollback_test.go

@@ -48,7 +48,9 @@ func Test_newRollback(t *testing.T) {
 		got := newRollback(&helmaction.Configuration{}, obj, 0, nil)
 		g.Expect(got).ToNot(BeNil())
 		g.Expect(got.Timeout).To(Equal(obj.Spec.Rollback.Timeout.Duration))
-		g.Expect(got.ForceReplace).To(Equal(obj.Spec.Rollback.Force))
+		// ForceReplace is not set in the constructor; it is set after SSA resolution
+		// in Rollback() to avoid the Helm SDK mutual exclusivity error.
+		g.Expect(got.ForceReplace).To(BeFalse())
 		g.Expect(got.MaxHistory).To(Equal(obj.GetMaxHistory()))
 	})
 

internal/action/upgrade.go

@@ -75,6 +75,7 @@ func Upgrade(ctx context.Context, config *helmaction.Configuration, obj *v2.Helm
 		upgrade.ServerSideApply = fmt.Sprint(serverSideApply)
 	}
 	upgrade.ForceConflicts = serverSideApply // We always force conflicts on server-side apply.
+	upgrade.ForceReplace = obj.GetUpgrade().Force && !serverSideApply
 
 	policy, err := crdPolicyOrDefault(obj.GetUpgrade().CRDs)
 	if err != nil {
@@ -116,7 +117,6 @@ func newUpgrade(config *helmaction.Configuration, obj *v2.HelmRelease, opts []Up
 	upgrade.DisableHooks = obj.GetUpgrade().DisableHooks
 	upgrade.DisableOpenAPIValidation = obj.GetUpgrade().DisableOpenAPIValidation
 	upgrade.SkipSchemaValidation = obj.GetUpgrade().DisableSchemaValidation
-	upgrade.ForceReplace = obj.GetUpgrade().Force
 	upgrade.CleanupOnFail = obj.GetUpgrade().CleanupOnFail
 	upgrade.Devel = true
 

internal/action/upgrade_test.go

@@ -49,7 +49,9 @@ func Test_newUpgrade(t *testing.T) {
 		g.Expect(got).ToNot(BeNil())
 		g.Expect(got.Namespace).To(Equal(obj.Namespace))
 		g.Expect(got.Timeout).To(Equal(obj.Spec.Upgrade.Timeout.Duration))
-		g.Expect(got.ForceReplace).To(Equal(obj.Spec.Upgrade.Force))
+		// ForceReplace is not set in the constructor; it is set after SSA resolution
+		// in Upgrade() to avoid the Helm SDK mutual exclusivity error.
+		g.Expect(got.ForceReplace).To(BeFalse())
 	})
 
 	t.Run("timeout fallback", func(t *testing.T) {