Duplicate label on ConfigMap causes helm install to fail via FluxCD

[matt-at-bunny]

Expected vs actual behavior

Expected: Paralus v0.2.9 is installed via Helm Chart successfully when using FluxCD
Actual: Post-render step and installation fails due to duplicate app.kubernetes.io/component label

Steps to reproduce the bug

1. Create a local kind cluster: kind create cluster
2. Install Flux on the cluster: kubectl apply -f https://github.com/fluxcd/flux2/releases/latest/download/install.yaml
3. Wait for resources to come up in the flux-system namespace
4. Create barebones HelmRepository and HelmRelease resources for Flux to install 0.2.9:

---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
  name: paralus
  namespace: flux-system
spec:
  interval: 12h0m0s
  url: https://paralus.github.io/helm-charts
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: paralus
  namespace: flux-system
spec:
  releaseName: paralus
  chart:
    spec:
      chart: ztka
      reconcileStrategy: ChartVersion
      sourceRef:
        kind: HelmRepository
        name: paralus
      version: "0.2.9"
  install:
    createNamespace: true
  interval: 10m0s
  targetNamespace: paralus
  values:
    deploy:
      postgresql:
        enable: true

5. Apply both resources against the cluster
6. Install fails. View helmrelease resource for error:

$ kubectl describe helmrelease paralus
Name:         paralus
Namespace:    flux-system
Labels:       <none>
Annotations:  <none>
API Version:  helm.toolkit.fluxcd.io/v2
Kind:         HelmRelease
Metadata:
  Creation Timestamp:  2025-02-19T17:22:24Z
  Finalizers:
    finalizers.fluxcd.io
  Generation:        1
  Resource Version:  1544
  UID:               5f4065be-555e-46bb-9b42-d200371babf7
Spec:
  Chart:
    Spec:
      Chart:               ztka
      Reconcile Strategy:  ChartVersion
      Source Ref:
        Kind:   HelmRepository
        Name:   paralus
      Version:  >=0.2.*
  Install:
    Create Namespace:  true
  Interval:            10m0s
  Release Name:        paralus
  Target Namespace:    paralus
  Values:
    Deploy:
      Postgresql:
        Enable:  true
Status:
  Conditions:
    Last Transition Time:  2025-02-19T17:22:27Z
    Message:               Running 'install' action with timeout of 5m0s
    Observed Generation:   1
    Reason:                Progressing
    Status:                True
    Type:                  Reconciling
    Last Transition Time:  2025-02-19T17:22:28Z
    Message:               Helm install failed for release paralus/paralus with chart [email protected]: error while running post render on files: map[string]interface {}(nil): yaml: unmarshal errors:
  line 14: mapping key "app.kubernetes.io/component" already defined at line 9
    Observed Generation:   1
    Reason:                InstallFailed
    Status:                False
    Type:                  Ready
    Last Transition Time:  2025-02-19T17:22:27Z
    Message:               Helm install failed for release paralus/paralus with chart [email protected]: error while running post render on files: map[string]interface {}(nil): yaml: unmarshal errors:
  line 14: mapping key "app.kubernetes.io/component" already defined at line 9
    Observed Generation:          1
    Reason:                       InstallFailed
    Status:                       False
    Type:                         Released
  Failures:                       2
  Helm Chart:                     flux-system/flux-system-paralus
  Last Attempted Config Digest:   sha256:b3d7c5001e0cb84511e487596a464f377bfc51ee3ad6edd87511a351a8ac5317
  Last Attempted Generation:      1
  Last Attempted Release Action:  install
  Last Attempted Revision:        0.2.9
  Observed Generation:            -1
  Storage Namespace:              flux-system
Events:
  Type     Reason            Age   From             Message
  ----     ------            ----  ----             -------
  Normal   HelmChartCreated  4s    helm-controller  Created HelmChart/flux-system/flux-system-paralus with SourceRef 'HelmRepository/flux-system/paralus'
  Warning  InstallFailed     2s    helm-controller  Helm install failed for release paralus/paralus with chart [email protected]: error while running post render on files: map[string]interface {}(nil): yaml: unmarshal errors:
  line 14: mapping key "app.kubernetes.io/component" already defined at line 9

Last Helm logs:

2025-02-19T17:22:27.062811632Z: applying CustomResourceDefinition(s) with policy Create
2025-02-19T17:22:27.062813507Z: creating 1 resource(s)
2025-02-19T17:22:27.067431046Z: CustomResourceDefinition contourconfigurations.projectcontour.io is already present. Skipping.
2025-02-19T17:22:27.06743238Z: creating 1 resource(s)
2025-02-19T17:22:27.069853336Z: CustomResourceDefinition extensionservices.projectcontour.io is already present. Skipping.
2025-02-19T17:22:27.069854628Z: creating 1 resource(s)
2025-02-19T17:22:27.07688629Z: CustomResourceDefinition httpproxies.projectcontour.io is already present. Skipping.
2025-02-19T17:22:27.076887582Z: creating 1 resource(s)
2025-02-19T17:22:27.078951955Z: CustomResourceDefinition tlscertificatedelegations.projectcontour.io is already present. Skipping.
  Warning  InstallFailed  1s  helm-controller  Helm install failed for release paralus/paralus with chart [email protected]: error while running post render on files: map[string]interface {}(nil): yaml: unmarshal errors:
  line 14: mapping key "app.kubernetes.io/component" already defined at line 9

Are you using the latest version of the project?

You can check your version by running helm ls|grep '^<deployment-name>' or using pctl, pctl version, and provide the output.

• 0.2.9

What is your environment setup? Please tell us your cloud provider, operating system, and include the output of kubectl version --output=yaml and helm version. Any other information that you have, eg. logs and custom values, is highly appreciated!

kubectl output:

clientVersion:
  buildDate: "1980-01-01T00:00:00Z"
  compiler: gc
  gitCommit: 67a30c0adcf52bd3f56ff0893ce19966be12991f
  gitTreeState: archive
  gitVersion: v1.32.2
  goVersion: go1.23.5
  major: "1"
  minor: "32"
  platform: darwin/arm64
kustomizeVersion: v5.5.0
serverVersion:
  buildDate: "2025-01-15T14:32:38Z"
  compiler: gc
  gitCommit: af64d838aacd9173317b39cf273741816bd82377
  gitTreeState: clean
  gitVersion: v1.31.5
  goVersion: go1.22.10
  major: "1"
  minor: "31"
  platform: linux/amd64

helm output: version.BuildInfo{Version:"v3.16.3", GitCommit:"v3.16.3", GitTreeState:"", GoVersion:"go1.23.3"}

(optional) If you have ideas on why the bug happens or how it can be solved, please provide it here

This is a combination of the changes introduced here. Adding app.kubernetes.io/component: kratos to this include causes a conflict with the app.kubernetes.io/component: configuration label already applied to the kratos-config-hooks ConfigMap here.

Using helm template makes the issue clearer. The generated YAML is invalid :

# Source: ztka/templates/configmap-kratos-hooks.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: kratos-config-hooks
  labels:
    helm.sh/chart: ztka-0.2.9
    app.kubernetes.io/version: "v0.2.8"
    app.kubernetes.io/component: kratos <-- duplicate label
    app.kubernetes.io/part-of: paralus
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kratos-config-hooks
    app.kubernetes.io/instance: paralus
    app.kubernetes.io/component: configuration <-- duplicate label

Passing the output through a YAML linter also flags it up:

$ helm template paralus paralus/ztka --values ./values-test.yaml | yamllint -                                               
stdin
  ...
  364:5     error    duplication of key "app.kubernetes.io/component" in mapping  (key-duplicates)

This isn't caught in a regular helm install because Helm doesn't care about duplicate keys and doesn't validate YAML. Flux's Helm controller however parses and validates YAML, specifically due to using kyaml. Here's a relevant issue in the repo for Flux's helm controller: fluxcd/helm-controller#283.

More to the point, there shouldn't be duplicate keys/invalid YAML at all, and not being able to apply the chart via Flux is a massive pain point.

The fix is very straightforward: remove one of those two labels.

• I've described the bug, included steps to reproduce it, and included my environment setup with all customizations.
• I'm using the latest version of the project.