Match the build-time helm binary to the linked helm library (release-v1.40)

[dimitri-nicolo]

HELM3_VERSION v3.11.3 → v3.21.3. Clean cherry-pick of the release-v1.42 change (#5214) — the two branches share the chart version and resources file.

This is the helm program hack/bin downloads to render the Envoy Gateway chart into pkg/render/gatewayapi/gateway_api_resources.yaml at build time. It's a build tool — it never ships in the operator image — and it's separate from the helm.sh/helm/v3 library the operator links, which is already on v3.21.3. The binary had been left on a 2021 release, ten minors behind.

The regenerated resources file is committed alongside, because the make rule keys off the versioned binary name and would otherwise re-render it and fail dirty-check.

The upgrade is inert

Across 58,298 lines the only change is nine comment lines, where helm now records the full chart path in the source comment:

-# Source: crds/gatewayapi-crds.yaml
+# Source: gateway-helm/charts/crds/crds/gatewayapi-crds.yaml

No Kubernetes resource changes — not a field, not an ordering, not a generated label. Those nine lines are YAML comments, dropped at parse time.

v3.11.3 re-renders the committed file byte for byte, so the comparison is against a faithful baseline rather than a file that had drifted from its generator.

---

⚠️ Two pre-existing problems on this branch, found while testing this

Neither is caused by this change, and this PR does not fix either. Both need a separate decision.

1. The gatewayapi unit tests cannot pass on this branch

go test ./pkg/render/gatewayapi/... panics, on the untouched base branch and with this change alike — byte-identically:

missing/extra k8s CRDs from gateway API YAML (12 != 11)
  pkg/render/gatewayapi/gateway_api.go:295

The committed YAML carries 12 Gateway API CRDs; gateway_api.go asserts exactly 11.

This looks like more than a stale test. gateway_api_resources.yaml is //go:embed-ed into the operator binary, and the panic sits in the lazily-called GatewayAPIResourcesGetter closure — so on the face of it a shipped release-v1.40 operator would panic the first time it renders Gateway API resources. Someone who knows this code should confirm whether that path is reachable in production.

2. CI cannot report a UT failure on this branch

The panic above is already in CI logs, and the job still reports green. The UT step is:

- make ut 2>&1 | tee ut.log        # release-v1.40

Without set -o pipefail, the step's exit status is tee's, which is always 0. Every UT failure on this branch is silently swallowed.

master and release-v1.42 already carry the fix:

- set -o pipefail; make ut 2>&1 | tee ut.log

(release-v1.41 doesn't pipe at all, so it's unaffected.) Worth picking that one-liner onto this branch — and note that until it lands, this PR's own green CI proves nothing about the tests.

Release note:

None

[Copilot]

Pull request overview

This PR updates the build-time Helm v3 binary version used by the Makefile to match the already-upgraded helm.sh/helm/v3 Go library version, and commits the corresponding regenerated Envoy Gateway rendered resources file so build-time dirty checks remain stable.

Changes:

• Bump HELM3_VERSION from v3.11.3 to v3.21.3 in the build tooling.
• Update the committed, rendered gateway_api_resources.yaml output to reflect Helm’s updated # Source: comment formatting (no Kubernetes resource spec/content changes).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
Makefile	Updates the build-time Helm binary version to v3.21.3, aligning with the existing Go Helm library version and the download/extract rules.
pkg/render/gatewayapi/gateway_api_resources.yaml	Regenerated output; only # Source: comment paths change to include full chart paths.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.