Skip to content

Helmfile 1.1.6+ uses Debug log level when making requests via the AWS Go SDK #2270

Description

@paulbehrisch

Operating system

OS X 15.6.1

Helmfile Version

1.1.6

Helm Version

3.19.2

Bug description

I use fetchSecretValue in my helmfile.yaml.gotmpl, which relies on the AWS Go SDK

In helmfile version 1.1.5, the helmfile diff behaves like expected

❯ helmfile version
▓▓▓ helmfile

Version            1.1.5


❯ helmfile diff -l cluster=staging
awssecrets: successfully retrieved key=g/argo
awssecrets: successfully retrieved key=g/argo
awssecrets: successfully retrieved key=g/argo
❯ helmfile version

▓▓▓ helmfile

  Version            1.1.6

❯ helmfile diff -l cluster=staging
SDK 2025/11/19 13:11:34 DEBUG Request
GET /federation/credentials?account_id=XXXX&role_name=XXXX HTTP/1.1
Host: portal.sso.ap-southeast-2.amazonaws.com
User-Agent: aws-sdk-go-v2/1.38.3 ua/2.1 os/macos lang/go#1.24.6 md/GOOS#darwin md/GOARCH#arm64 api/sso#1.25.3 m/E
Amz-Sdk-Invocation-Id: 1XXXX
Amz-Sdk-Request: attempt=1; max=3
X-Amz-Sso_bearer_token: XXXX
Accept-Encoding: gzip

SDK 2025/11/19 13:11:35 DEBUG Request
POST / HTTP/1.1
Host: secretsmanager.ap-southeast-2.amazonaws.com
User-Agent: aws-sdk-go-v2/1.38.3 ua/2.1 os/macos lang/go#1.24.6 md/GOOS#darwin md/GOARCH#arm64 api/secretsmanager#1.39.2 m/E,t,u
Content-Length: 26
Amz-Sdk-Invocation-Id: XXXX
Amz-Sdk-Request: attempt=1; max=3
Authorization: AXXXXXXXXX
Content-Type: application/x-amz-json-1.1
X-Amz-Date: XXXXXX
X-Amz-Security-Token: XXXXXXX
X-Amz-Target: secretsmanager.GetSecretValue
Accept-Encoding: gzip

awssecrets: successfully retrieved key=g/argo
SDK 2025/11/19 13:11:35 DEBUG Request

Example helmfile.yaml

{{- $awsRegion := (env "AWS_REGION") | default "ap-southeast-2" -}}

repositories:
  - name: argo
    url: https://argoproj.github.io/argo-helm

releases:
  - name: minimal-rollout
    namespace: argo
    chart: argo/argo-rollouts
    version: 2.40.5
    kubeContext: minimal-context
    values:
      - notifications:
          secret:
            create: true
            items:
              slack-token: {{fetchSecretValue (list "ref+awssecrets://g/argo?region=" $awsRegion "#SLACK_TOKEN" | join "")}}
    labels:
      cluster: minimal-context
      environment: minimal

Error message you've seen (if any)

Requests are made with Debug log level when calling the AWS Go SDK

Steps to reproduce

helmfile diff with version 1.1.6 and fetchSecretValue

Working Helmfile Version

1.1.5

Relevant discussion

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions