From a34ff4be9154818d77ff187c9a03341c769d07b4 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 19 Sep 2026 12:28:16 +1000
Subject: [PATCH] Pin helm capabilities version to the validation target

Render charts with --helm-kube-version from ci/kube-version so kustomize
no longer inherits the local helm binary's default Kubernetes version.
---
 Makefile                | 4 +++-
 ci/kube-version         | 1 +
 ci/validate-apps.sh     | 5 +++--
 ci/validate-clusters.sh | 5 +++--
 4 files changed, 10 insertions(+), 5 deletions(-)
 create mode 100644 ci/kube-version

diff --git a/Makefile b/Makefile
index 37ed939..100ae8a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,10 +1,12 @@
 .PHONY: build clean schemas
 
+KUBE_VERSION := $(shell cat ci/kube-version)
+
 # Build a kustomization path to manifests directory
 # Usage: make build clusters/au-syd1/bootstrap
 build:
 	@mkdir -p manifests/$(filter-out $@,$(MAKECMDGOALS))
-	@kustomize build --enable-helm $(filter-out $@,$(MAKECMDGOALS)) --output manifests/$(filter-out $@,$(MAKECMDGOALS))
+	@kustomize build --enable-helm --helm-kube-version $(KUBE_VERSION) $(filter-out $@,$(MAKECMDGOALS)) --output manifests/$(filter-out $@,$(MAKECMDGOALS))
 
 # Generate JSON schemas from CRDs and Kubernetes swagger spec (run manually, results committed)
 schemas:
diff --git a/ci/kube-version b/ci/kube-version
new file mode 100644
index 0000000..1304b01
--- /dev/null
+++ b/ci/kube-version
@@ -0,0 +1 @@
+1.33.7
diff --git a/ci/validate-apps.sh b/ci/validate-apps.sh
index 2e6c1e7..c925d52 100755
--- a/ci/validate-apps.sh
+++ b/ci/validate-apps.sh
@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-KUBE_VERSION="1.33.7"
+REPO_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+KUBE_VERSION="$(cat "$REPO_ROOT/ci/kube-version")"
 
 SCHEMA_DIR="${SCHEMA_DIR:-schemas}"
 
@@ -15,7 +16,7 @@ while IFS= read -r -d "" k; do
   dir="$(dirname "$k")"
   echo "==> kubeconform: $dir" >&2
 
-  kustomize build --enable-helm "$dir" \
+  kustomize build --enable-helm --helm-kube-version "$KUBE_VERSION" "$dir" \
     | kubeconform \
         -kubernetes-version "$KUBE_VERSION" \
         -summary \
diff --git a/ci/validate-clusters.sh b/ci/validate-clusters.sh
index eb1dee0..9395d7f 100755
--- a/ci/validate-clusters.sh
+++ b/ci/validate-clusters.sh
@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-KUBE_VERSION="1.33.7"
+REPO_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+KUBE_VERSION="$(cat "$REPO_ROOT/ci/kube-version")"
 
 SCHEMA_DIR="${SCHEMA_DIR:-schemas}"
 
@@ -15,7 +16,7 @@ while IFS= read -r -d "" k; do
   dir="$(dirname "$k")"
   echo "==> kubeconform: $dir" >&2
 
-  kustomize build --enable-helm "$dir" \
+  kustomize build --enable-helm --helm-kube-version "$KUBE_VERSION" "$dir" \
     | kubeconform \
         -kubernetes-version "$KUBE_VERSION" \
         -summary \