From fc4116f4f454a2eb568c1f69bb6dd59f40d1a4a9 Mon Sep 17 00:00:00 2001
From: rhjcd <jdisrael@redhat.com>
Date: Tue, 14 Jul 2026 14:13:19 -0700
Subject: [PATCH] Fix showroom helm install for non-root EE containers

The helm install task used become: true to install to /usr/local/bin
with root ownership. RHDP execution environments run as uid 1000
without sudo, causing a fatal "sudo: command not found" error.

Add a rescue block that falls back to installing helm in
~/.local/bin when become fails. Set _showroom_helm_binary fact
so helm_template tasks use the correct binary path regardless
of install location.
---
 .../tasks/check-and-install-helm.yaml         | 60 ++++++++++++++++---
 .../tasks/deploy-showroom-helm-zerotouch.yaml |  1 +
 .../tasks/deploy-showroom-helm.yaml           |  1 +
 3 files changed, 55 insertions(+), 7 deletions(-)

diff --git a/ansible/roles_ocp_workloads/ocp4_workload_showroom/tasks/check-and-install-helm.yaml b/ansible/roles_ocp_workloads/ocp4_workload_showroom/tasks/check-and-install-helm.yaml
index b799c2182f..802660c685 100644
--- a/ansible/roles_ocp_workloads/ocp4_workload_showroom/tasks/check-and-install-helm.yaml
+++ b/ansible/roles_ocp_workloads/ocp4_workload_showroom/tasks/check-and-install-helm.yaml
@@ -9,8 +9,13 @@
     path: /usr/bin/helm
   register: r_helm_installed
 
+- name: Check if helm is in ~/.local/bin
+  ansible.builtin.stat:
+    path: "{{ ansible_user_dir }}/.local/bin/helm"
+  register: r_helm_installed_user
+
 - name: Install Helm if it's not there
-  when: not (r_helm_installed_local.stat.exists or r_helm_installed.stat.exists)
+  when: not (r_helm_installed_local.stat.exists or r_helm_installed.stat.exists or r_helm_installed_user.stat.exists)
   block:
   - name: Set URL for helm
     ansible.builtin.set_fact:
@@ -44,10 +49,51 @@
     - name: Create Helm Bash completion file
       ansible.builtin.shell: /usr/local/bin/helm completion bash >/etc/bash_completion.d/helm
 
-  - name: Get helm version
-    ansible.builtin.shell: /usr/local/bin/helm version
-    register: r_helm_version
+    rescue:
+    - name: Install Helm to user-writable location (no sudo available)
+      block:
+      - name: Create ~/.local/bin directory
+        ansible.builtin.file:
+          path: "{{ ansible_user_dir }}/.local/bin"
+          state: directory
+          mode: "0755"
+
+      - name: Download and extract helm to temp directory
+        ansible.builtin.unarchive:
+          src: "{{ helm_url }}"
+          remote_src: true
+          dest: "{{ ansible_user_dir }}/.local/bin"
+          mode: "0775"
+        retries: 10
+        register: r_client
+        until: r_client is success
+        delay: 30
+
+      - name: Link extracted helm binary
+        ansible.builtin.file:
+          src: "{{ ansible_user_dir }}/.local/bin/linux-amd64/helm"
+          dest: "{{ ansible_user_dir }}/.local/bin/helm"
+          state: link
+
+      - name: Update r_helm_installed_user fact
+        ansible.builtin.set_fact:
+          r_helm_installed_user:
+            stat:
+              exists: true
+
+- name: Set helm binary path
+  ansible.builtin.set_fact:
+    _showroom_helm_binary: >-
+      {% if r_helm_installed_local.stat.exists %}/usr/local/bin/helm{%
+      elif r_helm_installed.stat.exists %}/usr/bin/helm{%
+      elif r_helm_installed_user.stat.exists | default(false) %}{{ ansible_user_dir }}/.local/bin/helm{%
+      else %}/usr/local/bin/helm{% endif %}
+
+- name: Get helm version
+  ansible.builtin.command: "{{ _showroom_helm_binary }} version"
+  register: r_helm_version
+  changed_when: false
 
-  - name: Emit Helm version
-    ansible.builtin.debug:
-      msg: "Helm version installed: {{ r_helm_version.stdout }}"
+- name: Emit Helm version
+  ansible.builtin.debug:
+    msg: "Helm version installed: {{ r_helm_version.stdout }}"
diff --git a/ansible/roles_ocp_workloads/ocp4_workload_showroom/tasks/deploy-showroom-helm-zerotouch.yaml b/ansible/roles_ocp_workloads/ocp4_workload_showroom/tasks/deploy-showroom-helm-zerotouch.yaml
index 5aa56a60f5..62e58aab12 100644
--- a/ansible/roles_ocp_workloads/ocp4_workload_showroom/tasks/deploy-showroom-helm-zerotouch.yaml
+++ b/ansible/roles_ocp_workloads/ocp4_workload_showroom/tasks/deploy-showroom-helm-zerotouch.yaml
@@ -10,6 +10,7 @@
   environment:
     KUBECONFIG: "{{ _showroom_kubeconfig | default(omit) }}"
   kubernetes.core.helm_template:
+    binary_path: "{{ _showroom_helm_binary | default(omit) }}"
     chart_repo_url: "{{ ocp4_workload_showroom_chart_package_url }}"
     chart_ref: "{{ ocp4_workload_showroom_deployer_chart_name }}"
     chart_version: "{{ ocp4_workload_showroom_deployer_chart_version }}"
diff --git a/ansible/roles_ocp_workloads/ocp4_workload_showroom/tasks/deploy-showroom-helm.yaml b/ansible/roles_ocp_workloads/ocp4_workload_showroom/tasks/deploy-showroom-helm.yaml
index ff93df8754..370a434eb4 100644
--- a/ansible/roles_ocp_workloads/ocp4_workload_showroom/tasks/deploy-showroom-helm.yaml
+++ b/ansible/roles_ocp_workloads/ocp4_workload_showroom/tasks/deploy-showroom-helm.yaml
@@ -10,6 +10,7 @@
   environment:
     KUBECONFIG: "{{ _showroom_kubeconfig | default(omit) }}"
   kubernetes.core.helm_template:
+    binary_path: "{{ _showroom_helm_binary | default(omit) }}"
     chart_repo_url: "{{ ocp4_workload_showroom_chart_package_url }}"
     chart_ref: "{{ ocp4_workload_showroom_deployer_chart_name }}"
     chart_version: "{{ ocp4_workload_showroom_deployer_chart_version }}"