helm install fails ebcause of invalid labels for the resources

[heathcliff26]

I'm trying to install the helm chart using flux, however currently the installation fails because the labels added to the resource are invalid:

(combined from similar events): Helm install failed for release kasm/kasm with chart kasm-helm@1.1190.6+fa7cb6daee12: failed pre-install: warning: Hook pre-install kasm-helm/templates/kasm-password-secret.yaml failed: server-side apply failed for object kasm/kasm-secrets /v1, Kind=Secret: Secret "kasm-secrets" is invalid: metadata.labels: Invalid value: "kasm-helm-1.1190.6+fa7cb6daee12": a valid label must be an empty string or consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyValue', or 'my_value', or '12345', regex used for validation is '(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?') Last Helm logs: 2026-08-01T09:12:17.251179308Z: starting delete resource: {"kind":"Secret","name":"kasm-secrets","namespace":"kasm"} 2026-08-01T09:12:17.252750304Z: ignoring delete failure: {"error":{"ErrStatus":{"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"secrets \"kasm-secrets\" not found","reason":"NotFound","details":{"name":"kasm-secrets","kind":"secrets"},"code":404}},"kind":"Secret","name":"kasm-secrets","namespace":"kasm"} 2026-08-01T09:12:17.37006854Z: creating resource(s): {"resources":1} 2026-08-01T09:12:17.370074151Z: using server-side apply for resource creation: {"dryRun":false,"fieldValidationDirective":"Strict","forceConflicts":false} 2026-08-01T09:12:17.372483385Z: Error creating resource via patch: {"error":{},"gvk":"/v1, Kind=Secret","name":"kasm-secrets","namespace":"kasm"}

The label kasm-helm-1.1190.6+fa7cb6daee12 is an invalid kubernetes name.
It seems the label is applied to all resources, as pre-creating the passwords only changes which resource it errors on.

Here is my flux manifests:

---
apiVersion: source.toolkit.fluxcd.io/v1
kind: OCIRepository
metadata:
  name: kasm
  namespace: flux-system
spec:
  interval: 24h
  url: oci://registry-1.docker.io/kasmweb/kasm-helm
  ref:
    tag: "1.1190.6"
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: kasm
  namespace: flux-system
spec:
  interval: 30m
  targetNamespace: kasm
  releaseName: kasm
  chartRef:
    kind: OCIRepository
    name: kasm
    namespace: flux-system
  upgrade:
    remediation:
      retries: -1
  install:
    remediation:
      retries: -1
  uninstall:
    keepHistory: false
  values:
    publicAddr: "<url>"
    proxyService:
      type: ClusterIP
    ingress:
      enabled: true
      ingressClassName: cloudflare-tunnel
      tls: true
    certificate:
      secretName: kasm-tls
      certManager:
        enabled: true
        addWildCard: false
        issuerName: letsencrypt-production
        issuerKind: ClusterIssuer
    database:
      storage:
        storageClassName: "p3-hdd-ephemeral"
        retentionPolicy:
          whenDeleted: Retain
          whenScaled: Retain

[heathcliff26]

Interestingly running helm manually seems to work:

helm install kasm oci://registry-1.docker.io/kasmweb/kasm-helm --version 1.1190.0 -n kasm -f values.yaml

[heathcliff26]

Okay, it seems the issue only occures when using the oci image. Using the helm repository instead works.

I'm not sure if the issue is with the oci artifact or fluxcd, as none of my other ocirepositories show the same problem.