Documentation Index
Fetch the complete documentation index at: https://resources.devweekends.com/llms.txt
Use this file to discover all available pages before exploring further.
Helm Package Manager
Helm is the package manager for Kubernetes. It helps you define, install, and upgrade even the most complex Kubernetes application. If Kubernetes is an operating system for the cloud, Helm is itsapt-get or npm — a way to install, configure, and manage applications as a single unit rather than juggling dozens of individual YAML files.
Why Helm?
Without Helm, deploying a real application to Kubernetes means managing a Deployment, a Service, a ConfigMap, a Secret, an Ingress, and possibly a dozen more resources — each in its own YAML file, each needing environment-specific values hardcoded or templated by hand. Multiply that by dev, staging, and production, and you quickly drown in copy-paste YAML. Helm solves this with Charts.Package Management
Find, share, and use software built for Kubernetes (like
apt or npm).Templating
Use a single template for Dev, Staging, and Prod environments.
Release Management
Easy upgrades and rollbacks with revision history.
Dependency Management
Manage dependencies (e.g., your app needs Redis).
Core Concepts
Think of Helm like installing an application on your phone. The Chart is the app package in the store. The Release is the installed instance on your phone. You can install the same app multiple times (e.g., two Redis instances with different names). And a Repository is the app store where you browse available packages.- Chart: A bundle of templates, default values, and metadata that defines a Kubernetes application. Charts are versioned and can declare dependencies on other charts.
- Config (values.yaml): The configuration that customizes a chart for a specific deployment. This is where you set replica counts, image tags, resource limits, and environment-specific settings.
- Release: A running instance of a chart, combined with a specific config. Each release has a unique name and maintains a revision history for rollbacks.
- Repository: A place where charts can be collected and shared. Artifact Hub is the public registry; teams often run private OCI registries for internal charts.
Using Helm
1. Installation
2. Installing a Chart
Install Redis using the Bitnami chart. One command replaces what would otherwise be creating a StatefulSet, Service, ConfigMap, Secret, and PVC by hand.3. Customizing Installation (values.yaml)
You can override default settings using avalues.yaml file or CLI flags. In practice, you almost always need to customize — the chart defaults are a starting point, not a production-ready configuration.
Creating Your Own Chart
Structure
Templating Example
Helm uses Go templates. The{{ .Values.x }} syntax pulls from values.yaml, {{ .Release.Name }} comes from the release metadata, and _helpers.tpl defines reusable named templates. If you have used Jinja2 or Mustache, the concepts are identical.
values.yaml:
Validating Before Deploying
Managing Releases
Helm tracks every install and upgrade as a numbered revision. This is your safety net — if an upgrade breaks something, rollback to the last known-good revision.Common Pitfalls
Interview Questions & Answers
What problem does Helm solve?
What problem does Helm solve?
Helm solves three problems: 1) Templating — one chart works across dev, staging, and prod by substituting values. 2) Package management — install complex applications (e.g., Prometheus with all its components) with a single command. 3) Release management — track revisions, upgrade atomically, and rollback when things go wrong. Without Helm, teams end up building ad-hoc templating with sed, envsubst, or Kustomize overlays, which works until you need rollback history.
What is the difference between Helm and Kustomize?
What is the difference between Helm and Kustomize?
Helm uses templating (Go templates with
values.yaml). Charts are shareable packages. Helm tracks releases and supports rollback.Kustomize uses overlays and patches (no templates). Built into kubectl (kubectl apply -k). No release tracking or rollback.When to use which: Use Helm for third-party applications (community charts) and when you need release management. Use Kustomize for simple internal applications where overlays are sufficient. Many teams use both — Helm for installing third-party software, Kustomize for their own applications.How do you manage secrets in Helm?
How do you manage secrets in Helm?
Never put secrets in plain-text values.yaml files committed to Git. Options:
- helm-secrets plugin: Encrypts values files using SOPS/AGE/PGP before committing to Git
- External Secrets Operator: Helm chart deploys ExternalSecret resources that sync from Vault/AWS Secrets Manager
- CI/CD injection: Pipeline injects secrets via
--setfrom a secret store at deploy time - Sealed Secrets: Encrypt secrets with a cluster-side key; safe to commit the encrypted form
Key Takeaways
- Helm is the standard package manager for Kubernetes. Learn it — you will use it every day.
- Use Repositories (Artifact Hub) to find existing software instead of writing charts from scratch.
- Use values.yaml files per environment checked into Git for reproducibility and auditability.
- Always use
--versionto pin chart versions in production and CI/CD. - Use
helm upgrade --atomicfor safe deployments with automatic rollback on failure. - Use
helm templateandhelm diffto preview changes before applying them. - Helm and Kustomize are complementary, not competing — many production teams use both.
Interview Deep-Dive
Your team uses Helm to deploy a critical service. A developer runs 'helm upgrade' with a bad values file and the service goes down. Walk me through how you recover and what guardrails you would put in place.
Your team uses Helm to deploy a critical service. A developer runs 'helm upgrade' with a bad values file and the service goes down. Walk me through how you recover and what guardrails you would put in place.
Strong Answer:
- Immediate recovery: run
helm rollback <release> <previous-revision>. Helm stores every revision as a Kubernetes Secret (or ConfigMap, depending on the storage driver), so rollback is near-instant. I would checkhelm history <release>to confirm which revision was healthy and roll back to that specific one. - While rolling back, I would also check
kubectl get podsto see if the old pods are still in a Terminating state or if new broken pods are in CrashLoopBackOff. If the rollback does not fix pod health immediately, I might need to check whether the bad values corrupted a persistent resource (like a PVC or a ConfigMap) that the rollback does not revert. - Guardrails: First,
helm diff(a Helm plugin) should be mandatory before every upgrade — it shows exactly what Kubernetes resources will change. Second, CI/CD should runhelm templateand pipe the output throughkubevalorkubeconformto validate the rendered manifests against the Kubernetes API schema. Third, use--atomiconhelm upgrade, which automatically rolls back if the release does not reach a healthy state within the timeout. Fourth, lock down production Helm releases behind a CI/CD pipeline so developers cannot run ad-hoc upgrades.
helm upgrade --atomic and helm upgrade --wait?--wait makes the command block until all resources are in a ready state (pods running, jobs complete), but if readiness is never achieved, the release stays in a failed state and you have to manually roll back. --atomic does everything --wait does, but additionally rolls back automatically on failure. In production, I always use --atomic because a failed release sitting in limbo at 3 AM is worse than an automatic rollback.How does Helm store release state, and what happens if that state is corrupted or deleted?
How does Helm store release state, and what happens if that state is corrupted or deleted?
Strong Answer:
- Helm 3 stores each release revision as a Kubernetes Secret in the release’s namespace, with the type
helm.sh/release.v1. Each Secret contains the rendered manifests, the chart metadata, and the values used for that revision. The labelowner=helmidentifies these Secrets. - If those Secrets are deleted, Helm loses all knowledge of the release.
helm listshows nothing,helm upgradefails because it cannot find a previous release to diff against, but the actual Kubernetes resources (Deployments, Services, ConfigMaps) still exist and keep running. - Recovery options: you can re-import the release using
helm install --replacewith the exact same values (risky if you do not have the values), or use community tools likehelm-mapkubeapisor manually recreate the Secrets from backup. This is why etcd backups and namespace-level backup strategies (Velero) are important — they capture the Helm release Secrets along with everything else. - A more insidious problem is Secret size. If your chart renders a very large set of manifests, the release Secret can exceed the 1MB etcd value size limit. Helm will fail silently or with a cryptic error. I have seen this happen with charts that embed large ConfigMaps or have many subcharts. The fix is to refactor the chart to reduce rendered size, or switch Helm’s storage driver to a SQL backend.
kube-system namespace. Helm 3 removed Tiller and stores releases as Secrets in the release namespace. The official helm-2to3 plugin handles the migration: it converts ConfigMap-based release records to Secrets and moves them to the correct namespace. The actual Kubernetes resources do not change. The main risk is that Helm 3 changed how it tracks resource ownership annotations, so you need to verify that helm upgrade works correctly after migration by running a dry-run first.You need to deploy the same application across 15 Kubernetes clusters in different regions. How would you structure your Helm workflow?
You need to deploy the same application across 15 Kubernetes clusters in different regions. How would you structure your Helm workflow?
Strong Answer:
- I would use a layered values strategy. One
values.yamlfile contains the application defaults (image, resource requests, probe configuration). Per-environment files (values-prod.yaml,values-staging.yaml) override environment-specific settings. Per-cluster files (values-us-east-1.yaml,values-eu-west-1.yaml) override region-specific settings like replica counts, ingress hostnames, and cloud provider annotations. - At deploy time, Helm merges values files in order, with later files taking precedence:
helm upgrade -f values.yaml -f values-prod.yaml -f values-us-east-1.yaml. - For the deployment orchestration across 15 clusters, I would use a GitOps tool like ArgoCD or Flux. Each cluster has an ArgoCD Application pointing to the same chart in a Git repo but with a different values overlay path. When a developer merges a change to the chart or values, ArgoCD detects the drift and syncs each cluster automatically.
- For chart versioning, I would publish the chart to an OCI-compatible registry (like ECR or Harbor) with semantic versioning. ArgoCD applications pin to a specific chart version, and promoting a new version is a separate pull request that updates the version reference.
prod/us-east-1/database-url. The secret values live in the secrets store, not in Git. When a new cluster is provisioned, you create the corresponding secrets in the regional store, and ESO pulls them automatically. This way, the Helm chart is identical across clusters — only the secrets store content differs per region.Next: Kubernetes Architecture →