Helm

The package manager for Kubernetes. Helm transforms Kubernetes from a low-level resource API into a deployable-application platform by bundling manifests into versioned, configurable, and reusable packages called charts. Synthesized from Helm Zero to Hero by @AbhishekVeeramalla.

The “APT for Kubernetes” Analogy

Helm’s mental model is identical to Linux package managers:

Concept	APT (Ubuntu)	Helm (Kubernetes)
Package	.deb file	Helm Chart (directory of templated YAML)
Install	apt install nginx	helm install my-nginx bitnami/nginx
Version pinning	apt install nginx=1.18.0	helm install my-nginx bitnami/nginx --version 13.0.0
Repository	/etc/apt/sources.list	helm repo add bitnami https://charts.bitnami.com/bitnami
Configuration	/etc/nginx/nginx.conf	values.yaml + --set / --values overrides
Remove	apt remove nginx	helm uninstall my-nginx

Without Helm, installing a production controller like Prometheus, Grafana, Argo CD, or the NGINX Ingress Controller requires manually assembling dozens of YAML files — Deployments, Services, ConfigMaps, RBAC, and sometimes CRDs. Helm collapses this into one command.

Architecture: Helm 3 vs Helm 2

Helm v2 introduced a cluster-side component called Tiller that applied changes on behalf of the client. Tiller ran with cluster-admin privileges and became a security liability.

Helm v3 (current, since 2019) removed Tiller entirely:

• All operations are client-side via the Kubernetes API
• Release history is stored as Secrets in the target Namespace (default) or ConfigMaps (legacy)
• No extra cluster component to install, secure, or upgrade
• Works with any kubeconfig that has sufficient RBAC

Practical implication: helm install on Helm v3 requires zero cluster-side setup. The client speaks directly to kube-apiserver using your existing kubeconfig credentials. Source: Helm Zero to Hero

Core Components

Charts

A Chart is the atomic package unit — a directory of files describing a set of Kubernetes resources. See Helm Charts for deep anatomy and authoring guidance.

Repositories

A Repository is an HTTP-accessible collection of packaged charts. The community convention is GitHub Pages, but any static server (S3, GCS, Artifactory, Nexus) works.

helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update                    # refresh local index
helm search repo nginx              # search for charts
helm search repo nginx --versions   # list all available versions

Releases

A Release is an installed instance of a chart running in a cluster. Helm tracks every release revision, enabling atomic upgrades and instant rollbacks. See Helm Release Management for the full lifecycle.

Essential Commands

# Install a chart from a repository
helm install my-nginx bitnami/nginx
 
# Install with custom values
helm install my-nginx bitnami/nginx --set service.type=NodePort
helm install my-nginx bitnami/nginx -f custom-values.yaml
 
# Preview rendered manifests without deploying
helm template my-nginx bitnami/nginx
 
# List installed releases
helm list
helm list --all-namespaces
 
# Upgrade an existing release
helm upgrade my-nginx bitnami/nginx
 
# Rollback to a previous revision
helm rollback my-nginx 1
 
# Uninstall (remove all resources)
helm uninstall my-nginx
 
# Show chart information
helm show values bitnami/nginx      # default values
helm show readme bitnami/nginx      # documentation
helm show chart bitnami/nginx       # metadata

Templating and Customization

Helm uses Go templates (the text/template package) to parameterize Kubernetes manifests. A chart defines defaults in values.yaml; users override them at install time:

# values.yaml (chart default)
replicaCount: 1
image:
  repository: nginx
  tag: "1.27"
  pullPolicy: IfNotPresent
service:
  type: ClusterIP
  port: 80

# Override at install time
helm install my-nginx ./nginx \
  --set replicaCount=3 \
  --set image.tag=1.28 \
  --set service.type=NodePort

This separation of template (structure) from values (configuration) is what makes charts reusable across environments. The same chart deploys a single-replica dev instance and a hundred-replica production instance.

Dependencies and Sub-charts

A chart can declare dependencies on other charts in Chart.yaml:

dependencies:
  - name: postgresql
    version: 12.0.0
    repository: https://charts.bitnami.com/bitnami
    condition: postgresql.enabled

Helm downloads sub-charts into the charts/ directory and installs them alongside the parent. The condition field allows users to disable a dependency via values.yaml.

Helm in the Ecosystem

Helm is the de facto standard for installing third-party Kubernetes software:

Software	Helm Install Command
NGINX Ingress Controller	helm install ingress-nginx ingress-nginx/ingress-nginx
Prometheus + Grafana	helm install kube-prometheus prometheus-community/kube-prometheus-stack
Argo CD	helm install argo-cd argo/argo-cd
Cert-manager	helm install cert-manager jetstack/cert-manager
MySQL / PostgreSQL	helm install db bitnami/mysql

This ubiquity makes Helm literacy essential for any Kubernetes operator. Source: Helm Zero to Hero

Security Considerations

• Chart provenance: Sign charts with GPG (helm package --sign) and verify with helm install --verify to confirm publisher identity
• Repository trust: Only add repositories from verified publishers; a malicious chart can create cluster-scoped resources or escalate privileges
• RBAC scope: Helm runs with the caller’s kubeconfig permissions. Restrict who can helm install into production Namespaces using RBAC
• Secret management: Never store raw credentials in values.yaml. Use Sealed Secrets, External Secrets Operator, or Vault injection
• Helm v3 improvement: Removing Tiller eliminated a persistent cluster-side attack surface present in Helm v2

Troubleshooting

Symptom	Cause	Fix
helm install fails with “release exists”	Release name already in use	helm upgrade --install or choose a new name
helm repo add fails with 404	Invalid repository URL	Verify URL; check if repository moved
Upgraded release broken	Bad values or chart bug	helm rollback <release> <revision>
helm list empty	Wrong Namespace or context	helm list -n <namespace>; verify kubeconfig context
Template rendering errors	Invalid Go template syntax	helm template to debug; check values.yaml types

Connection to CNCF

Helm is a graduated project in the Cloud Native Computing Foundation (CNCF). It is the standard packaging layer above Kubernetes, analogous to how apt sits above dpkg. Graduation means Helm has demonstrated production readiness, diverse governance, and broad ecosystem adoption.

Related Pages

• Helm Charts — Chart anatomy, authoring, and template functions
• Helm Release Management — Revisions, history, upgrades, and rollbacks
• Kubernetes Ingress — Installing Ingress Controllers via Helm
• Kubernetes ConfigMaps and Secrets — Configuration patterns with Helm values
• Kubernetes Namespaces — Helm release scoping and multi-tenancy
• GitOps Security — Chart signing, repository trust, and supply-chain hardening
• Tooling Index — Helm in the DevOps toolchain
• CKA Study Roadmap — Post-CKA Helm specialization recommendation
• Abhishek Veeramalla — Creator of the Helm Zero to Hero course
• Saiyam Pathak — CNCF Ambassador who frequently covers Helm in cloud-native education

---

Tags: helm kubernetes package-manager devops gitops templating cncf charts releases