Kubernetes Helm Charts: Best Practices and Production Patterns
Why Helm?
Helm standardizes Kubernetes application packaging, versioning, and deployment. Charts encode manifests + sane defaults, enabling consistent releases across environments.
Chart Structure Essentials
- Chart.yaml for metadata (name, version, appVersion)
- templates/ for manifests with Go templates
- values.yaml for defaults; values-*.yaml for env overrides
- charts/ for dependencies (subcharts)
Values and Overrides
Create a stable default values.yaml. Use hierarchical keys, document with comments, and support per-environment overrides via -f values.prod.yaml. Prefer explicit values over hard-coded templates.
Templating Patterns
- Use _helpers.tpl for named templates (labels, fullname, annotations)
- Quote user-provided values with | quote
- Use default, required, and toYaml for safe rendering
- Support podSecurityContext, securityContext, resources, nodeSelector, tolerations, affinity
Security & Compliance
- Run as non-root, drop capabilities, readOnlyRootFilesystem
- NetworkPolicies for ingress/egress control
- Image pinning with SHA digests and pullPolicy: IfNotPresent
- Sensitive data via Secrets; avoid committing secrets to values
Versioning and Releases
Follow SemVer for chart version, align appVersion with image tag, and automate chart release via CI. Use helm dependency update for subcharts.
CI/CD Automation
name: Helm Release
on: [push]
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: azure/setup-helm@v4
- name: Lint
run: helm lint charts/myapp
- name: Render manifests
run: helm template myapp charts/myapp -f values.prod.yaml > manifest.yaml
- name: Deploy
run: helm upgrade --install myapp charts/myapp -f values.prod.yaml --namespace prod --create-namespace
Testing and Validation
Use helm lint, helm template, and kubeconform/kubeval for schema validation. Add Helm tests (templates/tests/) with hooks. Prefer canary or blue/green with progressive delivery (Argo Rollouts/Flagger).
Takeaways
Keep charts configurable, secure by default, and validated in CI. Encapsulate best practices so every release is safe and repeatable.