Helm

helm template my-app ./chart -f values.yaml | less
helm template my-app ./chart -f values.yaml | kubectl apply --dry-run=server -f -
helm upgrade --install my-app ./chart -f values.yaml --dry-run=server   # output includes Secrets unless --hide-secret
helm diff upgrade my-app ./chart -f values.yaml                          # plugin: databus23/helm-diff

helm upgrade --install my-app ./chart \
  -n my-namespace --create-namespace \
  -f values.yaml -f values.prod.yaml \
  --set image.tag=1.4.2 \
  --wait --timeout 10m \
  --rollback-on-failure

helm list -A                                        # releases and revisions
helm get values my-app --all                        # user values merged with chart defaults
helm get manifest my-app | kubectl diff -f -        # drift between the release record and the cluster
helm status my-app

helm history my-app
helm rollback my-app 4 --wait

helm history my-app -n my-namespace                  # find the last revision with status deployed
helm rollback my-app <last-good> -n my-namespace     # usually clears the pending state
kubectl get secret -n my-namespace -l owner=helm,name=my-app   # the ledger itself

chart/
  Chart.yaml            # apiVersion: v2, name, version, appVersion, dependencies
  values.yaml           # defaults, every key documented
  values.schema.json    # optional JSON Schema, validated on install, upgrade, lint and template
  templates/
    _helpers.tpl        # named templates: fullname, labels, selectors
    deployment.yaml
    NOTES.txt           # printed after install

{{- define "chart.labels" -}}
app.kubernetes.io/name: {{ include "chart.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}

# Chart.yaml
dependencies:
  - name: postgresql
    version: "16.x.x"
    repository: oci://registry.example.com/charts
    condition: postgresql.enabled

helm dependency update ./chart     # resolve ranges, write Chart.lock, download charts/*.tgz
helm dependency build ./chart      # download exactly what Chart.lock pins

{{/* templates/_helpers.tpl */}}
{{- define "my-app.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" }}   # 63 is the DNS label limit
{{- end }}
{{- end }}

{{- define "my-app.selectorLabels" -}}
app.kubernetes.io/name: {{ .Chart.Name }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}

# templates/deployment.yaml
metadata:
  name: {{ include "my-app.fullname" . }}
  labels:
    {{- include "chart.labels" . | nindent 4 }}
spec:
  selector:
    matchLabels:
      {{- include "my-app.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}   # restart pods when the ConfigMap changes
    spec:
      containers:
        - name: app
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          env:
            - name: DB_HOST
              value: {{ required "database.host is required" .Values.database.host | quote }}
          args: {{- toYaml .Values.args | nindent 12 }}
          command: {{ tpl .Values.commandTemplate . | quote }}   # values may reference {{ .Release.Name }}

apiVersion: batch/v1
kind: Job
metadata:
  name: {{ include "my-app.fullname" . }}-migrate
  annotations:
    "helm.sh/hook": pre-upgrade,pre-install
    "helm.sh/hook-weight": "-5"                                   # lower runs first, string-quoted integer
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded   # keep failed Jobs for kubectl logs
spec:
  backoffLimit: 0
  template:
    spec:
      restartPolicy: Never
      containers:
        - name: migrate
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          args: ["migrate", "up"]

# templates/tests/connection.yaml
apiVersion: v1
kind: Pod
metadata:
  name: {{ include "my-app.fullname" . }}-test
  annotations:
    "helm.sh/hook": test
    "helm.sh/hook-delete-policy": hook-succeeded
spec:
  restartPolicy: Never
  containers:
    - name: curl
      image: curlimages/curl
      args: ["-fsS", "http://{{ include "my-app.fullname" . }}:{{ .Values.service.port }}/healthz"]

helm test my-app -n my-namespace --logs --timeout 2m   # --logs prints the test pod logs before cleanup
helm template my-app ./chart --skip-tests              # leave tests out of rendered output

helm registry login registry.example.com -u "$REGISTRY_USER" --password-stdin <<< "$REGISTRY_TOKEN"
helm package ./chart --version 1.2.3 --app-version 4.5.6     # writes my-app-1.2.3.tgz
helm push my-app-1.2.3.tgz oci://registry.example.com/charts  # reference is the repository, no chart name or tag
helm pull oci://registry.example.com/charts/my-app --version 1.2.3 --untar
helm show chart oci://registry.example.com/charts/my-app --version 1.2.3
helm upgrade --install my-app oci://registry.example.com/charts/my-app@sha256:<digest> -n my-namespace
helm registry logout registry.example.com

{
  "$schema": "https://json-schema.org/draft-07/schema#",
  "type": "object",
  "required": ["image"],
  "properties": {
    "image": {
      "type": "object",
      "required": ["repository"],
      "properties": {
        "repository": { "type": "string", "minLength": 1 },
        "tag": { "type": "string" }
      }
    },
    "replicaCount": { "type": "integer", "minimum": 1 },
    "resources": { "type": "object" }
  },
  "additionalProperties": false
}

helm template my-app ./chart \
  --kube-version 1.34.0 \
  --api-versions monitoring.coreos.com/v1 \
  --api-versions gateway.networking.k8s.io/v1 \
  --include-crds \                # CRDs from crds/ are otherwise left out of template output
  --is-upgrade                    # sets .Release.IsUpgrade for templates that branch on it

# Every release across the cluster, with chart versions
helm list -A -o json | jq -r '.[] | [.namespace, .name, .chart, .app_version, .status] | @tsv'

# Releases that are not deployed, including failed and pending
helm list -A --all -o json | jq -r '.[] | select(.status!="deployed") | [.namespace,.name,.status] | @tsv'

# What changed between two revisions
diff <(helm get manifest my-app --revision 6) <(helm get manifest my-app --revision 7)

# Images a chart would run, without installing
helm template my-app ./chart -f values.yaml | grep -E '^\s+image:' | sort -u

# Render one template
helm template my-app ./chart -s templates/deployment.yaml

# Find missing values in rendered output
helm template my-app ./chart 2>&1 | grep -n 'nil pointer\|<no value>'

# Pull a chart to inspect it
helm pull oci://registry.example.com/charts/postgresql --version 16.0.0 --untar

# Values a release was installed with, as a reusable file (may contain secrets)
helm get values my-app -o yaml > values.recovered.yaml

# Release ledger Secrets, oldest first (history is capped by --history-max, default 10)
kubectl get secret -n my-namespace -l owner=helm --sort-by=.metadata.creationTimestamp