Helm Charts

Appearance

Changelog ​

2026-09-09 ​

Standard ​

  • Post-install NOTES now list the configuration a release wired up: a Configuration section appears when variables, secrets, sealedSecrets, or any mounted*Files are set, naming the ConfigMap, Secret, and SealedSecret each produces.
    • variables print their values, truncated at 60 characters; they are non-secret by definition, that is what secrets is for.
    • Secrets and sealed secrets mask every value to a fixed ********, so nothing about the value, not even its length, is printed. Mounted-file blocks list paths only, since their values are whole file bodies.
    • Each block renders only when its values key is set, so a release without config is unchanged.

Tests ​

  • make tests now fails when any test fails: the per-test sub-makes were joined with ;, so only the last test's exit code counted and CI stayed green while the cronjobs test had been failing since 2026-08-25. The loops now chain with &&.
  • Golden manifests are regenerated with helm 4.3.0, the version the cloud-toolbox CI image ships: helm's rendering whitespace changed after 4.2.0, which broke 16 of the 33 standard tests on newer local helm versions. Goldens byte-match one helm version by design; run helm 4.3.0 locally, and regenerate with make tests-update whenever the CI image's helm changes.

2026-08-25 ​

Standard ​

  • Every CronJob-spec and Job-spec field is now configurable per cron job: CronJob-level timeZone, startingDeadlineSeconds, suspend, successfulJobsHistoryLimit, and failedJobsHistoryLimit, and job-level parallelism, completions, completionMode, activeDeadlineSeconds, backoffLimitPerIndex, maxFailedIndexes, podFailurePolicy, successPolicy, ttlSecondsAfterFinished, and podReplacementPolicy pass through to the rendered CronJob. The motivation is timeZone: without it a schedule runs in the kube-controller-manager's zone (UTC in practice), so 30 2 * * * did not mean 02:30 local time. Documented in Cron jobs.
    • Each field renders only when you set it and no defaults were added, so existing manifests are unchanged.
    • The API rejects a Job that sets both backoffLimit and backoffLimitPerIndex, so setting backoffLimitPerIndex drops backoffLimit (including its 0 default) instead of rendering both.
    • The chart keeps an explicit allowlist rather than passing the spec through wholesale; selector, manualSelector, and managedBy stay unexposed.

2026-08-21 ​

Standard ​

  • Labels and annotations work on every resource and pod template, with one rule everywhere: plain labels:/annotations: target the object's own metadata, podLabels:/podAnnotations: the pod template, each global and per resource, merged global < per-resource < chart-generated. Documented in Labels and Annotations.
    • Fixes two documented-but-unimplemented keys (deployments.<name>.annotations, services.<name>.annotations) and closes the Service annotation gap that previously forced extraManifests for external-dns and LoadBalancer config.
    • User labels never reach selectors or roll pods.
  • podAnnotations now reaches CronJob and Job pods: values.yaml and the docs always claimed "Used by: Deployment, CronJob and Job", but only Deployment pod templates rendered it, so Velero backup-hook annotations set per the docs silently missed cronjob and job pods. Per-workload podAnnotations also now merge per key with the global map instead of replacing it wholesale; anyone relying on the replace behaviour gets the global keys back and can null individual keys instead.
  • SealedSecret scope is now overridable: sealedsecrets.bitnami.com/cluster-wide: "true" was hardcoded; it is now a default the global annotations override per key, so namespace-wide scope no longer requires editing the template.

Tests ​

  • Golden manifests regenerated for the template filename rename: the rename to plural template filenames changed every # Source: comment and the alphabetical render order, but the goldens were not regenerated, so every chart's tests failed. Content unchanged.

2026-08-13 ​

Standard ​

  • Helm's test-connection pod now picks a stable port: the template chose the service port with an unsorted values | first, so Go's map iteration order decided it and a service with more than one port rendered a different target on each run. It now sorts, matching the fix the ingress and service templates got on 2026-06-02; this template was missed then.
    • Nothing in charts/*/values.yaml defines a multi-port service, which is why the golden tests never caught it: the TU/e Dataverse installation adds an AJP port in its installation values, and helm test there hit the AJP port roughly half the time and failed. The services test now covers a multi-port service.

2026-08-11 ​

Standard ​

  • resources now falls back to pod and chart level, resolving container < pod < chart, matching image, command, args, and securityContext. It previously read the container block only, so resources set on a deployment, job, or cronJob was silently dropped, including for a cronJob defined without an explicit containers block, where every other field falls through to the default container.
  • Reverted: configure defaults for init containers and sidecars. An earlier entry today described the opt-in behaviour from 2026-05-31 as a bug and made configure resolve as chart defaults < pod < container for every container type. That was wrong: init containers and sidecars are opt-in by design, and the change silently gave them the variables ConfigMap, the secrets Secret, mounted files and PVCs. Declare what a container needs on the container itself, listing every key you want since the block is taken verbatim.
  • Values examples no longer suggest kubernetes.io/ingress.class: the commented ingress and ingresses examples in values.yaml recommended the deprecated annotation alongside className, and consumers copied it verbatim, so Kubernetes warns annotation "kubernetes.io/ingress.class" is deprecated, please use 'spec.ingressClassName' instead on every apply. The examples now show className only, which the template has always rendered as spec.ingressClassName. No rendered output changes; drop the annotation from your own values to clear the warning, and make sure a matching IngressClass object exists in the cluster (the annotation did not need one).

CI ​

  • Pipeline includes follow gitlab-pipelines main again: the three include: entries pinned ref: helm-diff, a branch that was merged upstream and deleted. GitLab could no longer resolve the includes, so every pipeline (on main and on merge requests alike) was created and failed instantly with zero jobs and an empty yaml_errors field, which made it look like an infrastructure fault rather than a config error. Now pinned to main, matching every other Hosst project.
  • tests:charts builds subchart dependencies too: the job built dependencies for the chart under test only. A subchart packaged without its own standard dependency renders nothing inside its parent, so akeneo, peertube and superset were tested against output missing all of elasticsearch and valkey, silently and without error. The job now builds every chart first, and their goldens now carry the subchart resources the charts actually ship.
  • Golden tests pin the namespace: make test and make test-update now pass --namespace $(TEST_NAMESPACE) (default default). Without it helm template took the namespace from the caller's kube-context, so any chart rendering metadata.namespace produced a different golden locally than in CI, where the runner sets helm-charts. The bookstack job failed on exactly that while passing on every developer machine.
  • tests:charts builds chart dependencies: the job ran make tests CHART=$CHART without helm dependency build, so all twelve wrapper charts failed on found in Chart.yaml, but missing in charts/ directory: standard. make tests does not build dependencies and tests:standard never noticed, since the standard chart has none.

2026-06-18 ​

Standard ​

  • Config checksums hash data only: the checksum/variables, checksum/secrets, checksum/sealedSecrets, and checksum/files pod annotations now hash the relevant values maps directly (toYaml | sha256sum) instead of the whole rendered template file. Because the rendered files include standard.labels (which carries helm.sh/chart and app.kubernetes.io/version), the previous approach rolled pods on every chart/app version bump even when no config changed. Hashing only keys/values rolls pods on real data changes and is order-independent (toYaml sorts map keys).
  • The Deployment pod template uses selector labels only: it now carries standard.selectorLabels (name/instance/deployment) instead of the full standard.labels. Since pod-template-hash is derived from the pod template, keeping the mutable helm.sh/chart and app.kubernetes.io/version labels out of it stops version/chart bumps from rolling pods, completing the data-only-checksum change above. The selector is unchanged (it already used selectorLabels), and resource metadata still carries the full labels.
  • deployment.rolloutOnVersionChange (opt-in): set per deployment to put the full standard.labels back on the pod template, so a chart or app version bump rolls the pods (and the chart/version labels are readable on each pod). Defaults to false, preserving the selector-labels-only behavior above.
  • Golden manifests excluded from whitespace hooks: the end-of-file-fixer, mixed-line-ending, and trailing-whitespace pre-commit hooks now skip charts/*/tests/**/manifests.yaml, which must byte-match helm template output (the empty defaults render is a single newline the hooks were stripping to an empty file).

2026-06-05 ​

CI ​

  • One tests/<chart> job per chart added to the pipeline, using the cloud-toolbox:helm image; each runs helm dependency build followed by make tests. On main all chart tests always run; on branches only charts with changed files are tested (wrapper chart jobs also trigger on charts/standard/**/* changes). Jobs are grouped under tests/ in the pipeline UI and start immediately without waiting for prior stages (needs: []).

2026-06-04 ​

Standard ​

  • All generated PersistentVolumeClaims now carry helm.sh/resource-policy: keep, preventing silent data loss on helm uninstall or resource rename. Set keep: false on any PVC entry to opt out and allow Helm to delete it on uninstall. An annotations field is also supported to merge additional annotations onto the PVC.

  • Improved deployment NOTES: post-install/upgrade output now shows a Hostnames: list with scheme and TLS detection, conditional Jobs: and Cronjobs: sections, and ready-to-run namespaced commands for logs, pod status, shell access, rollback, and retrieving deployed values.

2026-06-02 ​

Standard ​

  • Ingress TLS smart defaults: tls: now accepts four forms. tls: (null) or tls: true auto-derives hosts from ingress.hosts and sets secretName to <fullname>-tls; the key alone is enough to get cert-manager to pick up the ingress. List mode and dict mode each merge entries with the same defaults, so omitted hosts and secretName fields are filled in automatically. tls: false, tls: [], and tls: {} explicitly suppress the TLS block (clear convention).

  • Ingress service lookup nil guard: rendering an ingress with no services defined no longer panics with "invalid value; expected string".

  • app.kubernetes.io/name now reflects the application, not the chart: when using the standard chart directly without nameOverride, the name label uses the Helm release name instead of the meaningless value standard. Set nameOverride: backend (or your app name) in values.yaml to get a stable application identity across all environments.

  • nameOverride enables per-branch uniqueness in shared namespaces: it affects both the app.kubernetes.io/name label and the resource name suffix. With nameOverride: backend and release feat-xyz, resources are named feat-xyz-backend: unique per branch, stable app identity. In production where release equals the app name, deduplication produces just backend.

  • The Ingress service fallback is now deterministic: when no service matches the ingress name, the fallback always selects the alphabetically first service rather than relying on Go map iteration order.

2026-06-01 ​

Standard ​

  • volumes: now supports the same dict/list duality as env, envFrom, and volumeMounts: dict keys are injected as the name field; list mode passes through unchanged. Previously, a dict value produced invalid Kubernetes YAML (a map instead of a sequence). Default changed from {} to [].

  • test-connection respects enabled: false: the Helm test pod was generated for every service regardless of enabled: false. It now skips disabled services.

  • New extraManifests key: render arbitrary Kubernetes resources alongside the chart's own output. Dict mode (recommended) automatically injects metadata.name, metadata.namespace, and standard labels, using the same naming rules as other resources, with user-provided metadata winning over auto-injected values. List mode passes resources through raw with tpl rendering for full control. Useful for NetworkPolicies, ExternalSecrets, ClusterRoles, BackendConfigs, or anything the chart does not natively support.

2026-05-31 ​

Standard ​

  • initContainers and sidecarContainers no longer auto-mount configuration: both container types use an empty configure: {} by default, so variables, secrets, files, and PVCs are not mounted unless explicitly enabled on the container. Regular containers continue to inherit the pod/global configure. Use Jobs with helm.sh/hook for tasks like DB migrations that need app config; they run once per Helm operation rather than on every pod restart.

  • volumeMounts dict key as name: when volumeMounts is specified as a dict, the key is now injected as the name field (matching the behaviour of env and envFrom). List-style volumeMounts continues to pass through unchanged.

  • configure.env: renamed from the undocumented configure.environment and now implemented. Set configure.env: false on a container to suppress the global env list from being applied. Container- and pod-level env are always respected regardless of this flag.

  • Ingress port name: the backend port name in generated Ingress rules is now resolved directly from the service port map keys instead of relying on a side-effect mutation from service.yaml. No change in rendered output.

  • volumeMounts guard: the volumeMounts: section no longer renders when all auto-mount flags (configure.files, configure.secretFiles) are disabled and no explicit mounts are defined, preventing an empty volumeMounts: null key in the container spec.

  • deployment, cronJob, and job entries with a null value (e.g. deployments: { app: }) no longer crash: the null-guard merge now runs before the enabled check in all three templates.

  • standard.fullname: the chart name standard is now treated as a transparent wrapper. Resources no longer get a -standard suffix when the chart is used directly; the release name is used as the full name instead. All dependent charts that set chartName are unaffected.

  • New ingress: single-ingress shorthand: set ingress.hosts, ingress.className, ingress.annotations, and ingress.tls directly, injected into ingresses using the release name as key.

  • New service: single-service shorthand: set service.ports directly, injected into services using the release name as key.

  • New deployment: single-deployment shorthand: set deployment.containers, deployment.replicaCount, etc. directly, injected into deployments using the release name as key.

2026-04-15 ​

Standard ​

  • HPA support reworked onto autoscaling/v2 (deployments[].autoscaling): the scaleTargetRef is automatically populated from the deployment context. Defaults: minReplicas: 1, maxReplicas: 10. Added enabled flag to disable the HPA while keeping the config. Supports full metrics list (passed through), shorthand targetCPUUtilizationPercentage/targetMemoryUtilizationPercentage, and behavior (scaleUp/scaleDown policies).