Helm is the package manager for Kubernetes. A chart bundles all the manifests an application needs — Deployments, Services, Ingress, ConfigMaps, RBAC — as templates with configurable values. One command installs a complete app; another upgrades or rolls it back. Most popular software (ingress-nginx, cert-manager, PostgreSQL, Prometheus, Grafana) ships as Helm charts.

Key terms

  • Chart — a package of templated Kubernetes manifests.
  • Repository — where charts are published (HTTP index or OCI registry).
  • Release — an installed instance of a chart in a cluster, with a name and revision history.
  • Values — configuration that fills the templates (values.yaml and overrides).

1. Install the Helm CLI

curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
helm version

Helm uses your current kubeconfig context — the same cluster kubectl talks to. (On k3s, point KUBECONFIG at the k3s config — see k3s.)

helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo update
helm search repo ingress-nginx
helm search hub grafana           # search Artifact Hub

Many charts are now distributed as OCI artifacts, installed directly by URL: helm install myrel oci://registry.example.com/charts/app --version 1.2.3.

3. Install a chart

helm install ingress ingress-nginx/ingress-nginx \
  --namespace ingress-nginx --create-namespace

Before installing, look at what you can configure:

helm show values ingress-nginx/ingress-nginx > ingress-values.yaml

Edit a copy with only the settings you change, then install with it:

helm install ingress ingress-nginx/ingress-nginx -n ingress-nginx --create-namespace -f my-values.yaml

Or set individual values on the command line:

helm install pg bitnami/postgresql -n db --create-namespace \
  --set auth.postgresPassword="$(openssl rand -base64 18)" \
  --set primary.persistence.size=10Gi

Keep values files in Git — they are your configuration.

4. Inspect releases

helm list -A
helm status ingress -n ingress-nginx
helm get values ingress -n ingress-nginx          # your overrides
helm get manifest ingress -n ingress-nginx        # rendered YAML that was applied
helm history ingress -n ingress-nginx

5. Upgrade and roll back

helm repo update
helm upgrade ingress ingress-nginx/ingress-nginx -n ingress-nginx -f my-values.yaml
helm upgrade --install pg bitnami/postgresql -n db -f pg-values.yaml   # install or upgrade
helm rollback ingress 2 -n ingress-nginx                               # back to revision 2

upgrade --install is idempotent — ideal for CI/CD pipelines. Add --atomic to roll back automatically if the upgrade fails, and --wait to wait until resources are ready.

Pin chart versions (--version 4.11.2) so upgrades happen when you decide.

6. Preview before applying

helm template pg bitnami/postgresql -f pg-values.yaml > rendered.yaml
helm upgrade pg bitnami/postgresql -f pg-values.yaml --dry-run

The helm-diff plugin shows exactly what an upgrade would change:

helm plugin install https://github.com/databus23/helm-diff
helm diff upgrade pg bitnami/postgresql -n db -f pg-values.yaml

7. Uninstall

helm uninstall pg -n db

PersistentVolumeClaims created by StatefulSets often remain after uninstall (to protect data). Delete them explicitly when you really want the data gone.

8. Create your own chart

helm create myapp
myapp/
├── Chart.yaml          # name, version, appVersion
├── values.yaml         # default values
└── templates/          # deployment.yaml, service.yaml, ingress.yaml, _helpers.tpl…

Templates use Go templating:

image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
replicas: {{ .Values.replicaCount }}

Check and render it:

helm lint myapp
helm template test ./myapp
helm install myapp ./myapp -n apps --create-namespace

Package and publish to an OCI registry:

helm package myapp
helm push myapp-0.1.0.tgz oci://registry.example.com/charts

Helm and GitOps

Tools like Argo CD and Flux can install Helm charts declaratively from Git, so the cluster always matches your repository — no manual helm upgrade needed.

Tips

  • Treat values.yaml overrides as code: review and version them.
  • Never put plain-text secrets in values files committed to Git; use sealed secrets or external secret stores.
  • Read a chart’s templates before trusting it in production — charts can create RBAC roles and cluster-wide resources.

Related: kubectl cheat sheet and ingress-nginx.

  • Helm
  • Kubernetes
  • DevOps