Helm
Helm is the package manager for Kubernetes. A chart is a folder of templated manifests plus a values.yaml; rendering a chart with a set of values produces the objects to apply, and an installed chart is a release. The platform uses Helm in two ways: the application ships as a chart that ArgoCD renders, and the cluster add-ons are installed as releases by OpenTofu.
What it does
Templates in templates/ reference values such as .Values.image.tag. Values files layer: later files override earlier ones, so one chart serves every stage with a small override file each. helm lint checks a chart; helm template renders it without a cluster.
How BuiltForProd uses it
The application chart lives in acme-aws-blueprint-webapp-gitops at blueprint-app/helm/ (chart blueprint-app, version 0.1.0). Its templates are a Deployment, a Service, an Ingress, a HorizontalPodAutoscaler, a PodDisruptionBudget, a NetworkPolicy, an ExternalSecret and an optional ServiceAccount. Values layer in the order ArgoCD reads them:
| File | Sets |
|---|---|
values.yaml | Defaults: one replica, port 8080, probes, pod hardening, topology spread, default-deny NetworkPolicy, every switch off |
values-<stage>.yaml | Stage choices: replicas and resources, HPA and PDB on for staging and prod, the Ingress host, externalSecrets.ssmPrefix, the stage VPC CIDR for the NetworkPolicy |
envs/<stage>/values.yaml | Only image.repository and image.tag, written by deploy pull requests from the code repository |
Staging runs 2 replicas with an HPA from 2 to 5; prod runs 3 with an HPA from 3 to 10 and a PodDisruptionBudget of 2. Stage differences are values, never separate charts, which is the promotion model in practice.
Add-ons as releases. The infrastructure modules use the Helm provider (helm ~> 3.3, declared in each module's own versions.tf) to install charts with pinned versions:
| Release | Chart and version | Namespace |
|---|---|---|
argocd | argo-cd 9.5.22 | argocd |
aws-load-balancer-controller | aws-load-balancer-controller 3.4.0 | kube-system |
external-dns, ext-dns-int | external-dns 1.21.1 | kube-system |
external-secrets | external-secrets 2.6.0 | external-secrets |
fluent-bit | aws-for-fluent-bit 0.2.0 | amazon-cloudwatch |
karpenter | karpenter 1.14.1 (OCI) | kube-system |
cluster-autoscaler | cluster-autoscaler 9.59.0 | kube-system |
Each provider block authenticates to the cluster with aws eks get-token, using the deployer role's access entry.
The chart is linted before commit by the helmlint pre-commit hook in the code repository, and the contributor rules call for helm lint and helm template against each stage's value files before a GitOps change is pushed. Self-hosted runners install Helm at startup.
Terms you will see
| Term | Meaning |
|---|---|
| Chart | A packaged set of templates and default values. |
| Release | One installed instance of a chart in a namespace. |
| Values | The inputs that fill the templates; files layer in order. |
| Template | A manifest with placeholders such as .Values.replicaCount. |
| Chart repository | Where charts are downloaded from, such as the ArgoCD or EKS chart repositories. |
Where to read more
- ArgoCD for who renders the application chart
- Kubernetes for the objects the chart creates
- Environments and promotion
- Web App Blueprint overview