HelmRelease & the helm-controller

Charts, the GitOps way.

Flux manages Helm charts through the helm-controller and the HelmRelease CRD — declarative, GitOps-native Helm. You define a HelmRelease that references a chart (from a HelmRepository, a GitRepository, or an OCIRepository source) and supplies values; the controller installs and upgrades the release, tracks its history, and can roll back automatically on a failed upgrade. It is Helm’s power without ever running helm install by hand, all reconciled from Git.

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata: { name: ingress-nginx, namespace: flux-system }
spec:
  interval: 10m
  chart:
    spec:
      chart: ingress-nginx
      version: "4.11.x"
      sourceRef: { kind: HelmRepository, name: ingress-nginx }
  values:
    controller: { replicaCount: 2 }
  install: { remediation: { retries: 3 } }
  upgrade: { remediation: { retries: 3, remediateLastFailure: true } }

Remediation and values

The remediation settings are a standout: on a failed install or upgrade, the helm-controller retries and can roll back to the last working release automatically, so a bad chart version does not leave you broken. Values come from the HelmRelease (and can be composed from ConfigMaps/Secrets), keeping per-environment config in Git. As always, keep secret values out of Git — reference a Secret or use SOPS (later). This is the Helm course applied through Flux’s reconcile loop.

$ flux get helmreleases -A
NAMESPACE    NAME           REVISION   READY  MESSAGE
flux-system  ingress-nginx  4.11.1     True   Helm upgrade succeeded
$ flux reconcile helmrelease ingress-nginx