Linting, testing & schemas

helm lint, test, values schema.

Advanced12 min · lesson 10 of 12

Charts are code that renders cluster manifests, so they deserve validation before release. helm lint checks a chart for structural problems and best-practice issues. helm template renders the chart locally (no cluster) so you can eyeball or diff the output. And a values.schema.json validates user-supplied values against a JSON Schema at install time, rejecting a bad type or a missing required field with a clear error instead of a broken manifest.

terminal

$ helm lint ./payments-api
==> Linting ./payments-api
1 chart(s) linted, 0 chart(s) failed
$ helm template payments ./payments-api -f prod-values.yaml | kubeconform -strict
# render, then validate the output against the Kubernetes schemas

values.schema.json

{
  "$schema": "https://json-schema.org/draft-07/schema#",
  "type": "object",
  "required": ["image"],
  "properties": {
    "replicaCount": { "type": "integer", "minimum": 1 },
    "image": { "type": "object", "required": ["repository", "tag"] }
  }
}

Chart tests

Helm also supports release tests: templates annotated helm.sh/hook: test (usually a Job that curls the service or checks a connection), run on demand with helm test <release>. They verify a release actually works after install/upgrade, not just that it rendered. Combined with lint, schema validation, and rendered-output checks in CI, you catch the vast majority of chart problems before they reach a cluster.

terminal

$ helm install payments ./payments-api -n prod
$ helm test payments -n prod
Phase: Succeeded    # the test Job connected to the service successfully

Render and validate in CI, every change

A chart can lint clean and still render invalid or insecure manifests once real values flow through it. Make CI render the chart with representative values and validate the output (kubeconform for schema, a policy scan for security) on every change, plus helm lint and schema checks. Testing the rendered result — not just the templates — is what actually prevents broken or unsafe releases.

Library charts & reuseSigning, provenance & OCI