Helm with GitOps and post-renderers

Helm · Expert · 12 min

At scale, charts are deployed by controllers from git, not by people typing helm upgrade.

With GitOps, a controller in the cluster continuously makes it match git, correcting drift. Both major tools consume Helm charts but differently:

  • Flux HelmRelease objects run real Helm operations through its helm-controller: releases appear in helm list, hooks and history behave as in Helm, and it can remediate failed upgrades with rollbacks.
  • Argo CD renders the chart with the equivalent of helm template and applies the output itself. There is no Helm release object; Argo tracks resources and drift itself, maps hooks to its own sync phases, and lookup has no cluster to read.

Choose knowingly: charts that depend on release state, lookup or exotic hooks behave differently under Argo CD.

Post-renderers let you change the rendered manifests after templating and before applying, without forking the chart: helm install --post-renderer ./kustomize-wrapper. In Helm 4, post-renderers are provided as plugins. The usual implementation pipes the YAML into Kustomize to add labels, sidecars or patches the chart's values don't expose. Flux supports Kustomize post-renderers declaratively in HelmRelease.

Promotion between environments then becomes a git change: bump the chart version or values in the staging folder, verify, then in production. Pair it with the chart's schema and CI rendering checks so broken values never reach the cluster.

Example

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata: {name: shop, namespace: shop}
spec:
  interval: 10m
  chart:
    spec:
      chart: shop
      version: "1.4.x"
      sourceRef: {kind: HelmRepository, name: acme-charts}
  values:
    replicaCount: 3
  upgrade:
    remediation: {retries: 2}   # roll back after failed upgrades
  postRenderers:
    - kustomize:
        patches:
          - target: {kind: Deployment, name: shop-web}
            patch: |
              - {op: add, path: /spec/template/metadata/annotations/team, value: payments}

Remember

  • Flux runs real Helm releases; Argo CD renders and applies itself
  • Post-renderers patch output without forking charts
  • Promote by changing versions/values in git

Watch out for

  • Moving a chart to Argo CD without checking its use of lookup and hooks.

Check yourself

  1. Under Argo CD, why might helm list show no release for an app deployed from a chart?

Sign in to answer, see the explanations, and get this lesson back as a quick review later.

Official docs: helm.sh/docs/topics/advanced/#post-rendering