Automating with Helm in CI/CD
1. Installing Helm in Pipeline
| Platform | Method |
|---|---|
| GitHub Actions | azure/setup-helm@v4 |
| GitLab CI | Image alpine/helm:3.16.2 |
| CircleCI | circleci/helm@3 orb |
| Tekton | helm-upgrade-from-source task |
2. Authenticating to Kubernetes
| Cluster | Auth method |
|---|---|
| EKS | aws eks update-kubeconfig + IRSA / OIDC federation |
| GKE | gcloud container clusters get-credentials + Workload Identity |
| AKS | az aks get-credentials + federated identity |
| Self-managed | Short-lived ServiceAccount token via OIDC |
3. Running Helm Lint
Example: Lint with strict mode
helm lint ./chart --strict --values values-prod.yaml
helm dependency update ./chart
helm lint ./chart --values values-staging.yaml4. Performing Dry Run
Example: Server-side dry-run
helm upgrade --install api ./chart \
-f values-prod.yaml \
--dry-run=server \
--debug5. Deploying Charts
Example: Atomic deploy with timeout
helm upgrade --install api ./chart \
-f values-prod.yaml \
--namespace api --create-namespace \
--atomic --timeout 10m \
--wait \
--version "$CHART_VERSION"6. Running Chart Tests
Example: Post-deploy validation
helm test api --timeout 5m --logs
# Fail pipeline on test failure
[ $? -eq 0 ] || exit 17. Rolling Back on Failure
| Mechanism | Behavior |
|---|---|
--atomic | Auto-rollback on upgrade failure |
| Explicit | helm rollback api $PREVIOUS_REV |
| Wait + verify | Custom step checks SLO before marking success |
8. Publishing Charts
Example: Chart-releaser action
- name: Release charts
uses: helm/chart-releaser-action@v1.6.0
env:
CR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
charts_dir: charts9. Versioning with CI Variables
Example: Inject build metadata
yq -i ".version = \"$CI_VERSION\"" Chart.yaml
yq -i ".appVersion = \"$IMAGE_TAG\"" Chart.yaml
helm package ./chart --version "$CI_VERSION" --app-version "$IMAGE_TAG"10. Using GitOps Workflows
| Pattern | Flow |
|---|---|
| Pull-based | CI commits new chart version → Argo CD / Flux reconciles |
| Image updater | Argo CD Image Updater bumps tag on new image push |
| PR-driven | Renovate / Dependabot opens PRs for version bumps |
11. Implementing Blue-Green Deployments
Example: Pipeline blue-green
NEW_COLOR=$([ "$ACTIVE" = "blue" ] && echo green || echo blue)
helm upgrade --install api-$NEW_COLOR ./chart \
-f values-prod.yaml --set color=$NEW_COLOR --atomic --wait
# Run smoke tests against api-$NEW_COLOR.api.svc
./smoke-test.sh api-$NEW_COLOR
# Switch traffic
kubectl patch svc api -p "{\"spec\":{\"selector\":{\"color\":\"$NEW_COLOR\"}}}"
# Decommission old after soak period
helm uninstall api-$ACTIVE