Skip to content

Helm Chart Deployment

The short version

Everything the chart does is controlled by values.yaml. As a partner, you only need to edit that file — you shouldn't need to touch the templates.

What's in the chart

Chart root: helm-hello-world-main/

File What it's for
Chart.yaml Chart metadata (name, version)
values.yaml Default configuration — the only file you need to edit
templates/deployment.yaml Runs your app's pods (Kubernetes Deployment)
templates/service.yaml Gives your pods a stable internal address (Kubernetes Service)
templates/virtualservice.yaml Routes external traffic to your Service (Istio VirtualService)
templates/hpa.yaml Automatically adds/removes pods based on load (optional autoscaler)

Deployment: what you can configure

  • Name: comes from Chart.yaml, not from values.yaml
  • Replicas (how many copies of your app run): replicaCount, default 1
  • Image: image.repository + image.tag
  • Pull policy (when Kubernetes re-downloads the image): image.pullPolicy, default Always
  • Image pull secret (credentials used to read from the private registry): imagePullSecret, default harbor-registry-secret
  • Container port: service.containerPort, default 80
  • Which user ID the container runs as: securityContext.runAsUser, default 1000
  • CPU/memory requests and limits: resources.*

One thing you can't change through values.yaml: the pod security baseline (seccomp profile, dropping all Linux capabilities, forcing non-root) is hardcoded — it's not optional.

Service: what you can configure

  • Name: comes from Chart.yaml
  • Type: service.type, default ClusterIP (internal-only — not directly reachable from outside the cluster)
  • Port exposed inside the cluster: service.port, default 5173
  • Port forwarded to the container: service.containerPort, default 80

Autoscaling (HPA): optional

Only created if you set autoscaling.enabled: true. When enabled:

  • autoscaling.minReplicas / autoscaling.maxReplicas set the floor and ceiling for replica count
  • autoscaling.targetCPUUtilizationPercentage sets the CPU threshold that triggers scaling
  • autoscaling.targetMemoryUtilizationPercentage does the same for memory, but it's commented out by default — uncomment it to use it

Full values.yaml reference

Value Default Used by Notes
replicaCount 1 Deployment Number of pod replicas
image.repository Harbor repo path Deployment Container image repository
image.tag latest Deployment Image tag — set to the commit SHA in CI
image.pullPolicy Always Deployment Image pull policy
imagePullSecret harbor-registry-secret Deployment Kubernetes secret used to authenticate to the private registry
securityContext.runAsUser 1000 Deployment UID the container process runs as
service.type ClusterIP Service Kubernetes service type
service.port 5173 Service, VirtualService Port exposed inside the cluster
service.containerPort 80 Deployment, Service Port the container listens on
istio.host api.playground.france-identite.gouv.local VirtualService Gateway hostname — do not change
istio.gateway istio-system/api-gateway VirtualService Istio Gateway reference — do not change
istio.pathPrefix /hello-world/ VirtualService URL prefix routed to your app — must be unique across all services
autoscaling.enabled false HPA Set to true to turn on autoscaling
autoscaling.minReplicas 1 HPA Minimum replica count
autoscaling.maxReplicas 5 HPA Maximum replica count
autoscaling.targetCPUUtilizationPercentage 80 HPA CPU threshold that triggers scaling (%)
autoscaling.targetMemoryUtilizationPercentage (unset) HPA Memory threshold (%) — uncomment to enable
resources.requests.cpu 100m Deployment Guaranteed CPU
resources.requests.memory 64Mi Deployment Guaranteed memory
resources.limits.cpu 200m Deployment CPU cap
resources.limits.memory 128Mi Deployment Memory cap

Before you deploy, make sure

  • harbor-registry-secret already exists in your target namespace — the chart references it but doesn't create it for you
  • Istio's CRDs are installed on the cluster — the chart includes a VirtualService, which needs them to apply cleanly

Sources