Author a Helm Chart for Your Application

Author a Helm chart to deploy your application on IronSled — scaffold a chart with helm create, configure Chart.yaml and values.yaml (image repository and tag, imagePullSecrets, securityContext, service, ingress, resources, autoscaling, liveness/readiness probes), point the chart at your uploaded image in the internal registry, install and upgrade with helm, verify the release, and roll back. External vendors must commit their own chart and README.

A Helm chart packages everything Kubernetes needs to run your application — the Deployment, Service, Ingress, resource limits, and probes — as a single versioned unit driven by a values.yaml file. On IronSled, your application is deployed from a Helm chart, and every project is provisioned with a Helm chart repository during onboarding.

External vendors must commit their own Helm chart and a README to the chart repository provisioned during onboarding — it is a hard prerequisite for deployment. The IronSled platform team cannot stand up your application until the chart is in place. (Internal teams get help building one.) The chart should deploy the images you uploaded by referencing them from the internal registry.

Scaffold the Chart

Generate a chart skeleton with helm create:

helm create my-app

This produces the standard chart structure:

my-app/
├── Chart.yaml
├── values.yaml
├── templates/
│   ├── deployment.yaml
│   ├── service.yaml
│   ├── ingress.yaml
│   ├── hpa.yaml
│   ├── serviceaccount.yaml
│   ├── _helpers.tpl
│   ├── NOTES.txt
│   └── tests/
└── charts/

You configure the chart mainly through Chart.yaml (metadata) and values.yaml (what actually gets deployed). Commit this chart, along with a README describing your application, to the Helm chart repository provisioned for your project.

Configure Chart.yaml

Chart.yaml holds the chart's metadata and version:

apiVersion: v2
name: my-app
description: My Application Helm Chart
type: application
version: 1.0.0
appVersion: "1.0.0"
maintainers:
  - name: Your Name
    email: your.email@example.com

Bump version whenever you change the chart, and set appVersion to the version of the application it deploys.

Configure values.yaml

values.yaml is where you set the image, security context, networking, resources, autoscaling, and health probes. A production-ready starting point:

replicaCount: 3

image:
  repository: registry.example.com/my-app
  pullPolicy: IfNotPresent
  tag: "v1.0.0"

imagePullSecrets:
  - name: regcred

serviceAccount:
  create: true
  name: ""

podSecurityContext:
  runAsNonRoot: true
  runAsUser: 1000

securityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities:
    drop:
    - ALL

service:
  type: ClusterIP
  port: 80

ingress:
  enabled: true
  className: nginx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: my-app.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: my-app-tls
      hosts:
        - my-app.example.com

resources:
  limits:
    cpu: 500m
    memory: 512Mi
  requests:
    cpu: 100m
    memory: 128Mi

autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 10
  targetCPUUtilizationPercentage: 80

livenessProbe:
  httpGet:
    path: /healthz
    port: http
  initialDelaySeconds: 30
  periodSeconds: 10

readinessProbe:
  httpGet:
    path: /ready
    port: http
  initialDelaySeconds: 5
  periodSeconds: 5

The securityContext block above (run as non-root, read-only root filesystem, drop all capabilities) reflects the hardened defaults expected on IronSled — keep them unless your application genuinely needs otherwise.

Point the Chart at Your Image

Set image.repository and image.tag to the image you published to the internal registry. IronSled images are pulled from registry.ironsled.com, so a published image reference looks like:

image:
  repository: registry.ironsled.com/<project>/<image>
  tag: "<tag>"        # the tag you uploaded, e.g. 1.0.0

Use the exact tag you gave the image when you uploaded or built it. Because the registry is private, the pod needs an image-pull secret (imagePullSecrets) that grants access — see Kubernetes Secrets for creating a docker-registry secret.

Install and Upgrade

Install the chart into your namespace, then use the same command to upgrade — helm upgrade --install is idempotent:

# Create the namespace (first time only)
kubectl create namespace my-app

# Install or upgrade the release
helm upgrade --install my-app ./my-app \
  --namespace my-app \
  --values values.yaml

# Override values at deploy time (e.g. a new image tag)
helm upgrade --install my-app ./my-app \
  --namespace my-app \
  --set image.tag=v2.0.0

Verify the Release

Confirm the release and its workloads are healthy:

# Release status
helm list -n my-app
helm status my-app -n my-app

# Kubernetes objects
kubectl get pods -n my-app
kubectl get svc my-app -n my-app
kubectl get ingress -n my-app

If pods do not reach Running, see Debug Pods.

Roll Back

If an upgrade goes wrong, roll back to the previous revision:

# List revision history
helm history my-app -n my-app

# Roll back to the previous revision
helm rollback my-app -n my-app

# Or roll back to a specific revision number
helm rollback my-app 3 -n my-app

For a Deployment-level undo without Helm, use kubectl rollout undo deployment my-app -n my-app.