helm-blueprint

A single, very opinionated, Helm chart for deploying any Kubernetes application workload. Instead of maintaining separate charts per application, define your entire deployment through values.

Quick Start

helm install my-app ./helm-blueprint -f values.yaml

containers:
  app:
    image:
      repository: nginx
      tag: "1.27"
    ports:
      http:
        port: 80

networking:
  services:
    http:
      ports:
        http:
          port: 80

This produces a Deployment with 1 replica, a ClusterIP Service, and a ServiceAccount.

Key Features

Any workload type -- Deployment, StatefulSet, DaemonSet, CronJob, Job, or Argo Rollout -- all from a single chart with workloadType.

Full networking stack -- Services, Ingresses, Gateway API routes, Envoy Gateway policies, NetworkPolicies, and cert-manager Certificates.

Event-driven autoscaling -- HPA v2, VPA, and KEDA (ScaledObject + ScaledJob) with any trigger.

Secrets management -- ConfigMaps, Secrets with push/pull via ESO, and auto-generated passwords (ArgoCD-safe). Stakater Reloader annotations auto-generated per resource.

Lifecycle hooks -- Pre-install/pre-upgrade Jobs for DB migrations, schema setup, etc. Auto-generates both Helm and Argo CD hook annotations. Hooks share the main workload's pod settings (SA, volumes, secrets).

Argo CD native -- Auto sync waves for ordered deployment, sync options, and dual hook annotations. Works with Argo CD, Flux, and Helm CLI without configuration changes.

Schema validation -- Catches misconfigurations at install time: missing mounts, port mismatches, conflicting settings.

Documentation

Core

Guide	Description
Workloads	Deployment, StatefulSet, DaemonSet, CronJob, Job, Argo Rollout
Containers	Container spec, env, mounts, health checks, init/sidecar containers
Configuration	ConfigMaps, Secrets (push/pull via ESO), auto-generated secrets
Persistence	PVCs, StatefulSet volume claim templates, static PV binding
RBAC	ServiceAccount, Roles, ClusterRoles, Bindings
Scheduling	Node affinity, tolerations, topology spread, priority classes

Networking

Guide	Description
Services & Ingresses	ClusterIP, NodePort, LoadBalancer, headless services, Ingress
Gateway API	HTTPRoute, GRPCRoute, TLSRoute, TCPRoute, UDPRoute, Envoy policies
Certificates	cert-manager TLS certificates with auto-named secrets
Network Policies	Ingress/egress rules, deny-all, namespace/pod/IP selectors

Autoscaling & Availability

Guide	Description
Autoscaling	HPA v2, VPA, KEDA (ScaledObject, ScaledJob), Pod Disruption Budgets

GitOps & Deployment

Guide	Description
Argo CD	Sync waves, sync options, hook annotations
Hooks	Pre-install/pre-upgrade Jobs, Argo CD + Flux compatible

Advanced

Guide	Description
Resource Quotas	LimitRange, ResourceQuota
Extra Resources	Escape hatch for arbitrary resources, global settings, pod settings

Requirements

• Kubernetes >= 1.28
• Helm >= 3.x

The core chart (Deployment, Service, Ingress, ConfigMap, Secret, HPA, PDB, RBAC) has zero external dependencies. Optional features require their respective operators:

Feature	Operator	Values key	Version
Argo Rollouts	Argo Rollouts	workloadType: Rollout	v1.6+
VPA	Vertical Pod Autoscaler	autoscaling.vpa.enabled	v1.0+
KEDA autoscaling	KEDA	autoscaling.keda.enabled	v2.12+
Gateway API	Gateway API CRDs	networking.gatewayApi.routes	v1.2+
Envoy policies	Envoy Gateway	networking.gatewayApi.routes.*.policies.envoy	v1.0+
TLS certificates	cert-manager	config.certificates	v1.12+
External Secrets	ESO	config.secrets.*.pull / config.secrets.*.push / config.secrets.*.generate	v0.9+

Examples

Tested configurations in ci/:

File	Scenario
minimal-values.yaml	Simplest deployment
deployment-values.yaml	Deployment with ingress and HPA
statefulset-values.yaml	StatefulSet with persistence
daemonset-values.yaml	DaemonSet with service exposure
cronjob-values.yaml	Scheduled batch job
job-values.yaml	One-shot job
rollout-values.yaml	Argo Rollout with canary strategy
keda-values.yaml	KEDA ScaledObject
scaledjob-values.yaml	KEDA ScaledJob
full-values.yaml	Every feature exercised

Values Reference

See the fully commented values.yaml for all available options.

License

MIT License -- see LICENSE.