Azure 35: Helm on AKS — Values Overlays
easy⏱ 5 mincourseazure
Chart structure
A Helm chart is a directory: Chart.yaml (metadata, version), values.yaml (defaults), templates/ (Go-templated manifests — Deployment, Service, ConfigMap, Ingress). At install time, Helm renders each template with the merged values, then applies the result to the cluster as a Release with a version history you can rollback to.
my-chart/
├── Chart.yaml
├── values.yaml # defaults
├── values-dev.yaml # dev overrides
├── values-uat.yaml
├── values-prod.yaml
└── templates/
├── deployment.yaml
├── service.yaml
└── ingress.yaml
Overlay merge semantics
helm install -f values.yaml -f values-prod.yaml does a deep merge: scalars and leaves in the right file win; maps are merged key-by-key; arrays are replaced wholesale (a common gotcha). --set key=value overrides are applied last and beat both files — pipelines use this for dynamic values (image tag, commit SHA, Key Vault secret refs).
helm upgrade --install orders ./chart \
-f values.yaml \
-f values-prod.yaml \
--set image.tag=$(Build.BuildNumber) \
--set secrets.dbPassword=$(DB_PASSWORD) \
--namespace orders --create-namespace
Pipeline pattern
A standard Azure Pipelines deploy step: (1) Log in to AKS with AzureCLI@2 + az aks get-credentials, (2) Pull secrets with AzureKeyVault@2, (3) helm upgrade --install with -f values-$(env).yaml and --set image.tag plus --set lines for Key-Vault-sourced secrets. One chart, N environments, all the deltas in version control.
Build a values merger
Write a mergeValues(base, overlay, setOverrides) function that deep-merges the three sources with the precedence base < overlay < setOverrides. Maps merge recursively; arrays and scalars are replaced. Parse --set a.b.c=x style overrides into nested objects. Log the final effective config.
Keep secrets OUT of values files
Values files live in git. Anything secret (DB passwords, API keys) should come from Key Vault via CSI driver (mounted into the pod at runtime) or from --set with the value sourced from the pipeline's AzureKeyVault@2 task. If you see a raw secret in values-prod.yaml during a code review, fail the PR — it's already compromised by being in git history.
🔁 Memorize the Helm flags
In an incident you won't have time to look up helm rollback, helm history, or the -f / --set precedence. Open the Command Lab from the Azure course home and repeat the Helm cards — install/upgrade, rollback, --dry-run/template, get values, --atomic — until they're automatic. Repetition is the whole trick. Keep at it!
Quiz: Array merge
Your values.yaml has env: [{name: A, value: 1}, {name: B, value: 2}] and values-prod.yaml has env: [{name: A, value: 99}]. What does the deployed pod see? Only A=99 — arrays are replaced wholesale. If you need to add to an array, you must redeclare the full list in the overlay.