Azure 35: Helm en AKS — overlays de values
easy⏱ 5 mincourseazure
Chart structure
A Helm chart is a directory: Chart.yaml (metadata, version), values.yaml (defaults), templates/ (Go-templated manifests — Deployment, Service, ConfigMap, Ingress). At install time, Helm renders each template with the merged values, then applies the result to the cluster as a Release with a version history you can rollback to.
my-chart/
├── Chart.yaml
├── values.yaml # defaults
├── values-dev.yaml # dev overrides
├── values-uat.yaml
├── values-prod.yaml
└── templates/
├── deployment.yaml
├── service.yaml
└── ingress.yaml
Overlay merge semantics
helm install -f values.yaml -f values-prod.yaml does a deep merge: scalars and leaves in the right file win; maps are merged key-by-key; arrays are replaced wholesale (a common gotcha). --set key=value overrides are applied last and beat both files — pipelines use this for dynamic values (image tag, commit SHA, Key Vault secret refs).
helm upgrade --install orders ./chart \
-f values.yaml \
-f values-prod.yaml \
--set image.tag=$(Build.BuildNumber) \
--set secrets.dbPassword=$(DB_PASSWORD) \
--namespace orders --create-namespace
Pipeline pattern
A standard Azure Pipelines deploy step: (1) Log in to AKS with AzureCLI@2 + az aks get-credentials, (2) Pull secrets with AzureKeyVault@2, (3) helm upgrade --install with -f values-$(env).yaml and --set image.tag plus --set lines for Key-Vault-sourced secrets. One chart, N environments, all the deltas in version control.
Build a values merger
Write a mergeValues(base, overlay, setOverrides) function that deep-merges the three sources with the precedence base < overlay < setOverrides. Maps merge recursively; arrays and scalars are replaced. Parse --set a.b.c=x style overrides into nested objects. Log the final effective config.
Keep secrets OUT of values files
Values files live in git. Anything secret (DB passwords, API keys) should come from Key Vault via CSI driver (mounted into the pod at runtime) or from --set with the value sourced from the pipeline's AzureKeyVault@2 task. If you see a raw secret in values-prod.yaml during a code review, fail the PR — it's already compromised by being in git history.
🔁 Memorizá los flags de Helm
En un incidente no vas a tener tiempo de buscar helm rollback, helm history ni la precedencia de -f / --set. Abrí el Command Lab desde el inicio del curso de Azure y repetí las tarjetas de Helm — install/upgrade, rollback, --dry-run/template, get values, --atomic — hasta que salgan automáticas. La repetición es todo el truco. ¡Seguí así!
Quiz: Array merge
Your values.yaml has env: [{name: A, value: 1}, {name: B, value: 2}] and values-prod.yaml has env: [{name: A, value: 99}]. What does the deployed pod see? Only A=99 — arrays are replaced wholesale. If you need to add to an array, you must redeclare the full list in the overlay.