Helmfile — cheat sheet

A one-page lookup for the commands and flags used across this course. Grouped by task; the course pages cover the why behind each one — this page is just the what.

Setup & bootstrap

Task	Command
Install required Helm plugins (idempotent)	helmfile init
Add/update every repositories: entry	helmfile repos
Run helm dependency update for local charts	helmfile deps
Check current kubeconfig context	kubectl config current-context
Switch context	kubectl config use-context <name>

Everyday workflow

Task	Command
Preview the diff against the live cluster	helmfile -e <env> diff
Diff, then sync only changed releases (use this most)	helmfile -e <env> apply
Install/upgrade every selected release unconditionally	helmfile -e <env> sync
Render manifests only, no cluster contact	helmfile -e <env> template
Render + helm lint every selected release	helmfile -e <env> lint
List resolved releases	helmfile -e <env> list
helm status for every selected release	helmfile -e <env> status
Uninstall every selected release	helmfile -e <env> destroy
Compute merged values, write to a file	helmfile write-values --output-dir <dir>

Selection & ordering flags

Flag	Meaning
-e <env>	Pick environment (default: default)
-l key=value / --selector key=value	Filter by label; repeatable (OR across -l, AND within one -l)
-f <file>	Use this helmfile.yaml instead of the default
--concurrency N	Cap parallel installs across the whole run (default: unlimited)
--skip-needs	Ignore a selected release's needs: entirely
--include-needs	Also include the selection's direct needs: (one hop up)
--include-transitive-needs	Also include the selection's entire upstream chain
--skip-deps	Don't run helm dependency update before applying
--dry-run	Pass --dry-run through to helm
--debug	Print every underlying helm command Helmfile invokes
--state-values-set k=v	Override a state value from the CLI
--state-values-file f	Extra state values file

Secrets (helm-secrets + SOPS)

Task	Command
Generate an age keypair	age-keygen -o ~/.config/sops/age/keys.txt
Encrypt a values file in place	sops --encrypt --in-place secrets/prod.yaml
Decrypt-in-editor, re-encrypt on save	sops secrets/prod.yaml
Mask secrets in diff/apply output (use in CI, always)	helmfile -e <env> diff --suppress-secrets / apply --suppress-secrets

Release-entry fields (in helmfile.yaml)

Field	Purpose
name: / namespace:	Required — Helm release name and target namespace
chart:	Chart ref: <repoAlias>/<chart>, oci://..., a local path, or a git+https://... ref
version:	Always pin — a SemVer range makes the diff non-deterministic run to run
createNamespace: true	Let Helmfile kubectl create ns if the namespace is missing
installed: false	Declarative uninstall of this one release
condition:	Environment-value path that enables/disables the release
needs: [ns/name, ...]	Explicit DAG dependency — must succeed before this release starts
labels:	Free-form key/value pairs for -l selectors
values: / secrets:	Plain and SOPS-encrypted values sources, in strategic-merge order
set:	helm --set equivalent — last resort, doesn't handle nested structures well
hooks:	Commands run on the control machine around the release lifecycle

Hook events (control-machine, not Helm chart hooks)

Event	Fires
prepare	Before chart resolution
presync	Just before helm upgrade --install
postsync	After helm upgrade --install succeeds
cleanup	Always, after postsync or a failure

Templating functions (Go template + Sprig, inside .yaml/.gotmpl)

Function	Does
requiredEnv "VAR"	Read env var; fail the render if empty
env "VAR"	Read env var; empty string if unset
exec "/bin" (list ...)	Shell out; substitute stdout
readFile "path"	Inline a file's contents
default x .Values.y	Use x when .Values.y is missing or empty
toYaml / nindent N	Re-serialise a value as YAML, indented N spaces

Rollback

Helmfile has no rollback of its own — drop to Helm directly:

Task	Command
Show release revision history	helm -n <namespace> history <release>
Roll back to a revision	helm -n <namespace> rollback <release> <REVISION>

How this connects

The environments page covers -e/environment-values plumbing, the secrets page covers the age-vs-KMS backend tradeoff, and the release-DAG page covers what needs: and --concurrency actually guarantee.