Helm

Constraints

Charts MUST produce manifests that satisfy the kubernetes skill constraints:

• Set resource requests and limits on every container
• Include liveness and readiness probes
• Use Secrets for sensitive data (never ConfigMaps or plain env vars)
• Dedicated ServiceAccount per workload — never rely on default
• Include a NetworkPolicy template (default-deny + explicit allows)
• Run containers as non-root with readOnlyRootFilesystem: true
• Use app.kubernetes.io/* standard labels (via _helpers.tpl)
• Never use :latest — default to .Chart.AppVersion
• Include PodDisruptionBudget for production workloads

Chart Structure

mychart/
├── Chart.yaml          # Chart metadata (required)
├── values.yaml         # Default values (required)
├── values.schema.json  # Values validation schema
├── charts/             # Dependency charts
├── templates/          # Template files
│   ├── NOTES.txt       # Post-install notes
│   ├── _helpers.tpl    # Template helpers
│   ├── deployment.yaml
│   ├── service.yaml
│   ├── ingress.yaml
│   ├── configmap.yaml
│   ├── serviceaccount.yaml
│   ├── hpa.yaml
│   └── tests/
│       └── test-connection.yaml
├── crds/               # Custom Resource Definitions
└── .helmignore         # Files to ignore when packaging

Chart.yaml

apiVersion: v2