Skip to content
In this Guide

In this Guide

Deep Dives

AI: Claude and Codex patterns

ConfigHub: Deploy and manage

Why did Helm ignore my values?

Helm accepts keys that a chart never reads, and it says nothing. Check every key in your values file in one run, keep the checked result, and make your next change from it.

Runs on your laptop. No ConfigHub account or cluster is required.

See one example

Redis 27.0.0 accepts the misspelled key auth.passwrod. The baseline and changed renders have the same object-set hash, so the key changed nothing and Helm gave no warning.

auth:
  passwrod: wrong-key-is-ignored

This record proves that one key on one chart version. It does not claim that every possible Redis value has been tested.

Check your own chart

Install the cub CLI, then add the Workshop plugin. The install script fetches cub from the confighub/sdk releases, and you can download it from there yourself instead.

cub plugin install confighub/cub-workshop@v0.6.61

The command installs the plugin release this page was checked with, version 0.6.58. Run the check in a new directory that holds a copy of your values file. Name your chart the way you install it. This example reads a chart from a Helm repository; for a chart in a registry, pass its oci:// address and leave out --repo.

cub config values oauth2-proxy --repo https://oauth2-proxy.github.io/manifests --version 10.7.0 \
  --values my-values.yaml --out values-report.json --render-out candidate.yaml --exit-code

The plugin renders the chart with your values, then once more for each value with that value taken out. A key the chart has no place for comes back IGNORED. A key the chart reads but another setting switches off comes back NO EFFECT. A key that changed the objects comes back APPLIED, with the objects it changed. Exit code 1 means at least one value did nothing, and exit code 2 means the check could not finish. No value is printed.

APPLIED means the rendered objects changed. Some charts copy a block such as resources into the object as written, so a misspelled field inside it still changes the objects. The check names a misspelled container resource field as INVALID, such as resources.limit where Kubernetes expects limits, and exits 1. It checks only container resource fields, so read any other changed field in the candidate yourself. When a key is IGNORED, the check names chart-declared candidates, such as controller.replicaCount for a top-level replicaCount. Review them before you change your values. If none fits, search the chart's defaults for what you meant, for example helm show values <chart> | grep -n -i replica.

Your AI assistant can run the same command, and it learns more than a single render and diff would show. It checks every key, including ones nobody suspected. The exit code can fail a build, and the saved files let the next session start from this result.

Keep the result for the next change

Keep my-values.yaml, values-report.json and candidate.yaml together. The report records the chart, its version, a hash of your values file and a hash of the render, and it holds no values. The candidate is the exact set of objects the chart produced, Secrets included, so keep it private and out of Git.

For the next change, edit the values, check them again into a new candidate, and compare the two.

cub config values oauth2-proxy --repo https://oauth2-proxy.github.io/manifests --version 10.7.0 \
  --values my-values.yaml --out values-report-next.json --render-out candidate-next.yaml --exit-code
cub config diff candidate.yaml candidate-next.yaml

The diff lists every changed field and every object the chart added or removed. A value can switch on a whole object, so read the added objects as well as the changed fields. Keep the new files beside the old ones rather than overwriting them.

Know when ConfigHub helps

Files are enough while one person changes one chart. ConfigHub helps once the configuration is shared, or changed by more than one person or tool. It keeps your deliberate edits as recorded changes and carries them through the next chart version or AI rewrite. It also adds a history you can roll back, an approval before anything ships, and a release that Argo CD or Flux pulls by digest.

An edit made directly to candidate.yaml does not change your values file, so the next render drops it. The My fixes survive demo shows ConfigHub carrying such edits through an upstream change. ConfigHub Server explains what needs an account or a server you run yourself.

Check the record

Open the Redis values diagnostic. It records both render hashes, the no-change result, and the limit of the check.

Do this next

Follow the Values Guide on your own chart. It shows the command and the assistant prompt, and walks through keeping the result and making a second change.

Start this check