Helm Package Manager Quiz

Related guide: Helm

These 20 question topics follow the Helm 3.21.3 / 4.3.0 review.

Multiple Choice

1. What did removing Tiller change?

• A) Only chart size changes.
• B) The client uses its Kubernetes credentials and RBAC.
• C) Every chart becomes safe.
• D) The Kubernetes API is no longer needed.

Show answer

Answer: B

Helm 3 removed Tiller and simplified the permission path. Unsafe manifests and broad client permissions still require review.

2. What is values.yaml for?

• A) Chart metadata
• B) Default configuration data consumed by templates
• C) Release history
• D) An automatically executed template

Show answer

Answer: B

Only values consumed by templates have an effect. Files and --set variants can override them; embedded template strings are not automatically evaluated.

3. What does helm upgrade --install do?

• A) Always creates a new release
• B) Always deletes and recreates
• C) Installs a missing release or upgrades an existing one
• D) Guarantees idempotency of external operations

Show answer

Answer: C

It selects installation or upgrade. Hooks, random values and external database changes need not be idempotent.

4. What is Release.Name?

• A) Chart name
• B) Cluster name
• C) The chosen release name
• D) Image tag

Show answer

Answer: C

In helm install demo ./chart, the name is demo. It differs from chart name, appVersion and release revision.

5. What does a dependency condition specify?

• A) Image tag
• B) A values path controlling whether the dependency is enabled
• C) Registry password
• D) Pod priority

Show answer

Answer: B

For alias cache, use a real Boolean path such as cache.enabled. Test absent-path behavior and distinguish it from values passed into the subchart.

6. When does a pre-upgrade hook run?

• A) After deletion
• B) After rendering and before ordinary resources are upgraded
• C) Always after new Pods are Ready
• D) Only after rollback

Show answer

Answer: B

A database migration must account for database availability, retries, failure and compatibility with the previous app. Rollback does not automatically undo database changes.

7. What is the purpose of ordinary helm template?

• A) Install into a cluster
• B) Render manifests locally
• C) Validate real webhooks
• D) Roll back automatically

Show answer

Answer: B

Default local rendering does not prove admission, RBAC, image execution or connectivity. Distinguish it from options that contact a server.

8. What is _helpers.tpl for?

• A) Store metadata
• B) Define reusable named templates
• C) Store default values
• D) Store release history

Show answer

Answer: B

Use define for named templates and include to consume them. Prefix names to avoid collisions and pass the intended context.

9. What does helm get values demo --all output?

• A) Only user overrides
• B) Computed values including chart defaults
• C) Only manifests
• D) Only history

Show answer

Answer: B

Select the correct namespace and release. Values can contain sensitive information, so protect the output.

10. Why combine toYaml with nindent?

• A) Automatic encryption
• B) Serialize structured values to YAML and add a newline/indentation
• C) Generate only JSON
• D) Always convert numbers to strings

Show answer

Answer: B

Unlike indent, nindent also prepends a newline. Match the indentation required at the insertion point.

Short Answer

1. What is the default release storage resource?

Show answer

A Secret in the release namespace, named sh.helm.release.v1.<release>.v<revision>. Other backends such as ConfigMap or SQL can be configured. Base64 is not encryption.

2. Which lock file does dependency update create, and what are its limits?

Show answer

Chart.lock. dependency build uses its locked versions, but the lock alone does not guarantee artifact integrity, pinned images or complete reproducibility.

3. Which empty values matter when using default?

Show answer

False, zero, empty strings and collections count as empty. Check presence and type when explicit false/zero must be preserved. default does not protect every nested lookup.

4. Which annotation controls hook ordering?

Show answer

helm.sh/hook-weight. Lower weights run first within the phase, including negative weights. Also consider kind/name tie ordering, Job completion and timeouts.

5. When and why is NOTES.txt used?

Show answer

It templates instructions shown after successful install/upgrade and available through helm get notes. Keep instructions accurate and avoid secrets. Notes do not prove application readiness.

Hands-on

1. Install the example as web-server in frontend with three replicas.

Show answer

helm install web-server examples/platform/helm/reviewed-app \
  --namespace frontend --create-namespace \
  --set replicaCount=3

Run from the repository root with an approved cluster context and permissions. This audit ran lint/template/package, not installation.

2. How should LOG_LEVEL=debug and MAX_CONNECTIONS="100" render as env?

Show answer

env:
  - name: LOG_LEVEL
    value: "debug"
  - name: MAX_CONNECTIONS
    value: "100"

Range over the map and quote each value so both remain strings. Go templates traverse maps with basic ordered keys in key order; this is distinct from list ordering.

3. Write a helper for chart, release and appVersion labels.

Show answer

{{- define "mychart.labels" -}}
app.kubernetes.io/name: {{ .Chart.Name | quote }}
app.kubernetes.io/instance: {{ .Release.Name | quote }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}

Pass the intended root context and indent at the call site. appVersion is metadata and does not automatically select an image tag.

Advanced

1. What is needed for Blue/Green and canary delivery with Helm?

Show answer

Blue/Green requires two Deployments with labels and an actual Service template that selects the active color after validation. Template strings inside values.yaml are not automatically evaluated. Canary requires real routes/subsets or a rollout controller, weights, observation metrics and abort conditions. Values alone do not create automated analysis or rollback. Account for database compatibility and in-flight requests.

2. Design chart security and secret management.

Show answer

Validate required values and types with a supported values.schema.json, and pin reviewed chart/image revisions. Connect required ServiceAccounts and RoleBindings with minimal API permissions. A Secret volume does not justify granting the app access to all Secrets. Keep secret values out of defaults, CLI arguments and debug logs; plan approved file mounts, rotation and rereading. ESO v1, Sealed Secrets and helm-secrets require their controllers/plugins and provider/key permissions. Check whether decrypted values enter release records. Combine a non-root UID, dropped capabilities, a read-only root and required writable volumes, then verify actual image compatibility.