Kubernetes Manifests & Helm Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

A manifest is a request you can diff

This page is the file that describes a workload: plain YAML, or a Helm chart with values you can read. The YAML generator drafts a starter. It does not apply it. The Kubernetes guide owns the cluster and the context. A managed cluster guide owns the product. You do not skip those because the file looks finished.

Helm is a package with a version. Write the chart version and the values that differ from the defaults. A default you have not read is still a choice. If the chart wants cluster administrator rights, that is a reason to stop, not a reason to install it faster.

Secrets do not go in values you commit. A secret reference is a name. The value lives in the secret store or in a sealed object whose key you do not paste here. prompt-for-this marks a sample. It is not a password.

One file is this window. A bundle of twenty kinds of objects is a platform, and it belongs to a later review. Namespace, workload, and service are enough to explain.

One file, one version, a context you have not applied to yet

Choose plain YAML or Helm, and write why. Draft or open one workload. Read the image tag, the namespace, the requests, and the service type. Pin the tag. A public load balancer is removed until the network ticket exists.

If you chose Helm, write the chart name and version. Read the values you set. Then read the defaults that grant rights or open a port. The rendered output, when you later template it, is what you review. The values file alone can hide a binding.

The context check from the Kubernetes guide happens before any apply, in that guide's window. This page can finish with the file in the ticket and no cluster contact at all. That is a successful hour.

A conversion from compose is the migration guide. Do not convert and install in the same hour. kube-system is not the namespace for a lab.

# Manifest note. Nothing is applied in the writing hour.
# Pin the image. Name the chart version if you use Helm.
# No secret in committed values.
# No cluster-admin from a chart default.
# Namespace is a lab name, not kube-system.
# prompt-for-this is not a password.

A change you can finish

Apply is a later window on the cluster named in the Kubernetes guide, one file, after a get shows the right context.

Rollback is the previous file or the previous chart version. You do not delete the namespace to undo a values typo.

Choose YAML or Helm and say why.
Put one workload in a lab namespace.
Pin the image and, for Helm, the chart version.
Read defaults that grant rights or open ports.
Remove secrets from committed values.
Remove a public service.
Leave apply to the cluster window.

Mistakes that outlive the command

Kubernetes manifests and Helm fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

Applying during the writing hour.
An unpinned image.
A chart version you did not write down.
cluster-admin accepted from a default.
A secret in values.yaml.
A lab installed into kube-system.
A public load balancer as a default.
Reviewing values and not the render.
Twenty objects in the first file.
A compose conversion applied the same day.
The wrong context, because this page skipped the check.
Deleting the namespace as a rollback.

Decisions to write down before the window

One decision for Kubernetes manifests and Helm: YAML or Helm is chosen. One workload is in the file. The namespace is a lab name. The image tag is pinned. The chart version is written, or Helm is not used. Defaults were read. No cluster-admin remains. No secret is committed. No public service remains. Apply has not happened. The context check belongs to the cluster window. And a second person can name the workload.

The hour you stop

Write the account, the project or subscription, the region, and the clock time before you change anything for Kubernetes manifests and Helm. If this account is serving people and you do not have a way back, this hour is a plan. A plan you can read tomorrow is a success. A change you cannot undo is not.

Use a lab account, a lab project, or a lab subscription you administer. You do not point a CLI, a pipeline, or a browser tool at an account you do not run. The tools on this site run in the browser. They draft text. They do not log in, and they do not scan.

prompt-for-this is a reminder that a secret is missing. It is not an access key, a token, a password, or a kubeconfig you save. The real secret stays in the password store or the platform's secret store. If a file, a log, a ticket, or a pipeline still contains a live secret, stop and rotate it. Then delete the copy.

One change. A network, a virtual machine, a policy, and a pipeline do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous file, the previous plan, or the resource you can delete because it was only a lab.

A second person reads the scope aloud: which account, which region, which name. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.

Documentation addresses stay in the note. 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, and 2001:db8::/32 are not prefixes you type into a production network. example.com is not your zone. A generated file that opens 0.0.0.0/0 is a file you edit before it is applied. A source you can name is the rule you keep.

Do not apply a draft you have not read. A cost estimate, a policy, a manifest, and a Terraform plan are reading material. Apply, a resize of a live machine, and a delete of a bucket are later decisions with their own proof. Read the names. Then decide.

Keep the previous file. A generator draft is not the previous file. The previous file is what you put back if the new one is wrong. You practised the path back, including the serial console or a second admin, before you changed a network or a lockout setting.

If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied stack produces an account nobody can explain. Rebuild the lab from the copy you kept.

When the checks pass, the next account waits until someone else can repeat the proof from the notes. Kubernetes manifests and Helm is done for this window when the proof is written, not when a CLI printed a success line.

This page is a planning guide. It is not a vendor manual, not an official standard, not legal advice, and not an audit opinion. If an auditor must see the decision, they see the ticket and the evidence, not this paragraph.

Hand the finished note to the neighbouring guide that owns the next step, and leave this account alone until that guide has its own window.

Manifest checks before any apply

Confirm this before you call the change done: The file is in the ticket. The namespace is not kube-system. The image tag is pinned. The chart version is recorded, or there is no chart. A rights-granting default was removed or justified in a sentence. No secret is in the file. No public service is in the file. Nothing was applied. The cluster name is the one from the Kubernetes guide. Rollback is the previous file. A second person read the namespace. The next window is one apply, not a bundle. The hostname in the prompt matches the hostname in the ticket for Kubernetes manifests and Helm. The result line includes the time and the person, not only the command. You can point at the rollback value without searching a chat history. And done is a sentence a second person can repeat: the proof for Kubernetes manifests and Helm happened, and the next host is not started early. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Kubernetes YAML Generator

Guides in this cluster

These supporting pages belong to this pillar.