Using Post-Renderers

1. Understanding Post-Renderers

Post-renderers in Helm are tools that process the rendered Kubernetes manifests after Helm has generated them but before they are applied to the cluster. They allow for additional transformations or validations of the manifests.

Feature	Description	Usage
post-renderer	Executable that takes rendered manifests and outputs modified versions	Used via `--post-renderer` flag in Helm commands
input	Rendered manifests passed to the executable via stdin	Standard input stream of the executable
output	Modified manifests written to stdout	Standard output stream of the executable

Example: Simple Post-Renderer Script

#!/bin/bash
# Simple post-renderer that adds a label to all resources
sed -i 's/labels:/labels:\n  post-rendered: true/' < /dev/stdin

Note: The post-renderer executable must be in the PATH or specified with an absolute path.

Warning: Post-renderers are executed in the same environment as Helm, so ensure they do not introduce security vulnerabilities.

2. Configuring Post-Renderer Command

Property	Description	Values
post-renderer	Command to run after rendering	`helm template --post-renderer /path/to/post-renderer.sh my-release my-chart`

Example: Post-renderer script

#!/bin/bash
# Example post-renderer script that adds a label to all resources
sed -i 's/labels:/labels:\n  post-rendered: "true"/' "$1"

Note: The post-renderer command must be executable and available in the PATH.

3. Using Kustomize as Post-Renderer

Helm supports integrating Kustomize as a post-renderer to modify or extend the rendered Kubernetes manifests after Helm has generated them. This allows you to apply transformations like patches, overlays, or environment-specific customizations without modifying the original chart.

Property	Description	Example
post-renderer	Command to run as post-renderer, typically a Kustomize command.	`kustomize build`

Example: Using Kustomize with Helm

helm install my-app ./my-chart --post-renderer=kustomize

Note: The --post-renderer flag expects a command that reads from stdin and writes to stdout. Kustomize supports this via kustomize build.

Key Points

Kustomize can be used as a post-renderer to modify rendered manifests.
Post-renderers must read from stdin and write to stdout.
Use kustomize build as the command for Kustomize.

4. Applying Custom Patches

Example: Applying a Custom Patch with Post-Renderer

helm install my-release my-chart \
  --post-renderer ./my-post-renderer.sh

Option	Description	Usage
--post-renderer	Path to the executable post-renderer script	Used to apply custom patches or modifications to rendered templates

Note: The post-renderer must be executable and accept the rendered template on stdin and output the modified template on stdout.

Example: Post-Renderer Script (my-post-renderer.sh)

#!/bin/bash
# Apply a custom patch to the rendered template
sed -i 's/old-value/new-value/g' /dev/stdin

Key Points

Post-renderers allow for custom transformations of rendered templates.
They are executed after the template is rendered but before it's installed or upgraded.
The script must be executable and handle input/output via stdin/stdout.

5. Adding Labels and Annotations

Field	Description	Example
metadata.labels	Labels to be added to rendered resources	`"app.kubernetes.io/name": "myapp"`
metadata.annotations	Annotations to be added to rendered resources	`"helm.sh/chart": "mychart-1.0.0"`

Example: Adding Labels and Annotations via Post-Renderer

apiVersion: v1
kind: ConfigMap
metadata:
  name: my-config
  labels:
    app.kubernetes.io/name: myapp
    app.kubernetes.io/version: "1.0"
  annotations:
    helm.sh/chart: mychart-1.0.0
    app.kubernetes.io/instance: myrelease
data:
  config.yaml: |
    key: value

Note: Post-renderers can modify labels and annotations on all resources generated by Helm, including those from sub-charts.

6. Modifying Generated Resources

Post-renderers in Helm allow you to modify the generated Kubernetes manifests after they are rendered but before they are applied. This is useful for injecting additional configuration or making last-minute changes to resources.

Feature	Description	Usage
post-renderer	Command to run after rendering	`helm install my-release my-chart --post-renderer=/path/to/script`
input	Input file (optional)	`--post-renderer=/path/to/script --post-renderer-input=/tmp/rendered.yaml`

Example: Using a Post-Renderer Script

#!/bin/bash
# script.sh
&#x2F;usr&#x2F;bin&#x2F;env cat > &#x2F;tmp&#x2F;output.yaml

Example: Modifying Labels with a Script

#!/bin/bash
# modify-labels.sh
INPUT_FILE="$1"
OUTPUT_FILE="$2"

# Read input and modify labels
sed -i 's/label: app/label: modified-app/g' "$INPUT_FILE"
cp "$INPUT_FILE" "$OUTPUT_FILE"

Note: Post-renderers must be executable and should read from stdin and write to stdout or a file.

Warning: Be cautious when modifying resources as it can lead to unexpected behavior or conflicts during upgrades.

7. Chaining Multiple Post-Renderers

Post-renderers in Helm can be chained to apply multiple transformations to the rendered output. This is useful for applying several modifications or validations in sequence.

Post-Renderer	Description	Usage Example
post-renderer-1	First transformation step, e.g., adding labels or annotations	`helm install my-release my-chart --post-renderer ./post-renderer-1`
post-renderer-2	Second transformation step, e.g., validating or modifying output	`helm install my-release my-chart --post-renderer ./post-renderer-2`

Example: Chaining Post-Renderers

Assuming two scripts add-labels.sh and validate-output.sh, both executable and accepting rendered manifests via stdin:

helm install my-release my-chart --post-renderer "./add-labels.sh | ./validate-output.sh"

Note: The order of execution is determined by the shell command pipeline. Ensure that each post-renderer accepts and outputs valid Kubernetes manifests.

8. Debugging Post-Renderer Output

Example: Debugging with verbose logging

helm install my-release ./my-chart \
  --set postRenderer.verbose=true \
  --set postRenderer.debug=true

Option	Values	Description
postRenderer.debug	`true` \| `false`	Enables debug mode for post-renderer output
postRenderer.verbose	`true` \| `false`	Enables verbose logging of post-renderer steps

Note: Debug output includes intermediate YAMLs and rendered templates, which can be useful for troubleshooting rendering issues.

Warning: Enabling debug mode may expose sensitive data in logs. Use only in development environments.

Debugging Tips

Use --debug flag with helm install to get detailed output
Check rendered templates using helm template with debug options
Validate YAML structure of post-rendered output using yaml-lint

9. Handling Post-Renderer Errors

Example: Error in Post-Renderer Script

#!/bin/bash
set -e

# Simulate an error in post-rendering
if [ "$1" = "error" ]; then
  echo "Error: Post-renderer failed" >&2
  exit 1
fi

# Normal processing
cat <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: my-config
data:
  key: value
EOF

Property	Description	Values	Notes
helm post-renderer error handling	How Helm handles errors in post-renderers	`exit 1`	If the script exits with non-zero code, Helm will fail the release
error propagation	Whether errors are propagated to the user	`true`	Errors from post-renderers are logged and shown to the user

Note: When a post-renderer script exits with a non-zero status, Helm treats it as a failure and stops the release process.

Warning: Ensure that your post-renderer script includes proper error handling to prevent silent failures.

10. Integrating Post-Renderers in CI/CD

Example: Using Helm Post-Renderer in GitHub Actions

name: Deploy with Helm
on:
  push:
    branches: [ main ]
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Helm
        uses: azure/setup-helm@v3
      - name: Install kubectl
        uses: azure/setup-kubectl@v3
      - name: Render and deploy
        run: |
          helm repo add stable https://charts.helm.sh/stable
          helm template my-app ./my-chart \
            --post-renderer ./scripts/post-render.sh \
            --set image.tag=latest

Step	Description	Configuration
post-renderer	Script to run after rendering	`--post-renderer ./scripts/post-render.sh`
script	Shell script or binary	Must be executable and in PATH
environment	Variables available to script	Includes `HELM_RELEASE_NAME`, `HELM_CHART_PATH`

Note: The post-renderer must be executable and available in the CI environment. It receives rendered YAML on stdin and outputs modified YAML to stdout.

Best Practices for CI/CD Integration

Use a dedicated script or binary as the post-renderer
Ensure all dependencies (e.g., yq, jq) are installed in the CI environment
Validate rendered output before deployment using helm template --debug
Log post-renderer output for debugging in CI logs

Using Post-Renderers

1. Understanding Post-Renderers

Example: Simple Post-Renderer Script

2. Configuring Post-Renderer Command

Example: Post-renderer script

3. Using Kustomize as Post-Renderer

Example: Using Kustomize with Helm

Key Points

4. Applying Custom Patches

Example: Applying a Custom Patch with Post-Renderer

Example: Post-Renderer Script (my-post-renderer.sh)

Key Points

5. Adding Labels and Annotations

Example: Adding Labels and Annotations via Post-Renderer

6. Modifying Generated Resources

Example: Using a Post-Renderer Script

Example: Modifying Labels with a Script

7. Chaining Multiple Post-Renderers

Example: Chaining Post-Renderers

8. Debugging Post-Renderer Output

Example: Debugging with verbose logging

Debugging Tips

9. Handling Post-Renderer Errors

Example: Error in Post-Renderer Script

10. Integrating Post-Renderers in CI/CD

Example: Using Helm Post-Renderer in GitHub Actions

Best Practices for CI/CD Integration

Was this article helpful?

Related Cheat Sheets

Working with Vagrant Boxes

Working with Text Editors

Implementing Backup and Disaster Recovery

Understanding Ansible Core Concepts