Decoding Helm3 resources in secrets

ReadingHelmResources.md

Helm 3 is storing description of it's releases in secrets. You can simply find them via

$ kubectl get secrets
NAME                                                TYPE                                  DATA   AGE
sh.helm.release.v1.wordpress.v1                     helm.sh/release.v1                    1      1h

If you want to get more info about the secret, you can try to describe the secret

$ kubectl describe secret sh.helm.release.v1.wordpress.v1
Name:         sh.helm.release.v1.wordpress.v1
Namespace:    default
Labels:       createdAt=1578561400
              name=wordpress
              owner=helm
              status=superseded
              version=1
Annotations:  <none>

Type:  helm.sh/release.v1

Data
====
release:  34976 bytes

Now you can see, that the secret is holding one file release which has ~35kB. In order to read that, you need to know, that kubernetes secrets are base64 encoded by default. But after decoding, you still don't get the data because Helm3 is encoding those data further.

So in order to decode the data, you have to:

• base64 decode - Kubernetes secrets encoding
• base64 decode (again) - Helm encoding
• gzip decompress - Helm zipping

The final command to get the Helm's release data can look like this:

kubectl get secrets sh.helm.release.v1.wordpress.v1 -o json | jq .data.release | tr -d '"' | base64 -d | base64 -d | gzip -d 

Voilà, now you have JSON data of Helm resources. It stores every Chart's file and further encode it via base64.

thx

marvelous! I come to this page like once a month for that command. kudos

Just wanted to also add the command needed in case a secret requires to be edited like in situations where the deployment is stuck with status pending-upgrade and can't be rolled back.

Considering that myapp.v1.edited.json has the decoded and edited content of .data.release from the commands above:

gzip -c myapp.v1.edited.json | base64 | base64 -w 0

goes here

    "data": {
        "release": " <<output goes here>> "

Thanks, this was really helpful!

okay, but how is this different to helm get all %release_name%?

From secrets you can get previous releases stuff. "get all" shows only current installed.

Anyway there are more user friendly ways to get it. I can advise helm dashboard plugin.

Awesome!