Skip to content

Instantly share code, notes, and snippets.

@bplasmeijer
Forked from DzeryCZ/ReadingHelmResources.md
Created January 12, 2024 12:07
Show Gist options
  • Save bplasmeijer/70d4c04e583849135ecfce43a3720f61 to your computer and use it in GitHub Desktop.
Save bplasmeijer/70d4c04e583849135ecfce43a3720f61 to your computer and use it in GitHub Desktop.
Decoding Helm3 resources in secrets

Helm 3 is storing description of it's releases in secrets. You can simply find them via

$ kubectl get secrets
NAME                                                TYPE                                  DATA   AGE
sh.helm.release.v1.wordpress.v1                     helm.sh/release.v1                    1      1h

If you want to get more info about the secret, you can try to describe the secret

$ kubectl describe secret sh.helm.release.v1.wordpress.v1
Name:         sh.helm.release.v1.wordpress.v1
Namespace:    default
Labels:       createdAt=1578561400
              name=wordpress
              owner=helm
              status=superseded
              version=1
Annotations:  <none>

Type:  helm.sh/release.v1

Data
====
release:  34976 bytes

Now you can see, that the secret is holding one file release which has ~35kB. In order to read that, you need to know, that kubernetes secrets are base64 encoded by default. But after decoding, you still don't get the data because Helm3 is encoding those data further.

So in order to decode the data, you have to:

  • base64 decode - Kubernetes secrets encoding
  • base64 decode (again) - Helm encoding
  • gzip decompress - Helm zipping

The final command to get the Helm's release data can look like this:

kubectl get secrets sh.helm.release.v1.wordpress.v1 -o json | jq .data.release | tr -d '"' | base64 -d | base64 -d | gzip -d 

Voilà, now you have JSON data of Helm resources. It stores every Chart's file and further encode it via base64.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment