Frequently Asked Questions

helm repo add helmforge https://repo.helmforge.dev
helm repo update

You can also install charts directly from the OCI registry without adding a repo:

helm install my-release oci://ghcr.io/helmforgedev/helm/redis

Yes. All HelmForge charts are published as OCI artifacts on GitHub Container Registry:

helm install my-release oci://ghcr.io/helmforgedev/helm/<chart-name>

All releases include GPG provenance files and Cosign keyless signatures. You can verify them with:

# Cosign (OCI artifacts)
cosign verify ghcr.io/helmforgedev/helm/<chart-name>:<version> \
  --certificate-identity-regexp="github.com/helmforgedev" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"

# GPG (Helm provenance)
helm verify <chart-name>-<version>.tgz --keyring pgp-public-key.asc

For most charts, helm upgrade performs a rolling update by default:

helm upgrade my-release helmforge/<chart-name> -f values.yaml

For database charts, check the architecture-specific docs:

• Standalone: brief downtime during pod restart is expected
• Replication: the upgrade rolls replicas first, then the primary, minimizing downtime

Always back up data before upgrading database charts.

helm install my-release helmforge/<chart-name> --version 1.2.3

To list all available versions:

helm search repo helmforge/<chart-name> --versions

Set ingress.className in your values:

ingress:
  enabled: true
  className: nginx # or traefik, haproxy, etc.
  hosts:
    - host: app.example.com
      paths:
        - path: /
          pathType: Prefix

HelmForge charts default to traefik as the ingress class, but any controller that supports the IngressClass resource will work.

Add the cert-manager annotation and a TLS section:

ingress:
  enabled: true
  className: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: app.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: app-tls
      hosts:
        - app.example.com

Most charts support a resources block:

resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    cpu: 500m
    memory: 512Mi

Check the chart’s values.yaml for the exact path — some charts have per-component resources (e.g., primary.resources, secondary.resources).

Most charts support existingSecret:

auth:
  existingSecret: my-precreated-secret

The secret must contain the expected keys. Check the chart’s README for the required key names.

Database charts that support backup accept S3-compatible endpoints:

backup:
  enabled: true
  schedule: '0 2 * * *'
  s3:
    endpoint: http://minio.minio.svc.cluster.local:9000
    bucket: backups
    accessKey: minioadmin
    secretKey: minioadmin
    region: us-east-1

For production, store credentials in a Kubernetes Secret and reference it via backup.existingSecret.

Charts with built-in S3 backup CronJobs:

• PostgreSQL — pg_dump to S3
• MySQL — mysqldump to S3
• MongoDB — mongodump to S3
• MariaDB — mariadb-dump to S3

All backup jobs support S3-compatible endpoints (AWS S3, MinIO, DigitalOcean Spaces, etc.).

Backup restoration is application-specific. General steps:

1. Download the backup from S3
2. Create a new release or scale down the existing one
3. Restore using the application’s native tool (psql, mysql, mongorestore)
4. Verify data integrity
5. Scale back up

Check the chart’s docs for detailed restore procedures.

Use a NodePort or LoadBalancer service type:

service:
  type: LoadBalancer
  port: 80

Or use port-forwarding for development:

kubectl port-forward svc/my-release-<chart> 8080:80

Deploy both charts and point Pi-hole’s upstream DNS to Cloudflared:

# Pi-hole values
pihole:
  dns:
    upstream:
      - 'cloudflared.default.svc.cluster.local#5053'

See the Network Stack preset in the Stack Builder for a one-click setup.

HelmForge charts are tested on Kubernetes 1.28+. Most charts work on 1.26+ but we recommend staying on a supported Kubernetes version.

Yes. For ArgoCD, create an Application resource:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-redis
  namespace: argocd
spec:
  destination:
    namespace: default
    server: https://kubernetes.default.svc
  source:
    repoURL: https://repo.helmforge.dev
    chart: redis
    targetRevision: '*'
    helm:
      values: |
        architecture: standalone
  project: default

For Flux, create a HelmRelease:

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: my-redis
  namespace: default
spec:
  chart:
    spec:
      chart: redis
      sourceRef:
        kind: HelmRepository
        name: helmforge
      version: '*'
  values:
    architecture: standalone

The Stack Builder can generate both ArgoCD and Helmfile manifests.

Yes. HelmForge charts use official upstream images whenever available. When an official image does not exist, the chart documents this clearly and specifies a trusted community image.

All image tags are pinned to specific versions — never latest or floating tags.

Yes. HelmForge uses dual signing: GPG provenance files for helm verify and Sigstore Cosign keyless signatures on OCI artifacts. Both are generated automatically in the CI/CD pipeline. See the installation section above for verification commands.

All HelmForge charts are released under the MIT License. You can use them freely in personal and commercial projects.