Helm Controller

Flags

Name Type Description
--concurrent int The number of concurrent HelmRelease reconciles. (default 4)
--default-kubeconfig-service-account string Default service account used for kubeconfig.
--default-service-account string Default service account used for impersonation.
--enable-leader-election boolean Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager.
--events-addr string The address of the events receiver.
--graceful-shutdown-timeout int The duration given to the reconciler to finish before forcibly stopping. (default 600s)
--health-addr string The address the health endpoint binds to. (default “:9440”)
--http-retry int The maximum number of retries when failing to fetch artifacts over HTTP. (default 9)
--http-timeout duration The timeout for HTTP requests when fetching artifacts. (default 30s)
--insecure-kubeconfig-exec boolean Allow use of the user.exec section in kubeconfigs provided for remote apply.
--insecure-kubeconfig-tls boolean Allow that kubeconfigs provided for remote apply can disable TLS verification.
--interval-jitter-percentage uint8 Percentage of jitter to apply to interval durations. A value of 10 will apply a jitter of +/-10% to the interval duration. It cannot be negative, and must be less than 100. (default 5)
--leader-election-lease-duration duration Interval at which non-leader candidates will wait to force acquire leadership (duration string). (default 35s)
--leader-election-release-on-cancel boolean Defines if the leader should step down voluntarily on controller manager shutdown. (default true)
--leader-election-renew-deadline duration Duration that the leading controller manager will retry refreshing leadership before giving up (duration string). (default 30s)
--leader-election-retry-period duration Duration the LeaderElector clients should wait between tries of actions (duration string). (default 5s)
--log-encoding string Log encoding format. Can be ‘json’ or ‘console’. (default “json”)
--log-level string Log verbosity level. Can be one of ‘trace’, ‘debug’, ‘info’, ‘error’. (default “info”)
--max-retry-delay duration The maximum amount of time for which an object being reconciled will have to wait before a retry. (default 15m0s)
--metrics-addr string The address the metric endpoint binds to. (default “:8080”)
--min-retry-delay duration The minimum amount of time for which an object being reconciled will have to wait before a retry. (default 750ms)
--no-cross-namespace-refs boolean When set to true, references between custom resources are allowed only if the reference and the referee are in the same namespace.
--oom-watch-interval duration The interval at which the OOM watcher will check for memory usage. Requires feature gate ‘OOMWatch’ to be enabled. (default 500ms)
--oom-watch-memory-threshold uint8 The memory threshold in percentage at which the OOM watcher will trigger a graceful shutdown. Requires feature gate ‘OOMWatch’ to be enabled. (default 95)
--oom-watch-max-memory-path string The path to the cgroup memory limit file. Requires feature gate ‘OOMWatch’ to be enabled. If not set, the path will be automatically detected.
--oom-watch-current-memory-path string The path to the cgroup current memory usage file. Requires feature gate ‘OOMWatch’ to be enabled. If not set, the path will be automatically detected.
--override-manager stringArray List of field managers to override during drift detection e.g. ‘–override-manager=kubectl-edit –override-manager=kubectl-patch’
--requeue-dependency duration The interval at which failing dependencies are reevaluated. (default 30s)
--snapshot-digest-algo string The algorithm to use to calculate the digest of Helm release storage snapshots. (default “sha256”)
--token-cache-max-size int The maximum amount of entries in the LRU cache used for tokens. (default 100, enabled)
--token-cache-max-duration duration The maximum duration for which a token would be considered unexpired. This is capped at 1h. (default 1h)
--watch-all-namespaces boolean Watch for custom resources in all namespaces, if set to false it will only watch the runtime namespace. (default true)
--watch-configs-label-selector string Watch for ConfigMaps and Secrets with matching labels (default ‘reconcile.fluxcd.io/watch=Enabled’).
--watch-label-selector string Watch for resources with matching labels e.g. ‘sharding.fluxcd.io/key=shard1’.
--feature-gates mapStringBool A comma separated list of key=value pairs defining the state of experimental features.

Feature Gates

Name Default Value Description
AdditiveCELDependencyCheck false Run both the built-in health checks and the CEL expression readyExpr when readyExpr is configured on a HelmRelease.
AdoptLegacyReleases true Enables the adoption of the historical Helm release based on the status fields from a v2beta1 HelmRelease object. This is enabled by default to support an upgrade path from v2beta1 to v2beta2 without the need to upgrade the Helm release.
AllowDNSLookups false Allows the controller to perform DNS lookups when rendering Helm templates. This is disabled by default, as it can be a security risk.
CacheSecretsAndConfigMaps false Configures the caching of Secrets and ConfigMaps by the controller-runtime client. When enabled, it will cache both object types, resulting in increased memory usage.
CancelHealthCheckOnNewRevision false Cancels ongoing health checks when a new revision is detected. Enabling DefaultToRetryOnFailure together is recommended, as HelmReleases are more prone to get stuck after the cancellation when using the default retry configuration (no retries).
DefaultToRetryOnFailure false Changes the default failure handling strategy from RemediateOnFailure to RetryOnFailure for both install and upgrade operations when no strategy is explicitly specified.
DirectSourceFetch false Enables fetching source objects directly from the API server using APIReader, bypassing the controller’s cache. This can be useful when immediate consistency is required for source object reads.
DisableChartDigestTracking false Disables the tracking of digest changes for Helm OCI charts. When set to true, the controller will not append the OCI digest to the chart version in Chart.yaml.
DisableConfigWatchers false Disables the watchers for ConfigMaps and Secrets.
ExternalArtifact true Enables support for the ExternalArtifact source type.
ObjectLevelWorkloadIdentity false Enables the use of object-level workload identity for the controller.
OOMWatch false Enables the OOM watcher, which will gracefully shut down the controller when the memory usage exceeds the configured limit. This is disabled by default.
UseHelm3Defaults false Restores Helm v3 defaults. When enabled, uses client-side apply for installation, Helm’s legacy readiness logic, and the nohooks post-render strategy instead of the Helm v4 defaults (server-side apply, kstatus-based health checking, and combined post-render strategy).