|
| 1 | +# Helm Controller |
| 2 | + |
| 3 | +## Flags |
| 4 | + |
| 5 | +| Name | Type | Description | |
| 6 | +|----------------------------------------|---------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| |
| 7 | +| `--concurrent` | int | The number of concurrent HelmRelease reconciles. (default 4) | |
| 8 | +| `--default-kubeconfig-service-account` | string | Default service account used for kubeconfig. | |
| 9 | +| `--default-service-account` | string | Default service account used for impersonation. | |
| 10 | +| `--enable-leader-election` | boolean | Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager. | |
| 11 | +| `--events-addr` | string | The address of the events receiver. | |
| 12 | +| `--graceful-shutdown-timeout` | int | The duration given to the reconciler to finish before forcibly stopping. (default 600s) | |
| 13 | +| `--health-addr` | string | The address the health endpoint binds to. (default ":9440") | |
| 14 | +| `--http-retry` | int | The maximum number of retries when failing to fetch artifacts over HTTP. (default 9) | |
| 15 | +| `--http-timeout` | duration | The timeout for HTTP requests when fetching artifacts. (default 30s) | |
| 16 | +| `--insecure-kubeconfig-exec` | boolean | Allow use of the user.exec section in kubeconfigs provided for remote apply. | |
| 17 | +| `--insecure-kubeconfig-tls` | boolean | Allow that kubeconfigs provided for remote apply can disable TLS verification. | |
| 18 | +| `--interval-jitter-percentage` | uint8 | Percentage of jitter to apply to interval durations. A value of 10 will apply a jitter of +/-10% to the interval duration. It cannot be negative, and must be less than 100. (default 5) | |
| 19 | +| `--leader-election-lease-duration` | duration | Interval at which non-leader candidates will wait to force acquire leadership (duration string). (default 35s) | |
| 20 | +| `--leader-election-release-on-cancel` | boolean | Defines if the leader should step down voluntarily on controller manager shutdown. (default true) | |
| 21 | +| `--leader-election-renew-deadline` | duration | Duration that the leading controller manager will retry refreshing leadership before giving up (duration string). (default 30s) | |
| 22 | +| `--leader-election-retry-period` | duration | Duration the LeaderElector clients should wait between tries of actions (duration string). (default 5s) | |
| 23 | +| `--log-encoding` | string | Log encoding format. Can be 'json' or 'console'. (default "json") | |
| 24 | +| `--log-level` | string | Log verbosity level. Can be one of 'trace', 'debug', 'info', 'error'. (default "info") | |
| 25 | +| `--max-retry-delay` | duration | The maximum amount of time for which an object being reconciled will have to wait before a retry. (default 15m0s) | |
| 26 | +| `--metrics-addr` | string | The address the metric endpoint binds to. (default ":8080") | |
| 27 | +| `--min-retry-delay` | duration | The minimum amount of time for which an object being reconciled will have to wait before a retry. (default 750ms) | |
| 28 | +| `--no-cross-namespace-refs` | boolean | When set to true, references between custom resources are allowed only if the reference and the referee are in the same namespace. | |
| 29 | +| `--oom-watch-interval` | duration | The interval at which the OOM watcher will check for memory usage. Requires feature gate 'OOMWatch' to be enabled. (default 500ms) | |
| 30 | +| `--oom-watch-memory-threshold` | uint8 | The memory threshold in percentage at which the OOM watcher will trigger a graceful shutdown. Requires feature gate 'OOMWatch' to be enabled. (default 95) | |
| 31 | +| `--oom-watch-max-memory-path` | string | The path to the cgroup memory limit file. Requires feature gate 'OOMWatch' to be enabled. If not set, the path will be automatically detected. | |
| 32 | +| `--oom-watch-current-memory-path` | string | The path to the cgroup current memory usage file. Requires feature gate 'OOMWatch' to be enabled. If not set, the path will be automatically detected. | |
| 33 | +| `--override-manager` | stringArray | List of field managers to override during drift detection e.g. '--override-manager=kubectl-edit --override-manager=kubectl-patch' | |
| 34 | +| `--requeue-dependency` | duration | The interval at which failing dependencies are reevaluated. (default 30s) | |
| 35 | +| `--snapshot-digest-algo` | string | The algorithm to use to calculate the digest of Helm release storage snapshots. (default "sha256") | |
| 36 | +| `--token-cache-max-size` | int | The maximum amount of entries in the LRU cache used for tokens. (default 100, enabled) | |
| 37 | +| `--token-cache-max-duration` | duration | The maximum duration for which a token would be considered unexpired. This is capped at 1h. (default 1h) | |
| 38 | +| `--watch-all-namespaces` | boolean | Watch for custom resources in all namespaces, if set to false it will only watch the runtime namespace. (default true) | |
| 39 | +| `--watch-configs-label-selector` | string | Watch for ConfigMaps and Secrets with matching labels (default 'reconcile.fluxcd.io/watch=Enabled'). | |
| 40 | +| `--watch-label-selector` | string | Watch for resources with matching labels e.g. 'sharding.fluxcd.io/key=shard1'. | |
| 41 | +| `--feature-gates` | mapStringBool | A comma separated list of key=value pairs defining the state of experimental features. | |
| 42 | + |
| 43 | +### Feature Gates |
| 44 | + |
| 45 | +| Name | Default Value | Description | |
| 46 | +|----------------------------------|---------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| |
| 47 | +| `AdditiveCELDependencyCheck` | `false` | Run both the built-in health checks and the CEL expression `readyExpr` when `readyExpr` is configured on a HelmRelease. | |
| 48 | +| `AdoptLegacyReleases` | `true` | Enables the adoption of the historical Helm release based on the status fields from a v2beta1 HelmRelease object. This is enabled by default to support an upgrade path from v2beta1 to v2beta2 without the need to upgrade the Helm release. | |
| 49 | +| `AllowDNSLookups` | `false` | Allows the controller to perform DNS lookups when rendering Helm templates. This is disabled by default, as it can be a security risk. | |
| 50 | +| `CacheSecretsAndConfigMaps` | `false` | Configures the caching of Secrets and ConfigMaps by the controller-runtime client. When enabled, it will cache both object types, resulting in increased memory usage. | |
| 51 | +| `CancelHealthCheckOnNewRevision` | `false` | Cancels ongoing health checks when a new revision is detected. Enabling `DefaultToRetryOnFailure` together is recommended, as HelmReleases are more prone to get stuck after the cancellation when using the default retry configuration (no retries). | |
| 52 | +| `DefaultToRetryOnFailure` | `false` | Changes the default failure handling strategy from `RemediateOnFailure` to `RetryOnFailure` for both install and upgrade operations when no strategy is explicitly specified. | |
| 53 | +| `DirectSourceFetch` | `false` | Enables fetching source objects directly from the API server using APIReader, bypassing the controller's cache. This can be useful when immediate consistency is required for source object reads. | |
| 54 | +| `DisableChartDigestTracking` | `false` | Disables the tracking of digest changes for Helm OCI charts. When set to `true`, the controller will not append the OCI digest to the chart version in `Chart.yaml`. | |
| 55 | +| `DisableConfigWatchers` | `false` | Disables the watchers for ConfigMaps and Secrets. | |
| 56 | +| `ExternalArtifact` | `true` | Enables support for the [ExternalArtifact](https://github.com/fluxcd/source-controller/blob/main/docs/spec/v1/externalartifacts.md) source type. | |
| 57 | +| `ObjectLevelWorkloadIdentity` | `false` | Enables the use of object-level workload identity for the controller. | |
| 58 | +| `OOMWatch` | `false` | Enables the OOM watcher, which will gracefully shut down the controller when the memory usage exceeds the configured limit. This is disabled by default. | |
| 59 | +| `UseHelm3Defaults` | `false` | Restores Helm v3 defaults. When enabled, uses client-side apply for installation, Helm's legacy readiness logic, and the `nohooks` post-render strategy instead of the Helm v4 defaults (server-side apply, kstatus-based health checking, and `combined` post-render strategy). | |
0 commit comments