The bjw-s app-template Chart

Field	Value
Type	Skill Resource
Source	~/.copilot/skills/platform/references/helm/app-template.md
Description	Not specified

Source Content

The bjw-s app-template Chart

For a single service, do not hand-roll a Deployment, Service, and Ingress. The bjw-s app-template chart expresses the standard workload shape declaratively, so a values file replaces three or four template files you would otherwise maintain.

Contents

• When to use it
• When to hand-roll instead
• Install and pin
• Values surface
• CRDs

When to use it

Default to app-template when the workload is the common case:

• A single container (or a sidecar or two) behind a Service.
• A Deployment, Statefulset, DaemonSet, CronJob, or Job controller.
• Standard Ingress, persistence (PVC / emptyDir / hostPath), ConfigMaps, Secrets, and RBAC.

That covers the large majority of internal services. The values file in templates/app-template-values.yaml is a worked example.

When to hand-roll instead

Author a bespoke chart only when app-template genuinely cannot express the workload:

• The app installs or owns CRDs and controllers (an operator) — and even then, CRDs go through kubectl (see crd-ordering.md).
• Non-standard controller kinds or custom resources the template does not model.
• Heavy templating logic that fights the template’s structure rather than fitting it.

If you reach for a hand-rolled chart, state in one line why app-template fell short.

Install and pin

app-template ships as an OCI chart. Pin the exact version.

# Latest as of this writing: 5.0.1 (requires k8s >= 1.31, Helm >= 3.18).
helm pull oci://ghcr.io/bjw-s-labs/helm/app-template --version 5.0.1

# As a Chart.yaml dependency:
#   dependencies:
#     - name: app-template
#       version: 5.0.1
#       repository: oci://ghcr.io/bjw-s-labs/helm

Always confirm the current version on Artifact Hub before pinning — see third-party-charts.md.

Values surface

The top-level keys map directly to Kubernetes resources:

Key	What it produces
controllers	Deployment / StatefulSet / DaemonSet / CronJob, each with containers (image, env, resources, probes)
service	Services, each bound to a controller and exposing named ports
ingress	Ingress objects with className, hosts, and per-path service refs
persistence	PVCs, emptyDir, hostPath, ConfigMap/Secret mounts via globalMounts
configMaps / secrets	ConfigMap and Secret objects (keep real secret values out — see below)
serviceAccount / rbac	ServiceAccount and RBAC objects

Multi-tenant naming (ADR-029) applies to the release name, namespace, and any resource names produced here — follow the <env>.<agency>.<org-unit>.<app> ladder.

CRDs

app-template does not ship CRDs, so there is nothing to disable for the template itself. If the application it deploys needs CRDs, those still install via the kubectl task first (see crd-ordering.md). app-template only creates namespaced resources.