Third-Party Charts: Artifact Hub First

Field	Value
Type	Skill Resource
Source	~/.copilot/skills/platform/references/helm/third-party-charts.md
Description	Not specified

Source Content

Third-Party Charts: Artifact Hub First

Never configure a chart you have not looked up. The values surface, the default values, the current version, and the CRD opt-out key all live on the chart’s Artifact Hub page. Guessing a values key wastes a deploy cycle and risks a silently ignored setting.

Contents

• The lookup workflow
• Reading the values schema
• Pinning and adding the repo
• Common charts and their CRD opt-out

The lookup workflow

1. Search artifacthub.io for the chart. Prefer the official publisher (verified-publisher badge) over a mirror.
2. Open the package page. Read the current version, the repo URL (the “Install” panel), and the default values.
3. Open the values-schema modal to inspect keys precisely: artifacthub.io/packages/helm/<repo>/<chart>?modal=values-schema. It shows YAML on the left and the JSON-schema type/description on the right, with autocomplete search.
4. Confirm the CRD opt-out key for any chart that ships CRDs (see the table below).
5. Only then write the values file, using the real keys.

When fetching the page programmatically, ask for: latest version, the helm repo add URL or OCI path, and the top-level values keys.

Reading the values schema

Helm v3 charts may ship a values.schema.json alongside values.yaml; Artifact Hub renders it as the Values Schema Reference. If a chart provides no schema, fall back to the raw values.yaml shown on the page’s “Default values” tab. Either way, copy the exact key path — controller.replicaCount, not a remembered guess.

Pinning and adding the repo

# Classic chart repo
helm repo add <name> <repo-url>
helm repo update
helm search repo <name>/<chart> --versions   # pick an exact version

# Pin it in Chart.yaml dependencies:
#   dependencies:
#     - name: <chart>
#       version: 1.16.2        # exact — never "latest" or "^1.16"
#       repository: <repo-url>

# OCI registry charts (no repo add needed)
helm pull oci://<registry>/<chart> --version 5.0.1

Pin the exact version everywhere: Chart.yaml dependency, helm pull --version, and the ArgoCD targetRevision.

Common charts and their CRD opt-out

Confirm each on Artifact Hub before relying on it — keys change between major chart versions. CRDs are applied by the kubectl task first (see crd-ordering.md).

Chart	Ships CRDs	Opt-out key
cert-manager	yes	installCRDs: false (newer: crds.enabled: false)
kube-prometheus-stack	yes	crds.enabled: false
external-secrets	yes	installCRDs: false
CloudNativePG (cnpg)	yes	apply operator CRDs via kubectl; chart consumes them
ingress-nginx	no	nothing to disable
Valkey / Redis	no	nothing to disable

For any chart not listed, search its values schema for crd, crds, or installCRDs and set the disabling value, plus --skip-crds as the backstop.