Helm get values: How to Fetch Config Values

This page explains how to use helm get values, a Helm command that prints the values that were used to generate a release. You run it against a deployed release name, and it returns the resolved values in YAML, which is useful for debugging, auditing, or reusing configuration. The command has several flags that control whether you see the full merged values, only user-supplied ones, or a specific sub-section.

What the Command Actually Does

Helm stores release metadata as a Secret in the namespace where the release was installed. The get values command reads that Secret, decodes the base64-encoded data, and extracts the values field. It does not contact the chart repository or re-render the template. This means the output is exactly what was used at install time, not what the chart would produce today if you ran helm template with the same values. If you upgraded the release later, the values reflect the latest upgrade unless you specify --revision.

When to Use It (and When Not)

Use helm get values when you need to:

• Debug why a pod has a certain environment variable or resource limit – the values explain it.
• Audit what configuration was applied to a production release.
• Create a backup of a release’s values before making changes.
• Reuse values for a new release in a different namespace or cluster.

Do not use it to see the final rendered manifests (that’s helm get manifest). Do not use it to see computed values that are not stored – for example, if a chart uses randAlphaNum to generate a password, that generated value is stored in the release, but if it’s not a value, it won’t appear here. Also, the command only works for releases managed by Helm v3; for v2 you’d use helm get values too, but the storage backend differs (ConfigMaps in Tiller’s namespace).

Common Mistakes and Pitfalls

One frequent mistake is expecting helm get values to show all values by default. It doesn’t – it shows only the user-supplied ones. If you run it and see an empty output or {}, that means you didn’t set any custom values during install; the chart defaults are not shown unless you add --all.

Another pitfall is using the output as a values.yaml file for a new install without checking for chart-specific fields. The output may contain keys that the chart no longer uses, or it may miss new defaults that were added in a chart upgrade. Always run helm show values CHART to see current defaults.

Also note that --revision requires the revision number to exist. If you specify a revision that was rolled back or deleted, you’ll get an error. To list revisions, use helm history RELEASE_NAME.

Comparing with Related Commands

Helm provides several similar commands, and it’s easy to confuse them:

• helm get manifest – prints the rendered Kubernetes YAML (Deployments, Services, etc.).
• helm get notes – prints the post-install notes from the chart.
• helm get hooks – lists the hook resources.
• helm get all – combines values, manifest, notes, and hooks.

The key difference is that get values is about configuration input, while get manifest is about the final output. If you change a value and re-run helm template, the manifest will change, but the stored release values won’t until you upgrade.

Using the Output in Scripts and Pipelines

Because the output is YAML, you can parse it with tools like yq or jq (after converting). For example, to extract a single value:

helm get values myapp --all | yq '.replicaCount'

To save the values to a file for a new release:

helm get values myapp --all > backup-values.yaml
helm install myapp2 mychart -f backup-values.yaml

You can also use --output json to get JSON instead of YAML, which is easier to parse in CI/CD scripts. However, note that JSON output is only available in Helm 3.10+; earlier versions only output YAML.

Security and Access Considerations

The release Secret is stored in the namespace where the release was installed, and it is readable by anyone with get permission on secrets in that namespace. This means helm get values can expose sensitive data like passwords or API keys that were set as values. Always ensure RBAC restricts secret access to only those who need it. If you use a secrets management tool (like Sealed Secrets or External Secrets), the actual secret values may not be in the Helm values at all – they may be references to external resources. In that case, helm get values will show the reference, not the secret itself, which is a good security practice.

Frequently Asked Questions

Q: Why does helm get values show nothing?
A: If you see empty output or {}, it means no custom values were set during install. The chart’s defaults are not shown unless you add --all. Also check that you’re using the correct release name and namespace (use --namespace if the release is not in the current namespace).

Q: Can I see values from a previous revision?
A: Yes, use helm get values RELEASE_NAME --revision N. You can find revision numbers with helm history RELEASE_NAME. Note that if a revision was superseded, it still exists; if it was uninstalled, it’s gone.

Q: How do I get only a specific value, like image.tag?
A: The command doesn’t have a built-in filter, but you can pipe the output to a YAML parser. For example: helm get values myapp --all | yq '.image.tag'. Alternatively, use --output json and jq '.image.tag'.

Q: Does helm get values work for Helm v2 releases?
A: Yes, but only if you have the Helm v2 client and the release was installed with v2. The storage is different (ConfigMaps in Tiller’s namespace), but the command syntax is the same. If you’re using Helm v3, it cannot read v2 releases unless you migrate them.

Q: What is the difference between --all and no flag?
A: Without a flag, the command shows only the values you supplied via --set, --values, or --set-file during install/upgrade. With --all, it shows the complete merged values: chart defaults + your overrides + any computed values (like generated passwords). The --all output is what the chart actually used for rendering.

Q: Can I use the output as a values file for another install?
A: Yes, you can redirect it to a file and use it with -f. However, be aware that the output may contain fields that are specific to the release (like releaseName or releaseNamespace) that could cause issues if reused. It’s safer to use helm show values for a clean template and then apply your overrides.

Related

• Obsidian Plugin Deletes Work: Fixes & Data Recovery
• Insightful Strike in Where Winds Meet: Location & Best Uses
• Epic Systems Pauses Product Development for Cybersecurity