Helm releases · New in v0.3.0

Helm releases, without reading every Secret in the namespace

PodSteer lists your Helm releases without reading a single byte of Secret data: a release is a set of labelled Secrets, and the labels are enough. A release opens on an overview built from those labels; one revision's values, notes and rendered manifest are read only when you open the tab that shows them, and any Secret inside that manifest is masked.

Download PodSteer All features

Why this matters

Helm stores each release as a Secret holding the whole chart, compressed. Reading forty of those to draw a list of forty names is the bulk Secret read that security teams alert on. PodSteer reads the labels Helm writes instead, through the metadata API, and the list never touches the payload.

The list refreshes when you open the page, when you press Refresh and after a change PodSteer made — not on a timer, which would put a Secret listing in your audit log every few seconds.

Reading one revision

  • Values and notes, hidden again after thirty seconds or when the window loses focus.
  • The rendered manifest, with any Secret it contains masked.
  • The upgrade, rollback, history and uninstall commands for your own shell — including the values you need so an upgrade does not reset them.
The Helm release storefront-web open in its panel: deployed at revision 2 in storefront, the chart storefront-web 0.3.0 with app version v3.1.0 and its description, the release Secret it lives in, and its history — revision 2 current, revision 1 superseded. Tabs above for Values, Manifest, Notes and Commands. The Helm release storefront-web open in its panel: deployed at revision 2 in storefront, the chart storefront-web 0.3.0 with app version v3.1.0 and its description, the release Secret it lives in, and its history — revision 2 current, revision 1 superseded. Tabs above for Values, Manifest, Notes and Commands.
One revision, read on request. Listing releases reads no Secret's contents; one revision's chart, values and manifest are read when you open a tab that shows them.

Honest when it cannot look

Listing releases needs permission to list Secrets. An account without it is told it is not permitted — never shown an empty page that reads as "no Helm here".

Be honest

What it does not do.

  • PodSteer does not run helm upgrade, rollback or uninstall. It shows you the exact commands; re-implementing Helm approximately is how production objects get deleted.
  • The release list has no chart or app version columns, because those live only inside the payload it deliberately does not read.

Read next

GitOps: Argo CD and Flux

Typed panels for Argo CD Applications and Flux Kustomizations and HelmReleases, and a warning before any change a controller will undo.

Security and RBAC

Privileges a spec takes, vulnerabilities your scanner already found, and what an account can actually do — answered by the API server.

Day-2 operations

Apply any kind including CRDs, roll back, drain, bulk-act with a review step — and see the kubectl command for each.

Compared with other tools: PodSteer vs Radar · PodSteer vs Lens Desktop