Pro · Lesson 10 of 12

Helm and Kustomize

Helm packages charts. Kustomize patches plain manifests. kubectl includes a Kustomize build. That copy can be older than the standalone kustomize binary.

Picture it this way

Helm is a boxed kit with a parts list and a few knobs. Kustomize is a stack of transparent sheets you lay over the same drawing: one sheet for the lab, one sheet for production.

Helm 3

Helm 3 has no Tiller. A release is a chart plus values, stored as Secrets or another driver in the cluster. helm install, helm upgrade, and helm uninstall are the everyday verbs. helm template renders without installing, which is the right first step when you do not trust a chart.

A chart you did not read can create ClusterRoles, LoadBalancers, and CRDs. Read helm show values and the templates before you point it at a shared cluster. Pin the chart version. A floating tag will change under you.

Kustomize overlays

A kustomization lists resources and patches. Overlays for dev and prod change names, replica counts, and image tags without copying the whole Deployment. kubectl apply -k builds with the Kustomize library compiled into that kubectl.

The standalone kustomize release can be newer than the one inside kubectl. If a feature works in one and not the other, that gap is the reason. kustomize version is the standalone binary. Do not assume kubectl version prints the same Kustomize version on every release.

Tool	You commit	It is weak at
Helm	A chart version and a values file	Understanding a chart you did not read
Kustomize	Base manifests and small patches	Packaging someone else's app with dependencies
Plain YAML	Exactly what you apply	Repeating the same edit across ten environments

Same app, two packagings

Chart
Values
Release

Step 1 of 3The chart is the template. Values fill it in. The release is what the cluster remembers.

Lab: render a Kustomize overlay without a cluster change

Build the YAML and read it. Apply only if the context is still your lab cluster.

mkdir -p lab/base lab/overlays/dev
cat > lab/base/deploy.yaml <<'EOF'
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello
spec:
  replicas: 1
  selector:
    matchLabels: {app: hello}
  template:
    metadata:
      labels: {app: hello}
    spec:
      containers:
      - name: web
        image: nginx:1.27
EOF
cat > lab/base/kustomization.yaml <<'EOF'
resources: [deploy.yaml]
EOF
kubectl kustomize lab/base

Concept summary

Helm 3 installs charts. There is no Tiller to secure.
Kustomize patches manifests. kubectl's copy and the standalone binary can differ.
Render first. Apply second.

Knowledge check

What happened to Tiller?

Why might `kubectl apply -k` reject a feature that standalone kustomize accepts?

What should you do before installing a public chart into a shared cluster?

Official sources

Checked against the linked documentation in October 2026. A later release can move a flag, a price, or a supported pair. Use the page for the version you installed.