what's the meaning of the empty value {} kubernetes helm chart yaml file?

xjfromsh 0
Viewed 30

What's the meaning of the empty value {} in a Helm chart YAML file?

In some Helm charts I see some values.yaml or override_values.yaml files, there are empty values {} in them. For example

containerSecurityContext: {}
podSecurityContext: {}

What is the purpose of those {} values in the YAML file? Does it mean to use default value or parent folder YAML file value or something else?

kubernetes-helm
2 Answers

you can think of those {} as empty placeholders. When you create a raw helm chart with helm create <chart-name>, of the many default files, Helm will create a values.yaml file with bare common variables. If you choose to specify these values such as containerSecurityContext or podSecurityContext, you would remove the {} and fill in your desired state. For example:

podSecurityContext: 
  fsGroup: 1000

securityContext: 
  runAsNonRoot: true
  runAsUser: 1000

So the main take-away is that if you choose to specify these values, removing {} tells Helm there is a value stored for it, else existence of {} tells Helm there is no specified state.

JasonY0

It's YAML syntax for an empty mapping, similar to what {} would mean in JSON or JavaScript or other languages. It doesn't imply any sort of inheritance, but it can mean to use Kubernetes's defaults for various things.

As with anything in Helm, the values.yaml file is configuration that gets read by the chart templates, so it matters how it gets used.

An empty mapping is "false", so you might use this in a chart to conditionally emit a block if any values are set:

{{- with .Values.containerSecurityContext }}
securityContext: {{- . | toYaml | nindent 2 }}
{{- end }}

There isn't any "inheritance" per se between charts, but if a value is unset often Kubernetes has defaults that can be used. To pick an arbitrary example from the pod security context, fsGroupChangePolicy has a default value at the Kubernetes level, so

# values_1.yaml
podSecurityContext:
  fsGroupChangePolicy: OnRootMismatch # overrides Kubernetes's default

# values_2.yaml
podSecurityContext: {}
# fsGroupChangePolicy has a Kubernetes default of "Always"

The chart's values.yaml file and any additional helm install -f files are merged, so if an override file contains an empty mapping {} the contents of the chart's values.yaml file at that point are used unmodified (I don't believe there's a way to delete an individual field set at the chart level).

David Maze0
Related