Why Are Helmfile Secrets Not Created in the Namespace During Deployment?

Below is an explanation of what’s likely happening and a couple of approaches to resolve it.

Why Aren’t the Secrets Created?

Helmfile’s “secrets:” field is used to decrypt files so that their contents can be passed as values into charts. It does not automatically apply Kubernetes resource manifests (like a Secret manifest) unless they are part of a chart release. In your setup, you’re providing a decrypted secret file (with kind: Secret) for your credentials, but unless you have a release that “owns” that manifest, Helmfile won’t create it in your cluster. This is why PostgreSQL and Redis complain—they expect an existing secret resource to be present.

How to Ensure Secrets Are Available Before Dependent Charts

You have a couple of viable options:

1. Create a Separate Release for the Secret

Include the secret manifest as part of a dedicated Helm release (for example, in a chart that only creates Kubernetes Secrets). This way, when you run “helmfile sync,” Helmfile will install the secret resource, which can then be referenced by your PostgreSQL and Redis charts.

Example (pseudo‑chart release for a Secret):

YAMLCopied
releases:
  - name: credentials-secret
    namespace: your-namespace
    chart: ./charts/secret-chart
    values:
      - environments/base/secrets.yaml
      - environments/{{ .Environment.Name }}/secrets.yaml

Make sure that your secret chart renders the provided secret manifest.

2. Use Hooks to Pre-Apply the Secret Manifest

If you want to keep the secret manifest outside of a Helm chart, you can leverage Helmfile hooks to run a command (such as “kubectl apply”) before your dependent releases are deployed. For example:

YAMLCopied
releases:
  - name: ensure-secrets
    hooks:
      - events: ["prepare"]
        command: "kubectl"
        args: ["apply", "-f", "environments/base/secrets.yaml"]
  - name: my-primary-chart
    namespace: your-namespace
    values:
      - environments/base/values.yaml
      - environments/{{ .Environment.Name }}/values.yaml
  - name: postgresql
    namespace: your-namespace
    chart: bitnami/postgresql
    values:
      - environments/base/values.yaml
      - environments/{{ .Environment.Name }}/values.yaml

This hook runs in the “prepare” event, applying the secret manifest before installing your other releases. Adjust the hooks as needed to ensure the secrets are available when the dependent charts deploy.

Debugging Tips

• Confirm Decryption: Run “helm secrets decrypt environments/base/secrets.yaml” separately to ensure the decrypted manifest is correct.
• Namespace Check: Verify that you’re applying the secret in the correct namespace. Mismatches in the namespace between the secret and the charts referencing it can cause the “not found” issue.
• Order of Deployment: Ensure that the secret release or hook runs before the charts that depend on the secret.
• Review Helmfile Logs: Add the “--log-level=debug” flag to helmfile to get more insights on the ordering and processing of files.

By making sure the decrypted Secret manifest is applied as a resource in your cluster (either through its own release or via pre-deploy hooks), your dependent charts like PostgreSQL and Redis should be able to find the expected credentials.

I hope this helps you resolve the issue!