Managing Chart Dependencies with Chart.lock

Utilize the Chart.lock file to pin specific versions of sub-charts and ensure reproducible builds across your CI/CD pipelines.

In this lesson, you will learn how to use the Chart.lock file to freeze sub-chart versions, ensuring that your Kubernetes deployments remain identical and reproducible every time you run your CI/CD pipeline.

Why Version Ranges Aren't Enough

When you define dependencies in your Chart.yaml file, you often use semantic versioning ranges (e.g., version: ^1.2.0). This is convenient for development because it allows you to automatically pull the latest patch or minor release. However, this non-deterministic behavior is dangerous for production environments. If a maintainer releases a buggy update or introduces a breaking change, your next helm dependency update could pull in that broken version, causing your deployment to fail silently.

The Role of Chart.lock

The Chart.lock file is a generated manifest that acts as a "source of truth" for your dependencies. Whenever you run helm dependency update, Helm checks your Chart.yaml requirements, resolves the latest versions that satisfy your ranges, downloads those specific charts into your charts/ folder, and creates a Chart.lock file that records the exact version and a cryptographic hash (integrity check) of those sub-charts.

Consider this Chart.lock entry:

dependencies:
- name: postgresql
  repository: https://charts.bitnami.com/bitnami
  version: 12.1.1
  digest: sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Ensuring Reproducible Builds

By committing your Chart.lock file to version control, you ensure that every environment—from your local machine to the production CI/CD server—uses the exact same dependency bytes. When your CI/CD pipeline executes helm dependency build (which is faster and safer than update), Helm will look for the Chart.lock file and install the specific versions defined there rather than trying to resolve new versions from the repository. This guarantees that your environment is immutable and immune to upstream changes in external repositories.

Key Takeaway: Always commit your Chart.lock file to version control to pin your sub-chart versions and guarantee consistency across your entire delivery pipeline.