Helm's CRD Management Gap: Why GitOps is Becoming Essential for Kubernetes Operators

A recent update to ScyllaDB's documentation on installing their ScyllaDB Operator via Helm explicitly highlights a long-standing and critical limitation of the Helm package manager: its inability to effectively manage CustomResourceDefinition (CRD) resources. The documentation states that Helm only creates CRDs on the first install and never updates them, necessitating manual updates for CRDs with every Operator upgrade. This technical detail, while not a new Helm feature or bug, underscores a significant operational challenge for anyone deploying Kubernetes Operators or other CRD-dependent applications. This limitation matters profoundly for practitioners because it introduces a seam in the otherwise smooth automation promised by Helm charts. While Helm simplifies the deployment of applications, its deficiency in handling CRD lifecycle management means that a fully automated, declarative state for Kubernetes Operators is unattainable through Helm alone. This forces DevOps teams to either manually intervene during upgrades, increasing the risk of errors and inconsistencies, or to adopt supplementary tooling and processes specifically for CRD management. For environments relying heavily on Kubernetes Operators for stateful applications or complex infrastructure, this gap can lead to significant operational overhead and reduced reliability during critical upgrade cycles. This issue resonates deeply with the broader trend towards GitOps principles in Kubernetes. The core tenet of GitOps is to use Git as the single source of truth for declarative infrastructure and applications, with automated processes ensuring the cluster state converges with the repository. Helm's CRD limitation is precisely the kind of challenge that GitOps aims to solve. Tools like Argo CD or Flux CD, when used in a GitOps workflow, can manage the entire lifecycle of Kubernetes resources, including CRDs, by continuously reconciling the cluster state against a Git repository. This provides a more consistent and auditable approach to managing all aspects of a Kubernetes deployment, including the often-tricky updates to CRDs that accompany Operator version bumps. In practice, this means that while Helm remains an invaluable tool for packaging and deploying applications, practitioners should critically evaluate their strategy for managing CRDs, especially in environments utilizing Kubernetes Operators. Relying solely on Helm for Operator deployments will inevitably lead to manual steps or brittle automation for CRD updates. The concrete implication is a strong recommendation to decouple CRD management from Helm chart deployments. Teams should consider leveraging GitOps tools to manage CRDs declaratively from a Git repository, ensuring that CRD updates are version-controlled, auditable, and automatically applied. This approach not only addresses Helm's inherent limitation but also aligns with best practices for maintaining robust, self-healing, and fully automated Kubernetes infrastructure.