jhelm — Helm on the JVM, and beyond

jhelm is a native Java implementation of the Helm package manager for Kubernetes. It provides an embeddable library, a Spring Boot starter, a REST API, an MCP server, and a standalone CLI to work with Helm charts from the JVM — without shelling out to the Go-based Helm binary. It renders byte-for-byte like helm template, then goes beyond Helm with Spring-native value management — profiles, centralized config, and encrypted secrets.

1. Helm-faithful rendering, in pure Java

jhelm renders chart templates identically to helm template across a continuously-run suite of 540+ real-world charts (Bitnami, Grafana, GitLab, Kubernetes-monitoring, and more) — in pure Java, with no Go or helm binary. Each chart is compared against helm template with default values and a pinned --kube-version v1.35.0; the match is byte-for-byte apart from a small set of documented, non-semantic differences (generated secrets/certs and toYaml key-ordering in checksum/* annotations, see Function coverage). This is template-rendering parity — install/upgrade reuse the same renderer but drive the cluster through the Kubernetes Java client. Parity is enforced in CI on every change, so behaviour tracks upstream Helm closely rather than approximating it. Rendering is driven by the standalone gotmpl4j Go-template engine.

Recognizable charts in the suite that render byte-for-byte include ingress-nginx/ingress-nginx, jetstack/cert-manager, prometheus-community/kube-prometheus-stack, prometheus-community/prometheus, grafana/grafana, grafana/loki, argo/argo-cd, cilium/cilium, traefik/traefik, and the Bitnami redis, postgresql, and mysql charts — alongside 500+ more.

2. Beyond Helm

Parity is the floor, not the ceiling. On top of a Helm-faithful renderer, jhelm adds Spring-native value management that Go Helm has no equivalent for. Each capability is opt-in and inert by default, so charts that don’t use it still render byte-for-byte:

  • Value profiles — Spring-Boot-style profiles select environment-specific values: jhelm template r ./chart -P prod,eu, with document gating (spring.config.activate.on-profile) and values-<profile>.yaml sidecars.

  • Centralized configuration — fetch chart values from a git-backed Spring Cloud Config Server, so one server holds the values for every release, behind auth and TLS.

  • Encrypted values — commit {cipher} ciphertext to git and let jhelm decrypt it at render time; jhelm encrypt / decrypt tokens are byte-compatible with Spring Cloud Config.

Together these are the first steps toward the Spring Boot management platform on the roadmap — centralized config, a web UI, multi-tenancy, and audit/RBAC. See Value Profiles for the full model.

3. MCP-native

The same operations are exposed as Model Context Protocol tools, so an AI agent can render charts, search ArtifactHub, and manage releases directly — no shelling out, no glue code. See MCP Server.

4. Key Features

  • Go template engine — the full Go text/template language with Helm’s Sprig function set and Helm-specific functions (include, tpl, required, lookup, toYaml, …), provided by the standalone gotmpl4j library.

  • Chart lifecycle management — install, upgrade, rollback, uninstall, list, status, history, test

  • Repository & OCI registries — add/remove repos, search, pull, push

  • Dependency management — list, update, build chart dependencies

  • Packaging & provenance — package charts to .tgz, PGP sign and verify

  • Spring Boot auto-configuration — programmatic action API with @ConfigurationProperties

  • REST API — Spring MVC endpoints with OpenAPI/Swagger documentation (pure library plus a jhelm-rest-starter)

  • MCP server — exposes jhelm operations as Model Context Protocol tools for AI agents (built on Spring AI)

  • JSON Schema validation — validates chart values against values.schema.json (Draft-07)

  • Async Kubernetes operations — Java 21 virtual threads via AsyncKubeService

  • Value profiles (beyond Helm) — Spring-Boot-style -P profiles with document gating and values-<profile>.yaml sidecars

  • Centralized & encrypted values (beyond Helm) — fetch values from a Spring Cloud Config Server and decrypt {cipher} secrets at render time

5. Technology Stack

  • Java 21

  • Spring Boot 4.0.7

  • Kubernetes Client 26.0.0

  • gotmpl4j 1.3.0 (Go template + Sprig engine)

  • Picocli 4.7.7 (CLI framework)

6. Quick Links

  • Getting Started — build, run the CLI, or add jhelm as a library

  • Spring Boot Starter — programmatic API with auto-configured beans and code samples

  • REST API — HTTP endpoints and OpenAPI documentation

  • MCP Server — jhelm operations as Model Context Protocol tools for AI agents

  • CLI Reference — all commands, options, and examples

  • Value Profiles — profiles, centralized config, and encrypted values beyond Helm

  • Configuration — jhelm.* properties reference

  • Security — the unified jhelm.security.* model for REST and MCP

  • Architecture — module structure and design

  • Helm Functions — the Helm-specific template function catalogue

  • Roadmap — planned features and compatibility matrix