Moving Helm release to another Kubernetes Namespace

If you want to cleanup your Helm releases, moving them into more appropriate namespace than the one initially deployed into, you might feel kinda stuck, since Helm CLI does not allow you to move these already deployed release to another namespace. But, it can be accomplished with some manual editing of K8s resources...

Information about Helm v3 release is stored in a secret within a namespace where release is deployed.
These secrets can be carefully updated to "move" release from one namespace to another.

The following moves Helm release, as visible from output of helm ls -n mynamespace command. It does not move any of the K8s resources which are part of the release.

Using Jenkins Helm chart as an example:

reflect on "do I really need to do this?"

get the original secret

kubectl -n default get secret sh.helm.release.v1.jenkins.v1 -o yaml | neat > jenkins_release_orig.yaml

decode the secret's data.release (it's double-base64 encoded, and gzipped)

oq -i yaml -r '.data.release' jenkins_release_orig.yaml  | base64 -D | base64 -D | gzip -d > jenkins_release_secret_decoded.txt

change the namespace of the release, and save the changes into the new file

NEW_VALUE=$(cat jenkins_release_data_decoded.txt | jq -c '.namespace="jenkins"' | gzip -c | base64 | base64)
oq -i yaml -o yaml --arg new "$NEW_VALUE" '.data.release = $new' jenkins_release_orig.yaml > jenkins_release_moved.yaml

verify and apply

oq -i yaml -r '.data.release' jenkins_release_moved.yaml | base64 -D | base64 -D | gzip -d | jq .namespace
kubectl -n jenkins apply -f jenkins_release_moved.yaml
helm -n default ls
helm -n jenkins ls

remove old release record (secret) in original namespace

kubectl -n default delete secret sh.helm.release.v1.jenkins.v1

rinse and repeat for other versions / deployments of the release

Moving resources to another namespace can be achieved grabbing K8s manifests, modifying them with desired metadata.namespace and redeploying them. It helps to be extra careful with PVs, to avoid loosing them. Whenever possible, consider deleting Helm release, and redeploying it in the new namespace to save yourself a headache.

Menu