helm-secrets is a Helm plugin that decrypts encrypted Helm value files on the fly, built for teams that keep Kubernetes secrets in Git or a cloud-native secret manager and deploy charts with Helm or a GitOps operator such as ArgoCD.

What it is

helm-secrets lives in the Helm ecosystem as a plugin, written in Shell and licensed under Apache-2.0. It sits between Helm and the encrypted material a chart needs at render time, so a release can consume secret values without anyone committing plaintext. The plugin decrypts encrypted Helm value files on the fly, either by wrapping the whole helm command or by handling a secrets:// protocol reference inside a normal helm invocation. Encryption itself is delegated to sops, and reference resolution to vals.

The concrete problem it solves is the gap between "secrets must not be in Git in plaintext" and "Helm needs those values as files when it renders a chart." Rather than replacing Helm or building a bespoke secret store, helm-secrets replaces the manual step of decrypting a values file to disk, running Helm, and remembering to clean up. Encrypted value files stay in the repository and are decrypted only for the duration of the command. For teams that prefer not to keep ciphertext at all, the same plugin injects values from cloud-native secret managers such as AWS Secrets Manager, Azure KeyVault, or HashiCorp Vault into value files or templates.

Key capabilities

• Decrypts value files through a protocol handler, so a standard Helm command works unchanged: helm upgrade name . -f secrets://secrets.yaml. The README states this mode is preferred over the plugin command and is the one used in ArgoCD environments.
• Wraps the entire helm command through the plugin form: helm secrets upgrade name . -f secrets.yaml. The README notes this mode is slow on multiple value files.
• Uses sops to encrypt value files and store them in Git, keeping ciphertext alongside the chart.
• Backs secrets with cloud-native stores — AWS Secrets Manager, Azure KeyVault, HashiCorp Vault — and injects them into value files or templates.
• Evaluates vals expressions inside Helm templates with the --evaluate-templates flag, which requires Helm 3.9+ and vals 0.20+, for example ref+awsssm://foo/bar?mode=singleparam#/BAR.
• Selects a backend explicitly with --backend vals, as in helm secrets --backend vals template bitnami/mysql --name-template mysql --set auth.rootPassword=ref+awsssm://foo/bar?mode=singleparam#/BAR.
• Supports ArgoCD value file schemes including secrets+gpg-import:///helm-secrets-private-keys/key.asc?secrets.yaml and secrets+gpg-import-kubernetes://argocd/helm-secrets-private-keys#key.asc?secrets.yaml, with fileParameters (--set-file) supported as well.

Who uses it and how

• ArgoCD users, where the secrets:// protocol handler is the documented integration path and GPG keys can be imported from a file path or from a Kubernetes Secret.
• Teams that store encrypted values in Git with sops, using GPG or KMS-backed keys, and want Helm to decrypt at deploy time instead of at commit time.
• Organizations deploying charts into Kubernetes that pull credentials from AWS Secrets Manager, Azure KeyVault, or HashiCorp Vault rather than from committed files.
• Projects and companies that have added themselves to the repository's USERS.md file, which the README invites users to update by pull request.
• Deployment pipelines templating third-party charts, as shown with bitnami/mysql and a cloud secret reference passed through --set.

Getting started

Installation instructions live on the project's GitHub wiki Installation page, and installation is followed by either the plugin command helm secrets upgrade name . -f secrets.yaml or the protocol handler helm upgrade name . -f secrets://secrets.yaml. There is no hosted service; helm-secrets runs as a Helm plugin in the environment where Helm runs, which is what makes it usable inside ArgoCD.

How it compares

The facts do not list paid products that helm-secrets replaces. Among the tools it names, helm-secrets sits on top of sops for encryption and vals for reference resolution rather than competing with either; sops and vals do the cryptographic and reference work, and helm-secrets is the Helm-shaped interface to them. It also overlaps with cloud secret managers such as AWS Secrets Manager, Azure KeyVault, and HashiCorp Vault, but as a consumer of those services inside Helm value files and templates, not as a replacement.

When to use it — and when not to

Choose helm-secrets when Helm or a GitOps operator such as ArgoCD is already the deployment path and encrypted value files or cloud secret references need to reach a chart without plaintext landing in Git. Be aware that the wrapping helm secrets command is documented as slow on multiple value files, and that the README is deliberately thin — installation and usage detail lives on the wiki, so self-hosters must read there rather than in the repository. Anyone not deploying with Helm should look elsewhere, and operators still own the pieces helm-secrets depends on: sops or vals availability, GPG or KMS keys, and credentials for whichever cloud secret backend is referenced.

helm upgrade name . -f secrets://secrets.yaml

helm secrets upgrade name . -f secrets.yaml

apiVersion: v1
kind: Secret
metadata:
  name: secret
type: Opaque
stringData:
  password: "ref+awsssm://foo/bar?mode=singleparam#/BAR"

helm secrets --evaluate-templates upgrade name .

helm secrets --backend vals template bitnami/mysql --name-template mysql \
  --set auth.rootPassword=ref+awsssm://foo/bar?mode=singleparam#/BAR

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: app
spec:
  source:
    helm:
      valueFiles:
        - secrets+gpg-import:///helm-secrets-private-keys/key.asc?secrets.yaml
        - secrets+gpg-import-kubernetes://argocd/helm-secrets-private-keys#key.asc?secrets.yaml
        - secrets://secrets.yaml
      # fileParameters (--set-file) are supported, too. 
      fileParameters:
        - name: config
          path: secrets://secrets.yaml
        # directly reference values from Cloud Providers
        - name: mysql.rootPassword
          path: secrets+literal://ref+azurekeyvault://my-vault/secret-a

data "external" "helm-secrets" {
  program = ["helm", "secrets", "decrypt", "--terraform", "../../examples/sops/secrets.yaml"]
}

resource "helm_release" "example" {
  

  values = [
    file("../../examples/sops/values.yaml"),
    base64decode(data.external.helm-secrets.result.content_base64),
  ]
}

      </a>

  </td>
</tr>