# helm plugin: Usage, Options & Common CI Errors

> helm plugin installs and manages Helm CLI extensions like helm-diff and helm-secrets. Pinning versions in CI, and the install and command-not-found errors.

Source: https://latchkey.dev/learn/command-reference/helm-plugin-command  
Updated: 2026-06-25

Extend Helm with plugins like diff and secrets.

helm plugin installs, lists, updates, and removes Helm CLI plugins - extensions such as helm-diff (preview upgrades) and helm-secrets (encrypted values). CI pipelines that rely on a plugin must install it on every fresh runner.

## What it does

helm plugin install URL fetches and installs a plugin from a git repo or local path; plugin list shows installed plugins and versions; plugin update / uninstall manage them. Installed plugins add new top-level commands (e.g. helm diff, helm secrets). Plugins live under the Helm data home, which is per-runner in CI.

## Common usage

```Terminal
helm plugin install https://github.com/databus23/helm-diff
helm plugin install https://github.com/jkroepke/helm-secrets --version v4.6.0
helm plugin list
helm diff upgrade web ./charts/web -f values.prod.yaml
```

## Common errors in CI

"Error: unknown command \"diff\" for \"helm\"" means the plugin is not installed on this runner - fresh CI runners have no plugins, so install them in a setup step (and pin --version for reproducibility). "plugin already exists" on re-run means a cached Helm home already has it; guard with helm plugin list or uninstall-then-install. Plugin installs hit the network (git clone), so they fail in air-gapped CI unless vendored; and an unpinned plugin can change behaviour build-to-build, so always pin the version.

## Using this in CI

A runner has no kubeconfig, no cached context, and no interactive auth. Every kubectl invocation in CI needs the context supplied explicitly, and most confusing CI failures here are the command running against the wrong cluster or no cluster at all.

```Terminal
# never rely on the ambient context on a runner
kubectl --context "$KUBE_CONTEXT" -n "$NAMESPACE" get pods

# confirm what you are actually connected to before mutating anything
kubectl config current-context
kubectl cluster-info

# fail fast instead of hanging on an unreachable API server
kubectl --request-timeout=30s get nodes
```

> Always set `--request-timeout` in CI. Without it an unreachable API server hangs until the job times out, which turns a thirty-second failure into a twenty-minute one.

## FAQ

### helm plugin: Usage, Options & Common CI Errors?

helm plugin installs, lists, updates, and removes Helm CLI plugins - extensions such as helm-diff (preview upgrades) and helm-secrets (encrypted values). CI pipelines that rely on a plugin must install it on every fresh runner.

### What it does?

helm plugin install URL fetches and installs a plugin from a git repo or local path; plugin list shows installed plugins and versions; plugin update / uninstall manage them. Installed plugins add new top-level commands (e.g. helm diff, helm secrets). Plugins live under the Helm data home, which is per-runner in CI.

### Common errors in CI?

"Error: unknown command \"diff\" for \"helm\"" means the plugin is not installed on this runner - fresh CI runners have no plugins, so install them in a setup step (and pin --version for reproducibility). "plugin already exists" on re-run means a cached Helm home already has it; guard with helm plugin list or uninstall-then-install.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt