The Complete Production SOP: How to Deploy and Run helm-diff Plugin & Safe Upgrade Previews in Autonomous AI Agents

---
name: "helm-dry-run-helm-diff"
description: "Preview exact manifest changes and drift before applying Helm chart upgrades to production."
metadata:
  author: "databus23"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "run helm diff upgrade"
  - "preview helm changes dry-run"
  - "detect helm configuration drift"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: true
  net_access: true
---

# helm-diff Plugin & Safe Upgrade Previews

## SOP & Rules
1. Ensure helm-diff plugin is installed: `helm plugin list | grep -q diff || helm plugin install https://github.com/databus23/helm-diff`
2. Execute preview diff: `helm diff upgrade <release-name> <chart-path> -f <values-file> --detailed-exitcode`
3. Evaluate exit codes: 0 = No changes, 2 = Changes detected (require audit), 1 = Fatal template/connection error.
4. Prohibit invoking `helm upgrade` without explicit diff output review and human approval.

#!/usr/bin/env bash
set -euo pipefail

if ! helm plugin list | grep -q 'diff'; then
  echo "Installing databus23/helm-diff plugin..."
  helm plugin install https://github.com/databus23/helm-diff
fi

helm diff --help > /dev/null
echo "helm-diff plugin is functional and ready for agent invocations."

Claude Code CLI invocation:
claude "Run helm diff upgrade on release payments-service using ./charts/payments with values.prod.yaml and detect helm configuration drift"

#!/usr/bin/env bash
RELEASE_NAME=$1
CHART_PATH=$2
VALUES_FILE=$3

set +e
helm diff upgrade "${RELEASE_NAME}" "${CHART_PATH}" -f "${VALUES_FILE}" --detailed-exitcode
DIFF_STATUS=$?
set -e

case $DIFF_STATUS in
  0)
    echo "[PASS] No drift or manifest modifications detected. Release matches desired state."
    ;;
  2)
    echo "[WARN] Infrastructure modifications detected! Review output above."
    ;;
  *)
    echo "[FAIL] Unexpected diff error or connection failure (exit code: $DIFF_STATUS)."
    exit 1
    ;;
esac