No. Helm installs CRDs from a chart's crds directory on first install, but it does not upgrade or delete them. The Helm docs say there is no support at this time for upgrading or deleting CRDs using Helm. Upgrade CRDs yourself, or move them into a separate chart with its own lifecycle.
Why Helm behaves this way
A CustomResourceDefinition adds a new API to the cluster, and deleting one removes every object of that type. The Helm best practices page cites the risk of unintentional data loss as the reason Helm leaves CRD upgrades and deletes alone. That is a safety choice, but it surprises people who expect a chart upgrade to bring everything forward.
What Helm does with the crds directory
| Action | Behavior |
|---|---|
| helm install | Installs CRDs from crds, untemplated, by default |
| CRD already exists | Skipped, with a warning |
| helm install --skip-crds | Skips CRD installation entirely |
| helm upgrade | Does not change existing CRDs |
| helm uninstall | Does not delete CRDs |
| --dry-run | Cannot register CRDs, so custom resource validation may fail |
Why this matters for supply chain risk
A new chart version can ship a CRD with new fields, a new served version or a changed schema. If the cluster still has the old CRD, the new controller may run against an API shape it was not built for. Stale CRDs are also a place where a known issue in an older schema can linger after the operator itself is updated.
Two ways to manage CRDs
- Keep CRDs in the crds directory. Simple, and fine for a first install. You apply updates by hand, for example with
kubectl applyon the new CRD files from the chart you reviewed. - Put CRDs in their own chart. The Helm docs note this suits cluster operators with admin access, because the CRD chart can be managed on its own lifecycle. The cost is that you manage the install order yourself.
Either way, diff the CRDs between chart versions before you apply them, and keep the CRD step under change control since it affects the whole cluster, not one namespace.
Practical checklist for a chart upgrade
- Pull the new chart and compare its crds files against what is live.
- Apply CRD changes first, in a window where the controller can be restarted if needed.
- Then run helm upgrade for the workload.
- Never remove a CRD as cleanup without first exporting the custom resources it holds.
For the deletion side, see what happens to custom resources when you delete a CRD.
Quick check
Can I make Helm upgrade CRDs by putting them in templates?
You can, but the Helm docs explain that CRDs are kept untemplated in the crds directory so Helm can work from accurate cluster state. Check the trade offs in the Helm docs before choosing that route.
Does helm install fail if the CRD already exists?
No. Helm skips it and prints a warning.
Safeguard policies and gates enforce rules in the pull request and pipeline, and a free scan is at https://gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
