Environment

Small cluster with 2 helm charts deployed:

• ingress-nginx
• traefik

helm v3.7.0 is used.

Also yq was installed to work with output in yaml in the similar way jq works with json.

Rollback logic

If no revision is set, rollback will be performed on previous revision. If rollback is run again without revision, previous one again will be used.

$ helm history traefik
REVISION        UPDATED                         STATUS          CHART           APP VERSION     DESCRIPTION     
1               Tue Oct 12 11:28:22 2021        superseded      traefik-10.3.5  2.5.3           Install complete
2               Tue Oct 12 11:42:47 2021        superseded      traefik-10.3.6  2.5.3           Upgrade complete
3               Tue Oct 12 11:44:32 2021        superseded      traefik-10.3.2  2.5.1           Upgrade complete
4               Tue Oct 12 12:03:26 2021        superseded      traefik-10.3.6  2.5.3           Rollback to 2   
5               Tue Oct 12 13:26:02 2021        deployed        traefik-10.3.2  2.5.1           Rollback to 3
6               Tue Oct 12 13:26:53 2021        deployed        traefik-10.3.6  2.5.3           Rollback to 4

So to figure out details of the rolled back revision, we can use current revision.

The same way it can be used to find details from other revisions, flag --revision XX will be used, for example

$ helm get manifest traefik --revision 3

Answer

After some research I found at least 3 options where this information can be retrieved:

1. From manifest which was applied (most precise approach):

   $ helm get manifest ingress-nginx -n ingress-nginx | yq eval '.spec.template.spec.containers[].image' - | grep -oE '[v]?[0-9]\.[0-9]\.[0-9]'
   v1.0.0
   
   $ helm get manifest traefik | yq eval '.spec.template.spec.containers[].image' - | grep -oE '[v]?[0-9]\.[0-9]\.[0-9]'
   2.5.3

   Using yq in this example, because helm manifest provides output only in yaml:

   $ helm get manifest --help

   This command fetches the generated manifest for a given release.

   A manifest is a YAML-encoded representation of the Kubernetes resources that were generated from this release's chart(s). If a chart is dependent on other charts, those resources will also be included in the manifest.

2. From values (not always works, depends on a chart and/or if image details are located in values.yaml or were set using --set flag):

   $ helm get values ingress-nginx --all -n ingress-nginx -o json | jq '.controller.image.tag' "v1.0.0"

   $ helm get values traefik --all -o json | jq '.controller.image.tag' null

3. From kubernetes secrets (most difficult):

   All revisions are stored as secrets in the same namespace where chart is deployed, for instance:

   $ kubectl get secrets
   NAME                            TYPE                                  DATA   AGE
   sh.helm.release.v1.traefik.v1   helm.sh/release.v1                    1      134m
   sh.helm.release.v1.traefik.v2   helm.sh/release.v1                    1      119m
   sh.helm.release.v1.traefik.v3   helm.sh/release.v1                    1      118m
   sh.helm.release.v1.traefik.v4   helm.sh/release.v1                    1      99m
   sh.helm.release.v1.traefik.v5   helm.sh/release.v1                    1      16m
   sh.helm.release.v1.traefik.v6   helm.sh/release.v1                    1      15m

   The way the data is stored in these secrets is even more complicated, however image tag can be retrieved from it as well. Provided link contains details on how to extract data from these secrets.

   Here's a quote of command to decode one of the secrets:

   kubectl get secrets sh.helm.release.v1.wordpress.v1 -o json | jq .data.release | tr -d '"' | base64 -d | base64 -d | gzip -d

Useful links:

• helm get manifest

• helm get values