<p>I am using Helm v3.3.0, with a Kubernetes 1.16.</p>
<p>The cluster has the <a href="https://svc-cat.io/docs/" rel="nofollow noreferrer">Kubernetes Service Catalog</a> installed, so external services implementing the Open Service Broker API spec can be instantiated as K8S resources - as <code>ServiceInstance</code>s and <code>ServiceBinding</code>s.</p>
<p><code>ServiceBinding</code>s reflect as K8S <code>Secret</code>s and contain the binding information of the created external service. These secrets are usually mapped into the Docker containers as environment variables or volumes in a K8S <code>Deployment</code>.</p>
<p>Now I am using Helm to deploy my Kubernetes resources, and I read <a href="https://helm.sh/docs/topics/charts/#operational-aspects-of-using-dependencies" rel="nofollow noreferrer">here</a> that...</p>
<blockquote>
<p>The [Helm] install order of Kubernetes types is given by the enumeration InstallOrder in <a href="https://github.com/helm/helm/blob/release-3.3/pkg/releaseutil/kind_sorter.go" rel="nofollow noreferrer">kind_sorter.go</a></p>
</blockquote>
<p>In that file, the order does neither mention <code>ServiceInstance</code> nor <code>ServiceBinding</code> as resources, and that would mean that Helm installs these resource types <strong>after</strong> it has installed any of its InstallOrder list - in particular <code>Deployment</code>s. That seems to match the output of <code>helm install --dry-run --debug</code> run on my chart, where the order indicates that the K8S Service Catalog resources are applied last.</p>
<p><strong>Question:</strong> What I cannot understand is, why my <code>Deployment</code> does <strong>not</strong> fail to install with Helm.
After all my <code>Deployment</code> resource seems to be deployed before the <code>ServiceBinding</code> is. And it is the <code>Secret</code> generated out of the <code>ServiceBinding</code> that my <code>Deployment</code> references. I would expect it to fail, since the <code>Secret</code> is not there yet, when the <code>Deployment</code> is getting installed. But that is not the case.</p>
<p>Is that just a timing glitch / lucky coincidence, or is this something I can rely on, and why?</p>
<p>Thanks!</p>

FloW
<p>As said in the comment I posted:</p>
<blockquote>
<p>In fact your <code>Deployment</code> is failing at the start with <code>Status: CreateContainerConfigError</code>. Your <code>Deployment</code> is created before <code>Secret</code> from the <code>ServiceBinding</code>. It's only working as it was recreated when the <code>Secret</code> from <code>ServiceBinding</code> was available.</p>
</blockquote>
<p>I wanted to give more insight with example of why the <code>Deployment</code> didn't fail.</p>
<p>What is happening (simplified in order):</p>
<ul>
<li><code>Deployment</code> -&gt; created and spawned a <code>Pod</code></li>
<li><code>Pod</code> -&gt; failing pod with status: <code>CreateContainerConfigError</code> by lack of <code>Secret</code></li>
<li><code>ServiceBinding</code> -&gt; created <code>Secret</code> in a background</li>
<li><code>Pod</code> gets the required <code>Secret</code> and starts</li>
</ul>
<p>Previously mentioned <code>InstallOrder</code> will leave <code>ServiceInstace</code> and <code>ServiceBinding</code> as last by comment on <a href="https://github.com/helm/helm/blob/release-3.3/pkg/releaseutil/kind_sorter.go#L147" rel="nofollow noreferrer">line 147</a>.</p>
<hr />
<h2>Example</h2>
<p>Assuming that:</p>
<ul>
<li>There is a working Kubernetes cluster</li>
<li>Helm3 installed and ready to use</li>
</ul>
<p>Following guides:</p>
<ul>
<li><em><a href="https://kubernetes.io/docs/tasks/service-catalog/install-service-catalog-using-helm/" rel="nofollow noreferrer">Kubernetes.io: Instal Service Catalog using Helm</a></em></li>
<li><em><a href="https://www.magalix.com/blog/kubernetes-service-catalog-101" rel="nofollow noreferrer">Magalix.com: Blog: Kubernetes Service Catalog</a></em></li>
</ul>
<p>There is a Helm chart with following files in <code>templates/</code> directory:</p>
<ul>
<li><code>ServiceInstance</code></li>
<li><code>ServiceBinding</code></li>
<li><code>Deployment</code></li>
</ul>
<p>Files:</p>
<p><code>ServiceInstance.yaml</code>:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: servicecatalog.k8s.io/v1beta1
kind: ServiceInstance
metadata:
  name: example-instance
spec:
  clusterServiceClassExternalName: redis
  clusterServicePlanExternalName: 5-0-4
</code></pre>
<p><code>ServiceBinding.yaml</code>:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: servicecatalog.k8s.io/v1beta1
kind: ServiceBinding
metadata:
  name: example-binding
spec:
  instanceRef:
    name: example-instance
</code></pre>
<p><code>Deployment.yaml</code>:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: ubuntu
spec:
  selector:
    matchLabels:
      app: ubuntu
  replicas: 1
  template:
    metadata:
      labels:
        app: ubuntu
    spec:
      containers:
      - name: ubuntu
        image: ubuntu
        command:
        - sleep 
        - &quot;infinity&quot; 
        # part below responsible for getting secret as env variable
        env: 
        - name: DATA
          valueFrom: 
            secretKeyRef:
              name: example-binding
              key: host
</code></pre>
<p>Applying above resources to check what is happening can be done in 2 ways:</p>
<ul>
<li>First method is to use <code>timestamp</code> from <code>$ kubectl get RESOURCE -o yaml</code></li>
<li>Second method is to use <code>$ kubectl get RESOURCE --watch-only=true</code></li>
</ul>
<hr />
<h3>First method</h3>
<p>As said previously the <code>Pod</code> from the <code>Deployment</code> couldn't start as <code>Secret</code> was not available when the <code>Pod</code> tried to spawn. After the <code>Secret</code> was available to use, the <code>Pod</code> started.</p>
<p>The statuses this <code>Pod</code> had were the following:</p>
<ul>
<li><code>Pending</code></li>
<li><code>ContainerCreating</code></li>
<li><code>CreateContainerConfigError</code></li>
<li><code>Running</code></li>
</ul>
<p>This is a table with timestamps of <code>Pod</code> and <code>Secret</code>:</p>
<pre><code>|                  Pod                      |                Secret                     |
|-------------------------------------------|-------------------------------------------|
| creationTimestamp: &quot;2020-08-23T19:54:47Z&quot; |                   -                       |
|                   -                       | creationTimestamp: &quot;2020-08-23T19:54:55Z&quot; |
| startedAt: &quot;2020-08-23T19:55:08Z&quot;         |                   -                       |
</code></pre>
<p>You can get this timestamp by invoking below commands:</p>
<ul>
<li><code>$ kubectl get pod pod_name -n namespace -o yaml</code></li>
<li><code>$ kubectl get secret secret_name -n namespace -o yaml</code></li>
</ul>
<p>You can also get get additional information with:</p>
<ul>
<li><code>$ kubectl get event -n namespace</code></li>
<li><code>$ kubectl describe pod pod_name -n namespace</code></li>
</ul>
<h3>Second method</h3>
<p>This method requires preparation before running Helm chart. Open another terminal window (for this particular case 2) and run:</p>
<ul>
<li><code>$ kubectl get pod -n namespace --watch-only | while read line ; do echo -e &quot;$(gdate +&quot;%H:%M:%S:%N&quot;)\t $line&quot; ; done</code></li>
<li><code>$ kubectl get secret -n namespace --watch-only | while read line ; do echo -e &quot;$(gdate +&quot;%H:%M:%S:%N&quot;)\t $line&quot; ; done</code></li>
</ul>
<p>After that apply your Helm chart.</p>
<blockquote>
<p>Disclaimer!</p>
<p>Above commands will watch for changes in resources and display them with a timestamp from the OS. Please remember that this command is only for example purposes.</p>
</blockquote>
<p>The output for <code>Pod</code>:</p>
<pre><code>21:54:47:534823000   NAME                      READY   STATUS                       RESTARTS    AGE
21:54:47:542107000   ubuntu-65976bb789-l48wz   0/1     Pending                      0           0s
21:54:47:553799000   ubuntu-65976bb789-l48wz   0/1     Pending                      0           0s
21:54:47:655593000   ubuntu-65976bb789-l48wz   0/1     ContainerCreating            0           0s
-&gt; 21:54:52:001347000    ubuntu-65976bb789-l48wz   0/1     CreateContainerConfigError   0           4s
21:55:09:205265000   ubuntu-65976bb789-l48wz   1/1     Running                      0           22s
</code></pre>
<p>The output for <code>Secret</code>:</p>
<pre><code>21:54:47:385714000   NAME                            TYPE                 DATA   AGE
21:54:47:393145000   sh.helm.release.v1.example.v1   helm.sh/release.v1   1      0s
21:54:47:719864000   sh.helm.release.v1.example.v1   helm.sh/release.v1   1      0s
21:54:51:182609000   understood-squid-redis          Opaque               1      0s
21:54:52:001031000   understood-squid-redis          Opaque               1      0s
-&gt; 21:54:55:686461000    example-binding                 Opaque               6      0s
</code></pre>
<hr />
<p>Additional resources:</p>
<ul>
<li><em><a href="https://stackoverflow.com/a/51962615/12257134">Stackoverflow.com: Answer: Helm install in certain order</a></em></li>
<li><em><a href="https://www.alibabacloud.com/blog/helm-charts-and-templates-hooks-and-tests-part-3_595650" rel="nofollow noreferrer">Alibabacloud.com: Helm charts and templates hooks and tests part 3</a></em></li>
</ul>
