WordPress

Deploy WordPress on Kubernetes with the official docker.io/library/wordpress:7.1.3-apache image. The chart keeps the default install useful for development while exposing explicit production controls for database selection, secrets, routing, storage, backup, network policy, metrics, WordPress cron, WP-CLI bootstrap, plugin installation, and object cache.

The chart pins WordPress 7.1.3, a maintenance and security release with seven security fixes and four bug fixes. The addressed issues include stored XSS, denial of service, second-order SQL injection, authorization weaknesses, private comment disclosure, unsafe embeds, and hook action-name collisions. Review the official WordPress 7.1.3 release and upgrade production installations promptly.

Key Features

• Official image alignment - uses the upstream WordPress Apache image, with PHP configuration exposed through values.
• Persistent core upgrades - synchronizes image core files into an existing PVC without replacing site content.
• Database choices - HelmForge MySQL subchart by default, or external MySQL/MariaDB through structured values.
• Secrets paths - generated Kubernetes Secrets, existing Secrets, or optional External Secrets Operator resources.
• Routing - classic Ingress and native Gateway API HTTPRoute.
• Networking - dual-stack Service fields and optional NetworkPolicy ingress/egress rules.
• Production controls - ServiceAccount token mount control, resources, HPA, PDB, deterministic WordPress cron, probes, and scheduling.
• Backups - S3-compatible CronJob that exports both the database and wp-content.
• Bootstrap - optional WP-CLI Job for initial site install, permalinks, locale, and multisite setup.
• Plugins - idempotent installer for official WordPress.org slugs and checksum-verified custom ZIPs.
• Object Cache - Redis provider for the official image, plus guarded Memcached wiring for custom images.
• Extensibility - extra env, envFrom, init containers, sidecars, volumes, mounts, and raw extra manifests.

Architecture

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install wordpress helmforge/wordpress -f values.yaml

OCI registry:

helm install wordpress oci://ghcr.io/helmforgedev/helm/wordpress -f values.yaml

For local access without Ingress or Gateway API:

kubectl port-forward svc/wordpress 8080:80

Development vs Production

Use the default install for local validation, demos, and development. It gives you a working WordPress instance quickly with a bundled MySQL database and persistent WordPress files.

For production, make the choices explicit:

• Use existing Secrets or External Secrets Operator for admin, database, backup, and Redis credentials.
• Set wordpress.siteUrl, wordpress.forceSSLAdmin, wordpress.disallowFileEdit, and wordpress.disableWpCron.
• Enable bootstrap.enabled when Helm should run the initial WP-CLI install.
• Use Gateway API or Ingress with TLS and route-aware NetworkPolicy ingress rules.
• Set CPU and memory requests, limits, PDB, and HPA only after storage is safe for multiple pods.
• Use ReadWriteMany storage or an immutable media/plugin strategy before running multiple replicas.
• Enable the Kubernetes wpCron CronJob when DISABLE_WP_CRON is set.
• Configure wp-cron scheduling independently when batch pods belong on a dedicated node pool.
• Test backup and restore, not only backup creation.

Deployment Examples

# values.yaml - development install with bundled MySQL
wordpress:
  siteTitle: My Blog
  adminUser: admin
  adminPassword: change-me
  adminEmail: [email protected]

mysql:
  enabled: true
  auth:
    password: db-password

persistence:
  enabled: true
  size: 10Gi

php:
  ini: |
    upload_max_filesize = 64M
    post_max_size = 64M
    memory_limit = 256M

# values.yaml - production-oriented baseline
wordpress:
  siteUrl: https://blog.example.com
  siteTitle: My Blog
  adminEmail: [email protected]
  forceSSLAdmin: true
  disallowFileEdit: true
  disableWpCron: true
  memoryLimit: 256M
  maxMemoryLimit: 512M

admin:
  existingSecret: wordpress-admin

mysql:
  enabled: false

database:
  external:
    host: mysql.example.com
    port: 3306
    name: wordpress
    username: wordpress
    existingSecret: wordpress-db
    existingSecretPasswordKey: password

persistence:
  enabled: true
  accessMode: ReadWriteMany
  storageClass: nfs-rwx
  size: 20Gi

service:
  ipFamilyPolicy: PreferDualStack
  ipFamilies:
    - IPv4
    - IPv6

gatewayAPI:
  enabled: true
  parentRefs:
    - name: public
      namespace: gateway-system
      sectionName: https
  hostnames:
    - blog.example.com

networkPolicy:
  enabled: true
  ingress:
    extraFrom:
      - namespaceSelector:
          matchLabels:
            kubernetes.io/metadata.name: gateway-system
  egress:
    enabled: true
    allowDNS: true
    allowSameNamespaceDatabase: false
    allowHTTPS: true

wpCron:
  cronJob:
    enabled: true

autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 5

pdb:
  enabled: true
  minAvailable: 1

resources:
  requests:
    cpu: 250m
    memory: 512Mi
  limits:
    cpu: '1'
    memory: 1Gi

# values.yaml - external MySQL or MariaDB
mysql:
  enabled: false

database:
  mode: external
  external:
    host: mysql.database.svc.cluster.local
    port: 3306
    name: wordpress
    username: wordpress
    existingSecret: wordpress-db
    existingSecretPasswordKey: database-password

admin:
  existingSecret: wordpress-admin
  existingSecretPasswordKey: admin-password

backup:
  enabled: true
  s3:
    endpoint: https://s3.amazonaws.com
    bucket: wordpress-backups
    existingSecret: wordpress-s3

# values.yaml - Gateway API with External Secrets Operator
mysql:
  enabled: false

database:
  external:
    host: mysql.example.com
    name: wordpress
    username: wordpress
    existingSecretPasswordKey: database-password

externalSecrets:
  enabled: true
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  admin:
    enabled: true
    passwordRemoteRef:
      key: prod/wordpress
      property: admin-password
  database:
    enabled: true
    passwordRemoteRef:
      key: prod/wordpress
      property: database-password

gatewayAPI:
  enabled: true
  parentRefs:
    - name: public
      namespace: gateway-system
  hostnames:
    - blog.example.com

# values.yaml - first install bootstrap with WP-CLI
wordpress:
  siteUrl: https://blog.example.com
  siteTitle: Example Blog
  adminUser: admin
  adminEmail: [email protected]

admin:
  existingSecret: wordpress-admin

bootstrap:
  enabled: true
  permalinkStructure: /%postname%/

# values.yaml - Redis Object Cache using HelmForge Redis subchart
plugins:
  enabled: true
  installer:
    enabled: true

objectCache:
  enabled: true
  provider: redis
  redis:
    mode: subchart
    subchart:
      enabled: true

redis:
  architecture: standalone
  auth:
    existingSecret: wordpress-redis-auth
    existingSecretPasswordKey: redis-password

# values.yaml - Redis Object Cache using external Redis
plugins:
  enabled: true
  installer:
    enabled: true

objectCache:
  enabled: true
  provider: redis
  redis:
    mode: external
    external:
      host: redis.example.com
    auth:
      existingSecret: wordpress-redis
      existingSecretPasswordKey: redis-password

# values.yaml - Memcached provider using a custom image with php-memcached
image:
  repository: example.com/custom-wordpress
  tag: 7.0.0-apache-memcached

plugins:
  enabled: true
  installer:
    enabled: true
    image:
      repository: example.com/custom-wordpress-cli
      tag: cli-php8.3-memcached

objectCache:
  enabled: true
  provider: memcached
  memcached:
    mode: subchart
    subchart:
      enabled: true

memcached:
  architecture: standalone

# values.yaml - install official and verified custom plugins
persistence:
  enabled: true

plugins:
  enabled: true
  installer:
    enabled: true
    activeDeadlineSeconds: 60
  items:
    - slug: classic-editor
      activate: true
      skipIfInstalled: true
    - slug: contact-form-7
      activate: true
      skipIfInstalled: true
  custom:
    - name: company-plugin
      url: https://plugins.example.com/company-plugin-1.4.2.zip
      sha256: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
      activate: true
      skipIfInstalled: true
      authentication:
        existingSecret: wordpress-plugin-download
        tokenKey: token

# values.yaml - S3-compatible backup of database and wp-content
backup:
  enabled: true
  schedule: '0 3 * * *'
  archivePrefix: wordpress
  s3:
    endpoint: https://s3.amazonaws.com
    bucket: wordpress-backups
    existingSecret: wordpress-s3
    existingSecretAccessKeyKey: access-key
    existingSecretSecretKeyKey: secret-key
  database:
    mysqldumpArgs: '--single-transaction --quick --skip-lock-tables --no-tablespaces'

backup:
  enabled: true
  s3:
    endpoint: https://s3.amazonaws.com
    bucket: wordpress-backups

externalSecrets:
  enabled: true
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  backup:
    enabled: true
    accessKeyRemoteRef:
      key: prod/wordpress-backup
      property: access-key
    secretKeyRemoteRef:
      key: prod/wordpress-backup
      property: secret-key

Operational Notes

Database Mode

When database.mode: auto, the chart resolves the database path in this order:

1. database.external.host or database.external.existingSecret selects an external database.
2. mysql.enabled: true selects the HelmForge MySQL subchart.
3. Rendering fails because WordPress requires MySQL or MariaDB.

WordPress Cron

Set wordpress.disableWpCron: true and enable wpCron.cronJob.enabled when you want deterministic cron execution from Kubernetes instead of request-driven wp-cron.php.

The CronJob does not inherit the WordPress Deployment placement. Use wpCron.cronJob.nodeSelector, wpCron.cronJob.affinity, and wpCron.cronJob.tolerations to place short-lived cron pods on a dedicated or lower-cost node pool. Empty defaults leave scheduling to the cluster.

wpCron:
  cronJob:
    enabled: true
    nodeSelector:
      workload-tier: batch
    tolerations:
      - key: workload
        operator: Equal
        value: batch
        effect: NoSchedule

Bootstrap

The official WordPress image creates files and wp-config.php, but it does not create the initial site. Enable bootstrap.enabled when Helm should run wp core install. The Job requires wordpress.siteUrl or bootstrap.siteUrl, and it skips work when WordPress is already installed.

Object Cache

For Redis, the chart installs the official redis-cache plugin, writes the object-cache.php drop-in, and sets WP_CACHE plus WP_REDIS_* constants. Redis is only functionally validated when WordPress can create cache keys in Redis; a running Redis pod alone is not enough.

If the Redis subchart is used and redis.auth.enabled=false, WordPress does not reference a Redis password Secret. If the subchart uses redis.auth.existingSecret, WordPress and the plugin installer read the same Secret and key.

Memcached is guarded because the official WordPress image does not include the PHP memcached extension. Use custom WordPress and installer images before enabling objectCache.provider: memcached.

Custom Plugin Security

plugins.items remains the contract for official WordPress.org slugs. plugins.custom accepts custom or private ZIPs only with HTTPS and a required SHA-256 checksum. Authentication can reference an existing Secret and token key; tokens are never rendered into manifests or placed in downloader arguments. With skipIfInstalled: true, upgrades skip both the download and installation when the plugin directory already exists.

Do not use custom plugin installation to add PHP extensions. Build extensions into immutable runtime and WP-CLI images, scan before publishing, and pin the resulting tag or digest. Startup compilation is unsupported.

NetworkPolicy

networkPolicy.enabled isolates application ingress. Add networkPolicy.ingress.extraFrom for an Ingress controller or Gateway controller that runs outside the WordPress namespace. Egress rules are opt-in; list DNS, database, HTTPS, SMTP, or custom destinations before enabling restrictive egress.

Backups and Restore

The backup CronJob writes two artifacts:

• A compressed database dump from mysqldump.
• A compressed archive of /var/www/html/wp-content.

Production users should test restore procedures, object storage retention, object lock, and database consistency. A successful backup upload is not a complete disaster recovery validation.

Configuration Reference

Core and Image

WordPress

Bootstrap

Credentials and External Secrets

Database and MySQL Subchart

Storage, Service, and Routing

Production Controls

Plugins and Object Cache

NetworkPolicy, Metrics, and Backup

Scheduling and Extensions

More Information

• WordPress official documentation
• WordPress 7.1.3 maintenance and security release
• WordPress Docker image
• Redis Object Cache plugin
• HelmForge WordPress chart source