kubernetes-helm

No entries match these filters. Clear filters

1. docs update Sep 10, 2026 · issue 070

   kubernetes-helm: Adds --description flag to helm rollback to record a human-readable reason for the rollback.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Document why a rollback was performed so the reason is visible in audit history.
   copy

   $ helm rollback my-release 3 --description 'Reverting due to latency spike in v4 deployment'

   Produce a reproducible chart archive with a fixed modification timestamp for deterministic CI builds.
   copy

   $ SOURCE_DATE_EPOCH=1700000000 helm package ./mychart

   • Adds a rollback revision column to helm history output so operators can trace which revision triggered each rollback.
   • Adds duration template functions to the Helm chart templating engine.
   • Adds debug logging to the template engine when lookup returns empty results.
   • Adds duration template functions to the Helm chart templating engine.

   2 more in Everything

2. v4.3.0 Sep 9, 2026 · issue 070

   Helm v4.3.0 adds --description to rollback, duration template functions, SOURCE_DATE_EPOCHSOURCE_DATE_EPOCHA Unix timestamp set as an environment variable to make build tools substitute a fixed date for the current time, enabling reproducible builds whose output is byte-for-byte identical across machines and runs. support, and ownership verification before resource deletion⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.3.0 https://github.com/helm/helm.git
   # already have the repo? check out this version:
   $ git checkout v4.3.0

   └──▷ TRY IT
   Roll back a release and capture the reason in release history for audit trails.
   copy

   $ helm rollback my-release 2 --description 'Reverting due to latency regression in v1.4.2'

   Produce a reproducible chart archive tied to a specific timestamp for supply-chain verification.
   copy

   $ SOURCE_DATE_EPOCH=1700000000 helm package ./my-chart

   • Adds --description flag to helm rollback to record a reason for the rollback (max 256 characters) in the release history.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds duration functions to the Helm template engine for time-based calculations in chart templates.
   • Honors the SOURCE_DATE_EPOCH environment variable when producing chart archives, enabling reproducible builds.
   • Adds ownership verification before deleting resources during uninstall, preventing accidental removal of resources not owned by the release.
   • Enables concurrent status computation to prevent multi-minute delays on releases with many resources.
   • Adds --description flag to helm rollback to record a reason for the rollback (max 256 characters) in the release history.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds duration functions to the Helm template engine for time-based calculations in chart templates.
   • Honors the SOURCE_DATE_EPOCH environment variable when producing chart archives, enabling reproducible builds.

   2 more in Everything

3. docs update Jul 24, 2026 · issue 024

   Helm now supports SOURCE_DATE_EPOCHSOURCE_DATE_EPOCHA Unix timestamp set as an environment variable to make build tools substitute a fixed date for the current time, enabling reproducible builds whose output is byte-for-byte identical across machines and runs. for reproducible chart archives across builds and machines.

   └──▷ TRY IT
   Package a chart with a fixed timestamp so every CI build produces the same .tgz regardless of when or where it runs.
   copy

   $ SOURCE_DATE_EPOCH=1609459200 helm package ./mychart

   Derive the reproducible timestamp from your last git commit so the archive stays tied to source history without hardcoding a value.
   copy

   $ SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct) helm package ./mychart

   • Supports the SOURCE_DATE_EPOCH environment variable to produce byte-identical chart archives across builds by stamping all archive file modification times with a fixed Unix timestamp.
   • Stamps the generated: timestamp in Chart.lock with SOURCE_DATE_EPOCH, making dependency-declaring charts fully reproducible across machines.
   • Extends SOURCE_DATE_EPOCH support to helm install, helm dependency build, and helm dependency update when re-archiving dependencies from local file:// repositories.

   3 details in Everything

4. docs update Jul 24, 2026 · docs issue 004

   Helm now supports SOURCE_DATE_EPOCHSOURCE_DATE_EPOCHA Unix timestamp set as an environment variable to make build tools substitute a fixed date for the current time, enabling reproducible builds whose output is byte-for-byte identical across machines and runs. for reproducible chart archives across builds and machines.

   └──▷ TRY IT
   Package a chart with a fixed timestamp so every CI build produces the same .tgz regardless of when or where it runs.
   copy

   $ SOURCE_DATE_EPOCH=1609459200 helm package ./mychart

   Derive the reproducible timestamp from your last git commit so the archive stays tied to source history without hardcoding a value.
   copy

   $ SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct) helm package ./mychart

   • Supports the SOURCE_DATE_EPOCH environment variable to produce byte-identical chart archives across builds by stamping all archive file modification times with a fixed Unix timestamp.
   • Stamps the generated: timestamp in Chart.lock with SOURCE_DATE_EPOCH, making dependency-declaring charts fully reproducible across machines.
   • Extends SOURCE_DATE_EPOCH support to helm install, helm dependency build, and helm dependency update when re-archiving dependencies from local file:// repositories.

   3 details in Everything

5. v4.2.0 May 14, 2026 · release notes

   Helm v4.2.0 adds mustToToml template function, server-side dry-run generateName support, and loong64 platform binaries.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.2.0 https://github.com/helm/helm.git
   # already have the repo? check out this version:
   $ git checkout v4.2.0

   • Adds mustToToml template function for rendering TOML output in chart templates.
   • Enables --dry-run=server to correctly respect generateName: in manifests.
   • Adds Linux loong64 binary distribution support.

   3 details in Everything

6. advisory CVE-2026-35206 Apr 9, 2026 · issue 128
   • CVE-2026-35206: Helm Chart extraction output directory collapse via Chart.yaml name dot-segment (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.4, affects <=3.20.1,<=4.1.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
7. advisory CVE-2026-35204 Apr 9, 2026 · issue 128
   • CVE-2026-35204: Path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.6, affects >=4.0.0,<=4.1.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
8. advisory CVE-2026-35205 Apr 9, 2026 · issue 128
   • CVE-2026-35205: Plugin verification fails open when .prov is missing, allowing unsigned plugin install (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects >=4.0.0,<=4.1.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
9. v4.1.1 Feb 9, 2026 · release notes

   Helm v4.1.1 adds --context options for fine-grained waiting control and fixes kstatus hangs.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.1.1 https://github.com/helm/helm.git
   # already have the repo? check out this version:
   $ git checkout v4.1.1

   • helm --context sub-options allow fine-grained control over resource waiting behavior

   1 detail in Everything

10. v3.20.0 Jan 21, 2026 · release notes

    Helm v3.20.0 adds a timeout flag to repo add/update and a TLS-in-memory login option for the registry client.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.20.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.20.0

    └──▷ TRY IT
    Set a custom timeout when adding a slow or high-latency chart repository to prevent indefinite hangs.
    copy

    $ helm repo add myrepo https://charts.example.com --timeout 2m

    Enforce a timeout on a repo index refresh in CI so the pipeline fails fast instead of blocking.
    copy

    $ helm repo update --timeout 30s

    • Adds --timeout flag to helm repo add and helm repo update commands.
    • New registry client login option for passing TLS config in memory (SDK).
    • Bumps Kubernetes API versions to v0.35.0 in the SDK.

    3 details in Everything

11. v4.1.0 Jan 21, 2026 · release notes

    Helm v4.1.0 adds concurrent dependency builds, --wait strategy selection, --no-headers for repo list, and SDK custom kstatus readers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.1.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v4.1.0

    └──▷ TRY IT
    Strip headers from helm repo list output for clean pipeline/script parsing.
    copy

    $ helm repo list --no-headers | awk '{print $2}'

    Use the new hook-only wait strategy to block only on hook completion rather than all resources.
    copy

    $ helm upgrade myrelease ./mychart --wait=hookOnly --timeout 5m

    • Adds --no-headers flag to helm repo list to suppress table headers, useful for scripting and automation.
    • Enables concurrent dependency builds with atomic file writes via helm dependency build.
    • Adds chart name to dependency logs, namespace to resource-waiting logs, and a confirmation message when all resources are ready.
    • Improves plugin name validation error messages and field name detection.
    • SDK: Adds LoadArchive to the common loader.

    +1 more show less

    • SDK: Introduces support for custom kstatus readers.

    6 details in Everything

12. v4.0.0 Nov 12, 2025 · release notes

    Helm 4.0.0 ships WebAssemblyWebAssemblyA binary instruction format that runs in browsers and server runtimes at near-native speed, letting developers compile C, Rust, or other languages into a portable, sandboxed module any compliant host can execute. plugins, server-side apply, kstatus-based resource watching, and reproducible chart builds.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.0.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v4.0.0

    • Adds a redesigned plugin system with support for WebAssembly-based plugins.
    • Promotes post-renderers to first-class plugins.
    • Supports server-side apply for Kubernetes resource management.
    • Improves resource watching for wait operations using kstatus.
    • Adds local content-based caching for charts and other artifacts.

    +3 more show less

    • Enables structured logging via slog, allowing SDK logging to integrate with modern loggers.
    • Supports reproducible builds of chart archives.
    • Updates the SDK API with support for multiple chart API versions, including a new experimental v3 chart API version.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Helm v4 introduces backward-incompatible changes to CLI flags and output compared to Helm v3.
    • !The SDK API has breaking changes incompatible with Helm v3.
13. v3.19.1 Nov 11, 2025 · release notes

    Helm v3.19.1 adds a --timeout flag to helm repo add and helm repo update.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.19.1 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.19.1

    └──▷ TRY IT
    Set a custom timeout when adding a slow or remote chart repository to avoid hanging indefinitely.
    copy

    $ helm repo add my-repo https://charts.example.com --timeout 30s

    Cap the wait time when refreshing all repos in a CI pipeline where a stale repo shouldn't block the build.
    copy

    $ helm repo update --timeout 15s

14. v3.19.0 Sep 11, 2025 · release notes

    Helm v3.19.0 adds Gateway API HTTPRoute support to helm create chart templates.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.19.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.19.0

15. advisory CVE-2025-55198 Aug 13, 2025 · issue 128
    • CVE-2025-55198: Incorrect YAML Content Leads To Panic (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects <= 3.18.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
16. advisory CVE-2025-55199 Aug 13, 2025 · issue 128
    • CVE-2025-55199: Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects <= 3.18.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
17. advisory CVE-2025-53547 Jul 8, 2025 · issue 128
    • CVE-2025-53547: Chart Dependency Updating With Malicious Chart.yaml Content And Symlink (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.5, affects <= 3.17.3, >= 3.18.0, <= 3.18.3 )⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
18. v3.18.0 May 19, 2025 · release notes

    Helm v3.18.0 adds JSON Schema 2020 support, CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./memory profiling, hook log streaming, HTTP fallback for OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant., and multi-platform plugin hooks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.18.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.18.0

    └──▷ TRY IT
    Capture a CPU profile while running a heavyweight install to diagnose slow deployments.
    copy

    $ HELM_PPROF=cpu helm install myrelease ./mychart

    Surface hook pod logs directly in the terminal when a hook fails, without having to kubectl logs separately.
    copy

    $ # In your hook manifest, add the annotation:
    # helm.sh/hook-output-log-policy: hook-failed
    helm upgrade myrelease ./mychart

    • Supports JSON Schema 2020 for chart value validation.
    • Enables CPU and memory profiling via HELM_PPROF environment variable and new profiling flags.
    • Adds hook annotations to stream pod logs to the client on hook error (and success).
    • Automatic HTTP fallback for OCI registries when HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. is unavailable.
    • Adds multi-platform plugin hook support.

    +1 more show less

    • Reports time spent waiting for resources as a debug log.

    6 details in Everything

19. advisory CVE-2025-32386 Apr 9, 2025 · issue 128
    • CVE-2025-32386: Specially Crafted Chart Archive Can Cause Out Of Memory Termination (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects < 3.17.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
20. advisory CVE-2025-32387 Apr 9, 2025 · issue 128
    • CVE-2025-32387: Specially Crafted JSON Schema Can Cause Stack Overflow (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects < 3.17.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
21. v4 Changes Also Backported to v3 Mar 24, 2025 · release notes

    Adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. install by digest, HTTPRoute template support, CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./memory profiling, hook log output, and resource ready status logging

    └──▷ USE IT
    Install a chart from an OCI registry pinned to a specific digest for reproducible deployments.
    shell copy

    helm install my-app oci://registry.example.com/my-chart --digest sha256:abc123...

    • Adds --digest support for OCI chart installs to pin versions by content hash instead of tag.
    • Adds httproute from gateway-api as a built-in Helm chart template snippet.
    • Enables CPU and memory profiling via new profiling flags or environment variables.
    • Outputs hook logs directly to the client output on error using the new hook annotation.
    • Logs time spent waiting for resources to be ready in slog format.

    5 details in Everything

22. v3.17.0 Jan 15, 2025 · release notes

    Helm v3.17.0 adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. digest installs, --take-ownership flag, toYamlPretty, richer metadata output, and credential support for push/dependency commands.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.17.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.17.0

    └──▷ TRY IT
    Take ownership of existing cluster resources (e.g. pre-created by Terraform) without errors during install.
    copy

    $ helm install my-release ./my-chart --take-ownership

    • Supports pulling and installing charts by OCI digest, enabling reproducible, immutable deployments.
    • New --take-ownership flag for helm install and helm upgrade allows Helm to adopt resources not currently managed by the release.
    • Adds toYamlPretty template function for human-readable YAML rendering in chart templates.
    • Includes annotations and dependencies fields in helm get metadata output.
    • Adds username/password authentication options to helm push and helm dependency build/helm dependency update subcommands.

    +2 more show less

    • SDK: Authorizer and registry authorizer are now configurable, enabling custom authentication flows.
    • Removes the Kubernetes configuration file permissions check, eliminating upgrade friction in shared environments.

    7 details in Everything

23. v3.16.0 Sep 11, 2024 · release notes

    Helm v3.16.0 adds sha512sum templating, --skip-schema-validation flag, ActiveHelp completions, and Windows arm64 support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.16.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.16.0

    └──▷ TRY IT
    Install a chart while bypassing JSON schema validation — useful when iterating on values that temporarily violate the schema.
    copy

    $ helm install my-release ./my-chart --skip-schema-validation

    Lint a chart without failing on schema errors, so CI can still catch template rendering issues independently.
    copy

    $ helm lint ./my-chart --skip-schema-validation

    • Adds sha512sum template function for use in chart templates.
    • Adds --skip-schema-validation flag to helm install, helm upgrade, and helm lint.
    • Adds ActiveHelp shell completions for commands that accept no further arguments.
    • Adds Windows arm64 binary support.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Drops support for very old Kubernetes versions in helm create Ingress templates.
24. v3.15.2 Jun 12, 2024 · release notes

    Helm v3.15.2 warns on outdated requirements.lock files

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.15.2 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.15.2

    • Adds a warning when requirements.lock is out of sync with requirements.yaml

    1 detail in Everything

25. v3.15.0 May 15, 2024 · release notes

    Helm v3.15.0 adds --hide-secrets for dry-run output and improves wait check robustness

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.15.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.15.0

    └──▷ USE IT
    Preview a release installation without exposing sensitive Secret values in the CLI output.
    shell copy

    helm install my-release ./my-chart --dry-run --hide-secrets

    Check what an upgrade will look like while keeping Secret values private.
    shell copy

    helm upgrade my-release ./my-chart --dry-run --hide-secrets

    • Adds the --hide-secrets flag to helm install --dry-run and helm upgrade --dry-run to redact Secret values from the rendered manifest output.
    • Improves wait status checks for stability during Helm operations.

    2 details in Everything

26. advisory CVE-2024-25620 Feb 14, 2024 · issue 128
    • CVE-2024-25620: Dependency management path traversal (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.4, affects < 3.14.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
27. v3.14.0 Jan 17, 2024 · release notes

    Helm v3.14.0 adds --fail-on-no-result to helm search, --kube-version to lint, and supports RISC-V

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.14.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.14.0

    └──▷ USE IT
    Fail a CI step immediately if a chart lookup returns empty, preventing downstream errors from silent failures.
    shell copy

    helm search repo stable/redis --fail-on-no-result

    Validate a chart against Kubernetes 1.30 APIs and deprecation rules before deploying to a newer cluster.
    shell copy

    helm lint . --kube-version 1.30.0

    • helm search now supports the --fail-on-no-result flag, allowing scripts to fail fast when a chart is not found.
    • The lint command now accepts --kube-version to specify Kubernetes version capabilities and deprecation rules during validation.
    • Added support for RISC-V architecture (linux-riscv64) binaries.
    • The ignore package is now public, enabling external projects to reuse its functionality.
    • Introduced HELM_QPS environment parameter to control query-per-second limits for Kubernetes packages.

    +1 more show less

    • Allows nested tpl invocations to access defines from a containing template context.

    6 details in Everything

28. v3.13.0 Sep 27, 2023 · release notes

    Helm v3.13.0 adds helm get metadata, --dry-run options, JSON index support, and OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. plain-http

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.13.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.13.0

    └──▷ USE IT
    Retrieve structured metadata for a specific release without needing external tools.
    shell copy

    helm get metadata my-release

    Push or pull charts from an OCI registry that does not support TLS (e.g., local dev registries).
    shell copy

    helm push ./my-chart oci://localhost:5000 --plain-http

    Generate a lightweight index file for a large chart repository to speed up client-side parsing.
    shell copy

    helm repo index . --url https://example.com/charts/ --json

    • Adds helm get metadata command to retrieve release metadata
    • Extends --dry-run flag with options to enable Helm to connect to a Kubernetes instance during dry-run execution
    • Adds --plain-http flag to allow working with OCI registries over HTTP
    • Helm now adds the OCI creation annotation to packaged charts
    • Adds labels support for install and upgrade commands

    +1 more show less

    • Enables generating index.yaml in JSON format via --json flag for faster parsing and lower memory usage

    6 details in Everything

29. v3.12.0 May 10, 2023 · release notes

    Helm v3.12.0 adds --set-literal, --cascade, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. annotations, and insecure registry support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.12.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.12.0

    • --set-literal command line flag to set a specific string with no escaping
    • --cascade flag to specify deletion policy on uninstall
    • When charts are pushed to OCI registries, annotations are attached using standard names that other tools can introspect (e.g. version)
    • Added support for insecure OCI registries

    4 details in Everything

30. v3.11.1 Feb 8, 2023 · release notes

    Helm v3.11.1 adds --enable-dns CLI flag and SDK EnableDNS to control DNS lookups in templates.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.11.1 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.11.1

    └──▷ USE IT
    Allow a Helm template to resolve hostnames via DNS during the install process.
    shell copy

    helm install mychart ./mychart --set some.value=true --enable-dns

    └──▷ BREAKING ON UPGRADE

    • !The --enable-dns flag is required for the helm template, helm install, and helm upgrade commands; without it, the getHostByName template function returns an empty string instead of attempting a lookup.
    • !The Helm SDK properties install.EnableDNS, upgrade.EnableDNS, and engine.Engine.EnableDNS default to false, disabling DNS lookups for getHostByName unless explicitly set to true.
31. advisory CVE-2023-25165 Feb 8, 2023 · issue 128
    • CVE-2023-25165: getHostByName Function Information Disclosure (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.3, affects v3.0.0 - v3.11.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
32. v3.11.0 Jan 18, 2023 · release notes

    Adds --show-resources to helm status and CSV support to --api-versions

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.11.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.11.0

    └──▷ TRY IT
    List all resources managed by the release my-app in the production namespace for auditing or inspection.
    copy

    $ helm status my-app -n production --show-resources

    Render templates using multiple specific API versions (e.g., apps/v1 and networking.k8s.io/v1) in a single command.
    copy

    $ helm template my-app ./my-chart --api-versions apps/v1,networking.k8s.io/v1

    • Adds the --show-resources flag to helm status to display the Kubernetes resources deployed by a release in the SDK and CLI output
    • Expands --api-versions in helm template (and related commands) to accept comma-separated values, enabling multiple API version specifications in a single argument

    2 details in Everything

33. advisory CVE-2022-23524 Dec 14, 2022 · issue 128
    • CVE-2022-23524: Denial of service through string value parsing (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects <= v3.10.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
34. v3.10.0 Sep 21, 2022 · release notes

    Helm v3.10.0 adds --set-json flag, --burst-limit option, and --no-headers support for helm list

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.10.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.10.0

    • Adds --set-json flag to allow setting JSON values directly in template overrides
    • Adds --burst-limit flag to configure client-side API throttling burst limits
    • Adds --no-headers flag to helm list for machine-parseable output without column headers

    3 details in Everything

35. v3.9.0 May 18, 2022 · release notes

    Adds --quiet flag to helm lint, --post-renderer-args for post renderers, and Kubernetes 1.24 support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.9.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.9.0

    └──▷ TRY IT
    Suppress lint output for cleaner CI logs
    copy

    $ helm lint --quiet ./chart

    Pass arguments like --arg=value to a post-rendering executable
    copy

    $ helm install my-release ./chart --post-renderer=/usr/bin/postrender --post-renderer-args='--config /etc/config.yaml'

    • Adds --post-renderer-args flag to pass arguments to the post renderer
    • Adds --quiet flag to helm lint to suppress output

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Helm SDK Factory interface from kubectl is now breaking due to Kubernetes API changes
36. v3.8.1 Mar 9, 2022 · release notes

    Helm v3.8.1 adds shell completion for OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. chart dependencies and updates Kubernetes libs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.8.1 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.8.1

    • Adds shell completion support for OCI-based chart dependencies to accelerate CLI workflow when working with container registry-hosted charts
    • Updates Kubernetes client libraries to version 0.23.4, aligning the cyber tooling's interaction with cluster APIs to the latest upstream standard

    2 details in Everything

37. v3.8.0 Jan 24, 2022 · release notes

    OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. registry support generally available and helm search hub gains --list-repo-url flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.8.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.8.0

    • helm registry login now follows the same structure as the Docker CLI for storing credentials.
    • helm search hub adds a --list-repo-url flag to quickly show the repositories URL.
    • OCI registry support for charts is now generally available, graduating out of experimental.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !HELHELM_REGISTRY_CONFIG default file for registry config changed to config.json
    • !Release names are validated during installation
38. v3.7.0 Sep 15, 2021 · release notes

    Helm v3.7.0 adds helm uninstall --wait, show crds, --password-stdin to repo add, and refines OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. commands

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.7.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.7.0

    └──▷ TRY IT
    Ensure all Kubernetes resources are fully deleted before the command returns.
    copy

    $ helm uninstall <release-name> --wait

    Extract the CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. from a chart without installing it, for use in GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. or documentation.
    copy

    $ helm show crds <chart> [--version <version>]

    Securely add a repository using a password passed via standard input to avoid logging or shell history exposure.
    copy

    $ helm repo add <name> <url> --password-stdin <<< '<password>'

    • helm chart list is removed
    • helm chart save is replaced with helm package
    • helm chart remove is removed
    • helm uninstall --wait flag
    • helm show crds subcommand

    +3 more show less

    • --max-col-width to helm dependency list
    • {{ .Chart.IsRoot }} in the template engine
    • SIGTERM handling for helm install and helm upgrade

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !helm chart list is removed
    • !helm chart save is replaced with helm package
    • !helm chart remove is removed
39. v3.6.1 Jun 16, 2021 · release notes

    Helm v3.6.1 adds --pass-credentials flag to allow credential forwarding to cross-domain repositories.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.6.1 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.6.1

    └──▷ USE IT
    Forward authentication credentials when a Helm repository URL redirects to a different domain for chart distribution.
    shell copy

    helm repo add stable https://charts.helm.sh/stable --pass-credentials

    • Adds --pass-credentials flag to helm repo add and commands accepting --repo

    1 detail in Everything

40. advisory CVE-2021-32690 Jun 16, 2021 · issue 128
    • CVE-2021-32690: Repository credentials passed to alternate domain (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.6, affects <=3.6.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
41. v3.6.0 May 27, 2021 · release notes

    Helm v3.6.0 adds Apple Silicon binaries, helm uninstall multi-release support, --kube-version flag, and OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. chart registry client initialization

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.6.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.6.0

    • Adds native darwin/arm64 binary for Apple Silicon support.
    • Adds --kube-version flag to helm create and other commands to specify the target Kubernetes version for template rendering.

    2 details in Everything

42. advisory CVE-2021-21303 Feb 4, 2021 · issue 128
    • CVE-2021-21303: Unsanitized data displayed directly to user's terminal (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.8, affects >3.0 and < 3.5.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
43. v3.5.0 Jan 13, 2021 · release notes

    Helm v3.5.0 adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. registry support for chart dependencies, new CLI flags, and sprig template functions

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.5.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.5.0

    └──▷ USE IT
    Pull a chart directly from an OCI registry without using Helm's legacy repository management.
    shell copy

    helm pull oci://registry-1.docker.io/bitnamicharts/redis

    Build dependencies locally without triggering a network registry refresh, useful for offline or constrained environments.
    shell copy

    helm dep build . --skip-refresh

    Override the cluster's default CA certificate file using an environment variable to point to a custom CA.
    shell copy

    HELM_KUBECAFILE=/path/to/custom-ca.crt helm upgrade --install myapp .

    • --skip-refresh flag is added to helm dep build to control dependency refresh behavior.
    • --kube-cafile flag and HELM_KUBECAFILE environment variable override the system-wide certificate authority for Kubernetes API communication.
    • --wait-for-jobs flag enables waiting for Kubernetes jobs to complete when paired with --wait in deployment commands.
    • OCI registries are supported via the oci:// scheme for pulling chart dependencies, though the feature requires an explicit enablement experiment.
    • Helm incorporates Sprig v3.2.0, adding over 20 new template functions to the rendering engine.

    5 details in Everything

44. v3.4.1 Nov 11, 2020 · release notes

    Helm v3.4.1 adds --skip-refresh flag to helm dep build and improves semver support in search

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.4.1 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.4.1

    └──▷ USE IT
    Build local dependencies without fetching remote updates, useful for offline builds or reproducible CI pipelines.
    shell copy

    helm dep build --skip-refresh .

    • Adds --skip-refresh option to helm dep build to skip updating dependencies
    • Updates helm search to support semver pre-version numbers starting with 0

    2 details in Everything

45. v3.4.0 Oct 26, 2020 · release notes

    Helm v3.4.0 adds time-format flag to list, description display to status, dependency checks in lint, GPG install verification, impersonation flags, fish completion, env variable selector, index.yaml annotations, and force-update default inversion.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.4.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.4.0

    └──▷ USE IT
    Format list output dates to RFC3339 instead of the default format for easier parsing.
    shell copy

    helm list --time-format '2006-01-02T15:04:05Z'

    Add a repository with GPG verification, passing the passphrase via stdin.
    shell copy

    echo "mysecretpass" | helm repo add myrepo https://myrepo.example.com --keyring ~/.gnupg/pubring.kbx

    • --time-format flag added to helm list to set the output time format
    • helm status now displays release description via new flag (or auto-display)
    • helm lint reports name length errors in templates
    • helm lint now checks dependencies for validity and resolution issues
    • Support adding a top-level annotations key/value pair in repository index.yaml files

    +4 more show less

    • --as flag added to enable impersonation similar to kubectl --as="user"
    • Support accepting signing passphrase from file or stdin for repository operations
    • Fish shell completion support added via helm env completion fish or direct sourcing
    • helm env <VARIABLE> command added to read a specific Helm environment variable value

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !--no-update flag is replaced by --force-update, and the default behavior for helm repo update (and implied in install/add contexts where applicable) now performs an update unless --force-update=false is explicitly passed
46. v2.17.0 Oct 26, 2020 · release notes

    Helm v2.17.0 adds --skip-repos to init and updates default repository locations

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.17.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.17.0

    └──▷ USE IT
    Initialize Helm without adding any chart repositories, useful for isolated environments or when managing repos manually
    shell copy

    helm init --skip-repo

    • helm init gains the --skip-repo flag to skip adding the stable and local chart repositories during initialization
    • The default location for the stable chart repository is changed to the new archive URL by default in Helm v2.17.0
    • Tiller's default Docker image location is updated to ghcr.io/helm/tiller

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default Tiller image has changed from the previous GCR location to ghcr.io/helm/tiller; existing setups relying on the old default will pull from the wrong registry unless overridden
    • !The default stable repository URL is now the new archive location; configurations relying on the old stable repo URL without explicit override will point to the archive
47. v3.3.2 Sep 17, 2020 · release notes

    Helm v3.3.2 introduces --force-update for helm repo add and stricter YAML parsing for plugin metadata files to address security issues.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.3.2 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.3.2

    └──▷ TRY IT
    Update an existing Helm chart repository URL or credential without removing and re-adding the remote.
    copy

    $ helm repo add stable https://charts.helm.sh/stable --force-update

    • Adds --force-update flag to helm repo add to allow overwriting existing repository entries

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default behavior of helm repo add no longer overwrites existing repository entries; the --no-update flag now does nothing.
48. advisory CVE-2020-15187 Sep 17, 2020 · issue 128
    • CVE-2020-15187: plugin.yaml file allows for duplicate entries (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.7, affects 2.0.0-2.16.10, 3.0.0-3.3.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
49. v3.3.0 Aug 11, 2020 · release notes

    Helm v3.3.0 adds Helm env vars for XDGXDGA set of specifications maintained by freedesktop.org that standardise where Linux applications store config, data, and cache files, letting tools respect user-defined paths instead of hardcoding locations. configuration, new linting checks, rollback revisions and Capabilities versioning.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.3.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.3.0

    • Adds helm env subcommands to list and configure environment variables that control Helm's XDG configuration directory locations
    • Enables upgrading releases that previously failed by completing the revision process
    • Introduces new linting capabilities including detection of missing selectors and validation of templated resource names

    3 details in Everything

50. advisory CVE-2020-4053 Jun 15, 2020 · issue 128
    • CVE-2020-4053: Plugin archive directory traversal (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.8, affects 3.0.0-3.2.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
51. advisory CVE-2020-7919 Jun 10, 2020 · issue 128
    • CVE-2020-7919: CVE-2020-7919 (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects 2.0.0-2.16.7,3.0.0-3.0.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
52. v2.16.7 May 5, 2020 · release notes

    Adds Sonatype Nexus Repository Manager as a supported Helm repository host

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.16.7 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.16.7

53. advisory CVE-2020-11013 Apr 22, 2020 · issue 128
    • CVE-2020-11013: lookup Function Information Discolosure (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.0, affects 3.1.0-3.1.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
54. v3.2.0 Apr 22, 2020 · release notes

    Helm v3.2.0 adds --insecure-skip-tls-verify for repo commands and ports the PostgreSQL storage driver.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.2.0

    └──▷ TRY IT
    Add a chart repository hosted over HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. that uses a self-signed or untrusted certificate.
    copy

    $ helm repo add my-repo https://charts.example.com --insecure-skip-tls-verify

    • Adds --insecure-skip-tls-verify flag to repository commands (e.g., helm repo add) to allow connections to repositories without valid TLS certificates
    • Ported the PostgreSQL SQL storage driver from Helm 2 for use with Helm v3, enabling PostgreSQL as a backend for release history

    2 details in Everything

55. v3.1.0 Feb 13, 2020 · release notes

    Adds post-render hooks to modify template output and restores the --description flag for custom release descriptions

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.1.0

    └──▷ USE IT
    Attach a custom description to a Helm release for better tracking in Kubernetes annotations.
    shell copy

    helm install my-app ./chart --description "Initial deployment by DevOps"

    Configure post-rendering to transform the rendered manifests before sending them to Kubernetes.
    shell copy

    helm install my-app ./chart --post-renderer ./transformer.sh

    • helm lint works on charts bundled as a .tar.gz file
    • Adds post-render hooks enabling a script or application to modify the output of rendered templates
    • helm upgrade / install adds -A short flag for --all-namespace

    3 details in Everything

56. v3.0.0 Nov 13, 2019 · release notes

    Helm v3.0.0 introduces OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. registry support, library charts, and removes the in-cluster Tiller component.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v3.0.0

    • Adds experimental support for storing Helm charts in OCI registries (e.g. Docker Distribution)
    • Adds support for library charts that act as resource libraries for other charts
    • Removes the in-cluster Tiller component, changing how releases are stored and managed

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The -n flag now aliases --namespace instead of name
    • !.Release.Time is removed from templates; use the now template function instead
    • !crd-install hooks are no longer supported; use the crds/ folder instead
57. v2.16.0 Nov 6, 2019 · release notes

    Helm v2.16 adds support for Kubernetes 1.16 manifest apiVersions and fixes repo search output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.16.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.16.0

    • Supports Kubernetes 1.16 new manifest apiVersions
    • Search command now displays the proper version for repository entries

    2 details in Everything

58. v2.15.0 Oct 18, 2019 · release notes

    Helm v2.15.0 introduces --output, helm test enhancements, and --api-versions

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.15.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.15.0

    └──▷ USE IT
    Validate a chart against specific Kubernetes API versions before installation
    shell copy

    helm template --api-versions "apps/v1,extensions/v1beta1" .

    Export repository search results as YAML for programmatic processing
    shell copy

    helm search repo <keyword> -o yaml

    • Adds --api-versions flag to helm template to validate templates with a custom API version list
    • Introduces helm test --max to set the maximum number of parallel test hooks
    • Adds --output flag to helm install, helm repo list, and helm search for YAML/JSON output
    • Exposes resource types in .Capabilities.APIVersions.Has function within templates

    4 details in Everything

59. v2.14.0 May 15, 2019 · release notes

    Helm v2.14.0 adds helm.sh/resource-policy annotation, --cleanup-on-fail, --template formatting, and configurable tiller probes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.14.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.14.0

    └──▷ USE IT
    Prevent specific resources from being deleted when uninstalling a chart.
    yaml copy

    apiVersion: v1
    kind: Service
    metadata:
      name: my-service
      annotations:
        helm.sh/resource-policy: delete

    Automatically clean up partially deployed resources if a rollback operation fails.
    copy

    $ helm rollback --cleanup-on-fail <RELEASE_NAME> <REVISION>

    Format the output of helm get using a Go template to extract specific values.
    copy

    $ helm get --template '{{.Name}}' <RELEASE_NAME>

    • Introduces helm.sh/resource-policy: delete annotation to opt in to resource deletion on chart uninstall
    • Adds --probe-listen flag to tiller for setting the address:port to listen on for probes
    • Adds --cleanup-on-fail flag to helm rollback to allow deletion of new resources created during a failed rollback
    • Adds --template flag to helm get to provide go template formatting for command output

    4 details in Everything

60. v2.13.0 Feb 27, 2019 · release notes

    Helm v2.13.0 adds --atomic rollback, --parallel testing, subchart notes, and devel inspect flags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.13.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.13.0

    └──▷ USE IT
    Ensure a release is fully rolled back to its previous state if the installation fails.
    shell copy

    helm install --atomic stable/nginx-ingress

    Run all tests for a release in parallel to speed up verification.
    shell copy

    helm test my-release --parallel

    • Adds --atomic flag to helm install and helm upgrade to automatically roll back if a release fails during installation or upgrade.
    • Adds --parallel flag to helm test to allow running multiple tests in parallel.
    • Adds --render-subchart-notes flag to helm install and helm upgrade to include ChartNotes from subcharts in the rendered output.
    • Adds --devel flag to helm inspect to support inspecting pre-release versions of Helm charts.
    • Adds chart name validation check to helm lint.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. API binary wire format has changed, breaking backward compatibility with previous Helm client libraries.
61. v2.12.0 Dec 7, 2018 · release notes

    Helm v2.12.0 adds $HELM_KEY_PASSPHRASE for chart signing and the helm convert plugin

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.12.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.12.0

    └──▷ USE IT
    Sign charts automatically by setting the passphrase environment variable before running Helm commands.
    shell copy

    export HELM_KEY_PASSPHRASE='your-secure-passphrase' && helm sign <chart-path>

    • Adds helm convert plugin to enable conversion between chart formats.
    • Introduces $HELM_KEY_PASSPHRASE environment variable to configure passphrase for signing Helm charts.

    2 details in Everything

62. v2.11.0 Sep 25, 2018 · release notes

    Adds helm notes subcommand and TLS env var support for Helm v2.11.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.11.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.11.0

    └──▷ USE IT
    View the notes defined in a chart for an existing release.
    shell copy

    helm notes <release-name>

    Configure TLS authentication for Helm and Tiller using environment variables instead of CLI flags.
    shell copy

    export HELM_TLS_CA_CERT=ca.crt HELM_TLS_CERT=cert.crt HELM_TLS_KEY=key.crt
    helm list --tls

    Initialize Tiller while specifying a custom hostname for TLS verification.
    shell copy

    helm init --tiller-tls-hostname tiller.default.svc.cluster.local

    • Introduces the helm notes subcommand to display release notes from a chart.
    • Enables setting all TLS flags via environment variables.
    • Adds --tls-hostname flag to helm init for specifying the Tiller server hostname during TLS verification.

    3 details in Everything

63. v2.10.0 Aug 17, 2018 · release notes

    Helm v2.10.0 adds --col_width, --description, and --kubeconfig flags, s390x support, and namespace name labels.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.10.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.10.0

    └──▷ USE IT
    Search for charts with a fixed column width for better terminal alignment.
    shell copy

    helm search --col_width 80 stable/nginx-ingress

    Specify a description for the release to aid in audit trails or documentation.
    shell copy

    helm install stable/nginx --description 'Production ingress controller'

    Use a specific kubeconfig file instead of the default location for managing multiple clusters.
    shell copy

    helm install stable/mysql --kubeconfig /path/to/custom/kubeconfig

    • Added --col_width flag to helm search
    • Added --description flag for install, upgrade, rollback, and delete operations
    • Added --tls-hostname flag for Tiller TLS verification
    • Added s390x binary releases for the Helm client
    • Added support for injecting a name label into namespaces created via helm install --namespace

    +2 more show less

    • Added support for reading from stdin when using plugin getters
    • Added --kubeconfig flag to specify a kubeconfig file

    7 details in Everything

64. v2.9.0 Apr 26, 2018 · release notes

    Helm v2.9.0 adds --set-string, output formats, authentication, and hook-delete-policy

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.9.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.9.0

    • Adds the --set-string flag to force string values in helm install or helm upgrade commands
    • Supports JSON and YAML output formats via a new flag on helm get manifest and related status/listing commands
    • Adds authentication support for remote chart repositories using HTTP basic auth
    • Implements the before-hook-creation delete policy in Helm hooks

    4 details in Everything

65. v2.8.0 Jan 22, 2018 · release notes

    Helm 2.8.0 adds helm status JSON/YAML output, helm lint namespace/values support, and helm init --wait flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.8.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.8.0

    └──▷ USE IT
    Parse Helm release data in automation scripts using standard JSON tools like jq.
    shell copy

    helm status my-release -o json | jq '.info.status'

    Validate a chart against a specific namespace and values file during CI to catch errors before deployment.
    shell copy

    helm lint ./my-chart --namespace production --values values-prod.yaml

    Ensure Tiller is fully ready before proceeding with subsequent Helm commands in a script to avoid race conditions.
    shell copy

    helm init --upgrade --wait

    • helm status now accepts -o json or -o yaml to export release state as structured data instead of only human-readable text.
    • helm lint gains --namespace <ns> and --values <file> flags, allowing chart validation against a target namespace and custom values before installation.
    • helm init --wait pings the Tiller server after deployment and fails if readiness is not confirmed within the timeout period.

    3 details in Everything

66. v2.7.0 Oct 23, 2017 · release notes

    Helm 2.7.0 adds --node-selectors and --output flags to helm init plus a new secrets storage backend.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.7.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.7.0

    └──▷ USE IT
    Deploy Tiller to specific nodes using custom selectors and output the manifest to a file.
    shell copy

    helm init --node-selectors disktype=ssd --output tiller.yaml

67. v2.5.0 Jun 19, 2017 · release notes

    Helm 2.5.0 adds experimental Tiller plugins, --set array indices, helm plugin update, and per-repo flags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.5.0

    └──▷ HOW TO FIND IT
    Enable experimental Tiller plugins to test new back-end capabilities.
    📍helm init --experimental-release
    Update installed Helm plugins to their latest versions.
    📍helm plugin update <plugin-name>
    Package a chart while automatically updating its dependencies.
    📍helm package -u .
    • Enables experimental Tiller back-end plugins by starting Tiller with --experimental-release
    • Adds support for array indices in --set syntax (e.g., --set servers[0].port=8080)
    • Adds -u flag to helm package to update dependencies during packaging
    • Introduces a new helm plugin update command for updating installed plugins
    • Allows aliasing packages in requirements.yaml (experimental)

    +2 more show less

    • Enables upgrading Tiller's service account via helm init
    • Adds --repo flag to install, update, and other applicable subcommands

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !helm install and helm update no longer download remote charts to the current working directory; use helm fetch instead.
    • !Keys in values.yaml with the literal form "foo[0]" will no longer work because --set now accepts array indices.
68. v2.4.2 May 18, 2017 · release notes

    Helm v2.4.2 adds the --devel flag for install/upgrade/fetch

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.2 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.4.2

69. v2.4.0 May 2, 2017 · release notes

    Helm 2.4.0 adds pluggable protocol downloaders, helm init flags for Service Account and --net-host, and zsh completion

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.4.0

    └──▷ TRY IT
    Install Tiller into a Kubernetes 1.6+ cluster with RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. enabled, assigning it a specific service account
    copy

    $ helm init --service-account=tiller-sa

    Configure Helm to use a custom chart repository instead of the default stable repo during installation
    copy

    $ helm init --repository-url https://my-custom-charts.example.com/charts

    • Adds pluggable protocol hooks to client-side plugins via the downloaders section in plugin.yaml, enabling custom handlers for protocols like s3:// or test://
    • Adds the --service-account=SOME_NAME flag to helm init to configure Tiller's Service Account during installation
    • Adds the --net-host flag to helm init for network configuration of the Tiller pod
    • Exposes repository-URLs as flags on helm init command to change the default repository
    • Adds zsh shell completion via helm completion zsh (bash completion already existed)

    +1 more show less

    • Introduces merge as a new Helm template function backed by Sprig 2.11.0

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Template execution now fails if an include template function cannot find the file it was trying to include
    • !helm install and helm update now fail with an error when a requirements.yaml dependency is not found in charts/, instead of printing a warning
70. v2.3.0 Apr 6, 2017 · release notes

    Helm v2.3.0 adds plugin manager, TLS between client and tiller, weighted hooks, new template functions, child chart value hoisting, skip-refresh flag, appVersion field, disabled plugin env var, and more

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.3.0

    └──▷ USE IT
    Install a community plugin directly from GitHub and list installed plugins
    shell copy

    helm plugin install https://github.com/adamreese/helm-last && helm plugin list

    Secure communications between the Helm client and Tiller server using TLS flags during initialization
    shell copy

    helm init --upgrade --tls --tls-ca-cert ca.pem --tls-cert cert.pem --tls-key key.pem

    • Adds helm plugin install, helm plugin list, and helm plugin remove commands for managing Helm plugins.
    • Supports TLS encryption between helm and tiller (via SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication.) with new flags passed through helm init.
    • Adds the required template function for marking parameters as required in Chart templates.
    • Adds the toToml template function alongside existing toYaml and toJson for configuration generation.
    • Enables hoisting values from child charts to parent charts via requirements.yaml.

    +6 more show less

    • Allows hooks to be weighted using the helm.sh/hookWeight annotation to control execution order.
    • Adds the --reuse-values flag to helm upgrade to reuse configuration from previous releases.
    • Adds two new fields to Chart.yaml: appVersion for specifying application version and deprecated to indicate unmaintained charts.
    • Adds the --skip-refresh flag to helm repo and helm init to prevent re-fetching repository index files.
    • Allows disabling the plugin system via an environment variable.
    • Adds the --url parameter to helm serve for specifying a base URL.

    11 details in Everything

71. v2.2.0 Feb 14, 2017 · release notes

    Helm v2.2.0 adds helm test command, --upgrade flag to helm init, and TLS client cert support for repositories

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.2.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.2.0

    └──▷ USE IT
    Run tests on a deployed release and cleanup resources if they fail.
    shell copy

    helm test <release-name> --cleanup-on-fail

    Upgrade the Tiller server component in place using the new upgrade flag.
    shell copy

    helm init --upgrade

    • Adds helm test subcommand to run test suites on a deployed release.
    • Adds --upgrade flag to helm init to easily upgrade the Tiller server component.
    • Extends chart repository configuration to support client SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS certificates for authentication.
    • Adds --wait flag to helm install and helm upgrade to wait until all resources are running.
    • Adds --namespace flag to helm list to filter release output by namespace.

    +9 more show less

    • Allows repositories.yaml to reference local file paths for dependencies.
    • Enables parent umbrella charts to enable or disable subcharts via the conditions and flags system in requirements.yaml.
    • Adds helm reset command to uninstall Tiller.
    • Validates Charts before sending them to Kubernetes.
    • Adds .Release.Revision, .Release.IsUpgrade, and .Release.IsInstall template fields.
    • Adds .Capabilities object in templates for querying cluster capabilities.
    • Adds fromYAML function in Helm templates.
    • Supports creating and upgrading Third Party Resources (TPRs).
    • Includes --cleanup-on-fail flag on the helm test command.

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Significant revision to the Go APIs inside of pkg/kube.
72. v2.1.2 Dec 21, 2016 · release notes

    Helm v2.1.2 adds nested globals support and enhanced dry-run debugging for install/upgrade

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.2 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.1.2

    └──▷ USE IT
    Preview how an upgrade will render templates before applying it, checking for errors or unexpected changes.
    shell copy

    helm upgrade myrelease ./mychart --dry-run --debug

    Validate a new chart installation by seeing the generated manifest without actually deploying.
    shell copy

    helm install myrelease ./mychart --dry-run --debug

    Use nested values in your chart's values.yaml which will now be correctly merged and accessible via .Values.global.foo.bar.
    text copy

    # In values.yaml:
    global:
      foo:
        bar: baz
    
    # In template:
    value: {{ .Values.global.foo.bar }}

    • helm upgrade --dry-run --debug now provides a preview of upgrades with detailed debug output.
    • helm install --dry-run --debug output has been improved for better visibility.
    • Globals in chart values files can now contain nested sections (deeply nested maps) instead of being restricted to flat name/value pairs.

    3 details in Everything

73. v2.1.0 Dec 14, 2016 · release notes

    Helm v2.1.0 adds plugin system, resource keep policy on delete, multiple values files, and SemVer 2 ranges

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.0 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.1.0

    └──▷ USE IT
    Fetch the provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. (.prov) file alongside a chart to verify its signature.
    shell copy

    helm fetch --prov stable/nginx-ingress

    Configure dependencies in requirements.yaml to allow any 1.x version using semver ranges.
    yaml copy

    version: '>=1.0.0 <2.0.0'

    Keep a PersistentVolumeClaim after helm delete by adding the annotation to the PVC template.
    yaml copy

    annotations:
      'helm.sh/resource-policy': keep

    • Adds helm fetch --prov to download chart provenance information alongside the chart archive
    • Extends Helm with a plugin system via feat(helm): add plugin system backend, allowing external commands written in any language
    • Allows annotating Kubernetes resources to be preserved during uninstall using resource-policy: keep in chart templates
    • Supports multiple -f / --values flags on install/upgrade commands to layer configuration from several files
    • Permits semver 2 version ranges (e.g., >=1.0.0 <2.0.0) in the version field of requirements.yaml dependencies

    +2 more show less

    • Exposes Files.Glob, AsSecrets, and AsConfig methods on the .Files object in templates to generate ConfigMaps and Secrets more easily
    • Adds a helm doc command to generate documentation for charts

    7 details in Everything

74. v2.0.0-rc.1 Prerelease Nov 2, 2016 · release notes

    Helm v2.0.0-rc.1 adds support for Kubernetes 3rd Party API objects and password-locked GPG keys.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0-rc.1 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0-rc.1

    • Enables Kubernetes 3rd Party API objects
    • Supports password-locked GPG keys via a password prompt
    • Adds --replace flag to helm install to append to release history

    3 details in Everything

75. v2.0.0-beta.1 Prerelease Oct 19, 2016 · release notes

    Helm v2.0.0-beta.1 adds --kube-context flag, gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. tracing for Tiller, and default repo fetch on helm repo add

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0-beta.1 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0-beta.1

    └──▷ USE IT
    Run Helm commands against a specific Kubernetes context without setting it in kubeconfig defaults.
    shell copy

    helm list --kube-context my-cluster

    Add a repository URL without triggering an immediate index fetch, useful for validating the URL first.
    shell copy

    helm repo add myrepo https://myrepo.example.com --no-update

    • Adds the --kube-context global flag to explicitly set the Kubernetes context
    • Adds optional gRPC tracing in Tiller for debugging (disabled by default)
    • Makes helm repo add fetch the repository content by default and introduces the --no-update flag to bypass this behavior

    3 details in Everything

76. v2.0.0-alpha.5 Prerelease Oct 10, 2016 · release notes

    Helm v2.0.0-alpha.5 introduces helm rollback, helm history, helm dependency commands and new template functions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0-alpha.5 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0-alpha.5

    └──▷ USE IT
    Revert a release named webapp to its previous successful deployment state or undelete a previously removed one.
    shell copy

    helm rollback <release_name>

    View the revision history for a specific release to identify when changes occurred.
    shell copy

    helm history <release_name>

    • Adds helm rollback command to revert a release to a previous version, including undeleting releases.
    • Introduces helm history subcommand to view the revision history of a specific release.
    • Adds helm dependency install and helm dependency update commands for managing chart dependencies via requirements.yaml.
    • Adds uuidv4 template function to generate random UUIDv4 values in charts.
    • Adds toYaml template function to encode Helm values into YAML format.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !helm update is renamed to helm repo update.
    • !The repository directory name kubernetes-charts is renamed to stable.
77. v2.0.0-alpha.4 Prerelease Sep 6, 2016 · release notes

    Helm v2.0.0-alpha.4 adds --sign/--verify for provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., ConfigMap storage backend, and enhanced helm status

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0-alpha.4 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0-alpha.4

    • helm package adds the --sign flag to create signed chart packages with a provenance file.
    • helm package, helm install, helm upgrade, helm rollout history, and other commands add the --verify flag for cryptographic integrity verification of packaged charts.
    • Release data now defaults to the ConfigMap storage backend in the kube-system namespace, making releases persistent across Tiller restarts.
    • helm status output has been overhauled to display detailed release information.

    4 details in Everything

78. v2.0.0-alpha.3 Prerelease Aug 10, 2016 · release notes

    Helm v2 adds helm upgrade, helm get, helm inspect, --replace, --name-template, and --strict linting with Tiller in ConfigMaps

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0-alpha.3 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0-alpha.3

    └──▷ USE IT
    Preview chart metadata and values before committing to an installation.
    shell copy

    helm inspect kube-charts/alpine-0.1.0

    • Adds the helm upgrade command to upgrade releases in place.
    • Adds helm status command with vastly improved information about release state.
    • Adds helm get, helm get values, helm get hooks, and helm get manifest commands for release information.
    • Allows Helm client configuration changes: the HELM_HOME storage backend can be set to use Kubernetes ConfigMaps instead of memory.
    • Adds helm inspect command to preview chart info (e.g., helm inspect kube-charts/alpine-0.1.0).

    +10 more show less

    • Enables Tiller to install into kube-system namespace and deploy charts to any namespace it has write access to.
    • Supports pre-install, post-install, pre-upgrade, post-upgrade, pre-delete, and post-delete hooks attached to Kubernetes jobs.
    • Exposes new template objects: .Files, .Release, .Template, .Chart alongside existing .Values. Uses {{.Files.Get("foo/info.yaml")}} syntax.
    • Adds include template function for importing templates (e.g., {{include "foo.tpl" | indent 4}}).
    • Tiller now runs as a Kubernetes Deployment instead of a Replication Controller.
    • helm delete now reaps related resources (e.g., deleting a Deployment also deletes ReplicaSet and Pods).
    • Adds --replace flag to helm install to reuse release names.
    • Adds --name-template flag to helm install for predictable auto-generated releases.
    • Enables passing install values via command line using helm install --set NAME=VALUE.
    • Adds --strict flag to helm lint.

    15 details in Everything

79. v2.0.0-alpha.2 Prerelease Jun 23, 2016 · release notes

    New features in v2.0.0-alpha.2 include helm install from repos, .helmignore support, and flexible Tiller installation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0-alpha.2 https://github.com/helm/helm.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0-alpha.2

    • helm install can now install directly from a chart repository
    • Helm charts now support .helmignore files to exclude files from packaging
    • Tiller component can be installed into any namespace instead of just helm
    • Values files are now in YAML format
    • Templates now use Sprig 2.3 with more functions

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !pkg/chart package has been removed; the import path is now k8s.io/helm