Helm 4.0 Everything you need to know about the biggest evolution of the Helm ecosystem

Helm is one of the main utilities within the Kubernetes ecosystem, and therefore the release of a new major version, such as Helm 4.0, is something to consider because it is undoubtedly something that will need to be analyzed, evaluated, and managed in the coming months.

Due to this, we will see many comments and articles around this topic, so we will try to shed some light.

Main New Features of Helm 4.0

According to the project itself in its announcement, Helm 4 introduces three major blocks of changes: new plugin system, better integration with Kubernetes ** and internal modernization of SDK and performance**.

New Plugin System (includes WebAssembly)

The plugin system has been completely redesigned, with a special focus on security through the introduction of a new WebAssembly runtime that, while optional, is recommended as it runs in a “sandbox” mode that offers limits and guarantees from a security perspective.

In any case, there is no need to worry excessively, as the “classic” plugins continue to work, but the message is clear: for security and extensibility, the direction is Wasm.

Server-Side Apply and Better Integration with Other Controllers

From this version, Helm 4 supports Server-Side Apply (SSA) through the --server-side flag, which has already become stable since Kubernetes version v1.22 and allows updates on objects to be handled server-side to avoid conflicts between different controllers managing the same resources.

It also incorporates integration with kstatus to ensure the state of a component in a more reliable way than what currently happens with the use of the --wait parameter.

Other Additional Improvements

Additionally, there is another list of improvements that, while of lesser scope, are important qualitative leaps, such as the following:

• Installation by digest in OCI registries: (helm install myapp oci://...@sha256:<digest>)
• Multi-document values: you can pass multiple YAML values in a single multi-doc file, facilitating complex environments/overlays.
• New --set-json argument that allows for easily passing complex structures compared to the current solution using the --set parameter
  

Why a Major (v4) and Not Another Minor of 3.x?

As explained in the official release post, there were features that the team could not introduce in v3 without breaking public SDK APIs and internal architecture:

• Strong change in the plugin system (WebAssembly, new types, deep integration with the core).
• Restructuring of Go packages and establishment of a stable SDK at helm.sh/helm/v4, code-incompatible with v3.
• Introduction and future evolution of Charts v3, which require the SDK to support multiple versions of chart APIs.
  

With all this, continuing in the 3.x branch would have violated SemVer: the major number change is basically “paying” the accumulated technical debt to be able to move forward.

Additionally, a new evolution of the charts is expected in the future, moving from v2 to a future v3 that is not yet fully defined, and currently, v2 charts run correctly in this new version.

Do I Have to Migrate to This New Version?

The short answer is: yes. And possibly the long answer is: yes, and quickly. In the official Helm 4 announcement, they specify the support schedule for Helm 3:

• Helm 3 bug fixes until July 8, 2026.
• Helm 3 security fixes until November 11, 2026.
• No new features will be backported to Helm 3 during this period; only Kubernetes client libraries will be updated to support new K8s versions.
  

Practical translation:

• You have ~1 year to plan a smooth migration to Helm 4 with bug support.
• After November 2026, continuing to use Helm 3 will become increasingly risky from a security and compatibility standpoint.
  

Best Practices for Migration

To carry out the migration, it is important to remember that it is perfectly possible and feasible to have both versions installed on the same machine or agent, so a “gradual” migration can be done to ensure that the end of support for version v3 is reached with everything migrated correctly, and for that, the following steps are recommended:

• Conduct an analysis of all Helm commands and usage from the perspective of integration pipelines, upgrade scripts, or even the import of Helm client libraries in Helm-based developments.
• Especially carefully review all uses of --post-renderer, helm registry login, --atomic, --force.
• After the analysis, start testing Helm 4 first in non-production environments, reusing the same charts and values, reverting to Helm 3 if a problem is detected until it is resolved.
• If you have critical plugins, explicitly test them with Helm 4 before making the global change.