Exploring Helm 4: New Features, Changes, and Implications for Kubernetes Users

Introduction

Helm, the popular package manager for Kubernetes, has reached a significant milestone with the release of version 4.0.0 on November 12, 2025, coinciding with KubeCon + CloudNativeCon North America 2025. This marks the first major version update in six years since Helm 3 in 2019, and it celebrates Helm's 10th anniversary as a key tool in the cloud-native ecosystem. Helm 4 builds on its predecessor's stability while introducing enhancements aimed at improving security, scalability, developer experience, and integration with modern Kubernetes practices. With Kubernetes adoption continuing to grow, Helm 4 addresses common pain points like CI/CD complexity (cited by 40% of users) and security concerns (37%), according to the CNCF 2024 Annual Survey.

Major New Features in Helm 4

Helm 4 introduces a host of features designed to enhance usability, security, and performance. Here's a breakdown of the most notable additions:

Redesigned Plugin System with WebAssembly (Wasm) Support

One of the standout changes is the complete overhaul of the plugin system. Helm 4 now supports WebAssembly-based plugins, which provide enhanced security by running in a sandboxed environment and improve portability across operating systems and architectures (e.g., Linux, macOS, Windows, and various ARM/Intel variants). This shift allows developers to extend Helm's functionality without compromising the core project's stability. Post-renderers, which modify Kubernetes manifests after rendering, are now implemented as plugins, streamlining customization.

For example, plugins can now be written in languages that compile to Wasm, making it easier to create secure extensions for tasks like validation or transformation without native binaries.

Server-Side Apply (SSA) as the Default Strategy

Helm 4 replaces the outdated "three-way merge" patching strategy with Kubernetes' native Server-Side Apply (SSA). This change moves conflict resolution logic to the Kubernetes API server, reducing chaos in environments where multiple tools (e.g., Helm charts, operators, and manual commands) manage the same resources. SSA promotes a more declarative approach, improving reliability in updates and upgrades.

This is particularly beneficial for production environments, as it aligns Helm with Kubernetes best practices introduced in version 1.22.

Improved Resource Status Watching with kstatus

Leveraging the Kubernetes kstatus library (unavailable at Helm 3's release), Helm 4 enhances how it monitors resource health during installations and upgrades. This allows Helm to better understand the status of a wider range of Kubernetes resources, leading to more accurate "wait" behaviors and reduced false positives in deployment failures.

OCI Digest Support and Content-Based Caching

Helm 4 adds support for OCI (Open Container Initiative) digests, enabling more secure and verifiable chart distributions. Additionally, content-based caching for charts improves performance by caching based on actual content rather than metadata, which is useful in CI/CD pipelines.

Multi-Document Values Files and JSON Arguments

Users can now use multi-document YAML values files, allowing for more flexible configuration management. Helm commands also support JSON arguments, simplifying automation and integration with scripting tools.

Modern Logging and SDK Enhancements

The SDK now uses Go's slog for logging, enabling integration with modern logging systems and supporting multiple loggers. Helm's commands are embeddable, allowing other applications to incorporate Helm functionality directly. Reproducible chart archives ensure consistent builds, aiding in security and compliance.

Experimental Chart v3 Support

Helm 4 lays the groundwork for a new experimental chart API version (v3), which will introduce advanced features during the Helm 4 lifecycle without breaking existing v2 charts.

Architectural Changes and Breaking Updates

Helm 4 includes several architectural shifts for long-term maintainability:

• Package Restructuring and Versioned Packages: The codebase has been reorganized, with moves to versioned packages to support future evolutions.
• CLI Flag Renaming: Some flags have been renamed for consistency, which may require updates to scripts and automation.
• Dropped Support for Legacy Kubernetes: Compatibility with Kubernetes versions 1.15 and earlier has been removed, cleaning up experimental APIs.

While existing v2 charts should work, users are advised to test thoroughly due to changes like SSA. The SDK has backward-incompatible changes, so plugins and integrations may need updates.

Patch releases like v4.0.4 (December 13, 2025) focus on bug fixes and security updates, with no new features added.

Implications for Users and Best Practices

For teams using Helm, upgrading to version 4 offers improved security and efficiency, especially in multi-tool Kubernetes environments. Start by testing in non-production setups, updating any custom plugins to Wasm where possible, and revising CI/CD pipelines to accommodate SSA and flag changes.

Helm 4's focus on stability and extensibility positions it well for the next decade of Kubernetes evolution, encouraging experimentation through its new plugin model while keeping the core reliable.

Conclusion

Helm 4 represents a thoughtful evolution of a mature tool, balancing innovation with backward compatibility. Released amid growing demands for secure and scalable Kubernetes operations, it equips users with modern features like Wasm plugins, SSA, and enhanced monitoring. As the cloud-native landscape advances, Helm 4 ensures that packaging and managing applications remains straightforward and robust.

For the full changelog and upgrade guides, visit the official Helm documentation. Stay tuned for future patches and the rollout of chart v3 features.