Cloud Native

Helm v4: Wasm plugins, OCI digest-first charts, and multi-doc values

Helm v4 stabilizes Wasm plugins, OCI digest-first chart references, and multi-doc values — shifts affecting plugin security, chart immutability, and CI workflows.

August 6, 2026·3 min read·AI researched · AI written · AI reviewed

Helm’s v4 train is no longer experimental theatre  v4.2.2 is the current stable release and the docs make it explicit that Wasm-based plugins, OCI digest support, multi-doc values, and JSON arguments are the direction of travel. The next milestone, v4.3.0, is already slated for September 2026, and the project still carries v4.0.0-beta.1 artifacts for testing. If you run a platform team or maintain chart pipelines, treat this like a platform policy shift, not a minor bump.

The practical consequences are sharp and immediate. Wasm-based plugins change the attack surface and the operational model for Helm extensions. Wasm gives plugin authors a safer runtime sandbox and makes cross-language authorship trivial  Rust, Go, and other languages that compile to Wasm can produce first-class plugins. That’s excellent for portability and security, but it also means your existing shell- or Go-based plugin ecosystem (and any ad-hoc helpers you installed into CI images) will start to look legacy. The redesigned plugin system is not just a nicer API; it changes installation locations, lifecycle hooks, and how plugins are discovered and invoked. Expect some breakage in naive CI setups.

OCI digest support is the second big change with real-world fallout. Helm has been publishing charts to OCI registries for a while; v4 codifies digest-aware semantics and encourages reproducible references (sha256:digest) over mutable tags. Platform teams should stop relying on floating tags for critical deployments. Pin charts by digest in your release pipelines and update your promotion workflows to push and propagate digests instead of tags. Registry permissions, promotion tooling, and artifact storage will need to track digests, not just tags.

Multi-doc values and JSON arguments look like ergonomics, but they change how automation marshals configuration. Chart inputs can now include multiple YAML documents as values and accept JSON arguments without brittle shell escaping. That reduces templating hacks but means some CI scripts that parsed or patched single-document values.yaml files will break. Audit any automation that mutates values files, and migrate to Helm’s new flags or JSON input where possible.

Platform teams should also note smaller but meaningful transitions mentioned in the docs and changelog: kstatus watcher improvements and a migration to a slog-based structured logging backend. These affect observability of Helm operations and how you collect plugin telemetry.

If you want a deep look at the docs and the migration guidance, Helm’s site and changelog are explicit about which behaviors changed. Pair that reading with a dry-run of your release pipeline under v4.2.2. For background and migration notes I wrote earlier, see Helm 4: WebAssembly plugins, OCI digests, kstatus watcher, and slog migration.

The migration friction you can't ignore

This is overdue and it will hurt teams that treat Helm as a CLI-only tool. Platform and IDP teams must act now: inventory plugins, rebuild any custom plugins as Wasm (or vendor them if you must), switch chart references to digests, and update CI images to include the v4 plugin discovery path. If you run image scanners, add Wasm binary scanning to your pipeline. If you publish charts into a centralized registry, change promotion policies to record and propagate digests. None of this is glamorous, but leaving it for later means an emergency migration when a deprecated plugin breaks a production rollout.

Helm v4 is signaling a maturity pivot: reproducibility and safer plugin runtimes win. In 12 months registries, IDPs, and chart authors will operate as if digests are the only correct way to publish; those who adopt the change early will avoid the messy, last-minute migrations. If your team still treats Helm like a developer convenience and not core supply-chain infrastructure, this release should be the moment you change that mind.

Sources

helmhelm-4wasm-pluginsoci-digests
← All articles
Cloud Native

Kubeflow & Cloud Native Buildpacks Graduate to CNCF; Follow OpenTelemetry Mesh Observability Guidance

CNCF graduated Kubeflow and Cloud Native Buildpacks. Platform teams must operationalize them and follow OpenTelemetry mesh guidance to prevent tracing errors.

Aug 24, 2026·3mkubeflowcloud-native-buildpacks
Cloud Native

Kubeflow CNCF Graduation: What Platform Teams Must Do to Run Production AI/ML on Kubernetes

Kubeflow's CNCF graduation marks it production-ready for end-to-end AI/ML on Kubernetes. Platform teams must treat Kubeflow as auditable, first-class infra.

Aug 22, 2026·3mkubeflowcncf
Cloud Native

Cilium and Istio Interoperability: set bpf-lb-sock-hostns-only in Flux HelmRelease

Enable bpf-lb-sock-hostns-only=true in your Flux HelmRelease when running Cilium with Istio. Update runbooks to use Hubble, cilium-dbg, and connectivity tests.

Aug 21, 2026·3mciliumistio