Skip to content

Conversation

@aditmeno
Copy link
Contributor

@aditmeno aditmeno commented Nov 15, 2025

Summary

This PR adds Helm 4.0.0 support to chartify while maintaining Helm 3 compatibility. Users can now use either Helm 3 or Helm 4, with automatic detection or explicit configuration.

Key Features

Dual Helm Version Support

  • Supports both Helm 3 (v3.19.2) and Helm 4 (v4.0.0)
  • Automatic version detection from helm version --template={{.Version}}+g{{.GitCommit}}
  • Explicit opt-in via UseHelm3(true) or UseHelm4(true)
  • Environment variable support: HELM_X_HELM3 or HELM_X_HELM4

CI Matrix Testing

  • Tests run against both Helm 3.19.0 and Helm 4.0.0 in parallel
  • Ensures dual version support works correctly
  • Catches version-specific issues early

Changes Made

Dependency Updates

  • ✅ Added helm.sh/helm/v3 v3.19.2 alongside helm.sh/helm/v4 v4.0.0 in go.mod
  • ✅ Both packages coexist with aliased imports where needed
  • ✅ Updated golangci-lint to v2.6.2 in CI workflow
  • ✅ Updated Kustomize to v5.8.0 in CI workflow

Core Implementation

runner.go:

  • ✅ Added isHelm3 field back alongside isHelm4
  • ✅ Restored UseHelm3() and IsHelm3() functions
  • ✅ Updated DetectHelmVersion() to use --template={{.Version}}+g{{.GitCommit}} (compatible with both versions)

chartify.go:

  • ✅ Imports both registry packages with aliases (registryv3, registryv4)
  • ✅ Runtime version detection for OCI registry checks

patch.go, replace.go, requirements.go:

  • ✅ Updated checks to support both Helm 3 and 4: if r.IsHelm3() || r.IsHelm4()
  • ✅ Both versions use modern Helm features (crds directory, template syntax, Chart.yaml dependencies)

chartrepo/server.go:

  • ✅ Added dual imports for both Helm 3 and Helm 4 packages (loader, provenance, repo)
  • ✅ Added version detection methods: detectHelmVersion(), IsHelm3(), IsHelm4()
  • ✅ Split Run() into runHelm3() and runHelm4() for version-specific logic
  • ✅ Created version-specific addToIndexFileHelm3() and addToIndexFileHelm4() functions
  • ✅ Extracted HTTP server logic into startHTTPServer() method
  • ✅ Supports HELM_X_HELM3 and HELM_X_HELM4 environment variables
  • ✅ Added comprehensive test suite in chartrepo/server_test.go

cmd/chartify/main.go, tests:

  • ✅ Removed hardcoded UseHelm4(true) calls
  • ✅ All code now uses auto-detection for maximum compatibility

CI/CD Improvements

GitHub Actions:

  • ✅ Matrix strategy tests both Helm 3.19.0 and 4.0.0
  • ✅ Parallel test execution for both versions
  • ✅ Job names show which Helm version is being tested
  • ✅ Updated golangci-lint to v2.6.2

API Compatibility

No Breaking Changes - All existing APIs are maintained:

Feature Helm 3 Helm 4 Status
UseHelm3(bool) Available
UseHelm4(bool) Available
IsHelm3() Available
IsHelm4() Available
HELM_X_HELM3 env var Supported
HELM_X_HELM4 env var Supported
Auto-detection Default behavior

Usage Examples

Auto-detection (Recommended - Default)

r := chartify.New(chartify.HelmBin("helm"))
// Automatically detects Helm version from `helm version`

Explicit Helm 3

r := chartify.New(chartify.UseHelm3(true), chartify.HelmBin("helm"))

Explicit Helm 4

r := chartify.New(chartify.UseHelm4(true), chartify.HelmBin("helm"))

Environment Variable

export HELM_X_HELM3=1  # Force Helm 3 mode
# or
export HELM_X_HELM4=1  # Force Helm 4 mode

Testing

  • ✅ All existing tests pass with both Helm versions
  • ✅ CI matrix tests both Helm 3.19.0 and Helm 4.0.0 in parallel
  • ✅ Auto-detection verified with helm version --template={{.Version}}+g{{.GitCommit}}
  • ✅ Manual testing with Helm 3 and Helm 4 binaries
  • ✅ Removed all hardcoded version preferences from tests and CLI
  • ✅ Added comprehensive chartrepo server tests for version detection and functionality

Migration Guide

For Current Users

No action required! The library will auto-detect your Helm version and work accordingly.

For Users Wanting to Upgrade to Helm 4

  1. Install Helm 4.0.0 or later
  2. Optionally use UseHelm4(true) for explicit Helm 4 mode
  3. Or rely on auto-detection (recommended)

For Users Wanting to Stay on Helm 3

  1. Continue using Helm 3 (no changes needed)
  2. Optionally use UseHelm3(true) for explicit Helm 3 mode
  3. Or rely on auto-detection (recommended)

Commits

  1. e683599 - feat: Add Helm 3 support alongside Helm 4
  2. 8d986ac - ci: Add matrix testing for both Helm 3 and Helm 4
  3. f0783a2 - fix: Remove hardcoded Helm version from tests and CLI
  4. ed0a35b - feat: Add Helm 3 and Helm 4 support to chartrepo server

Related


Signed-off-by: Aditya Menon amenon@canarytechnologies.com

@aditmeno
Copy link
Contributor Author

@yxxhero Could you review my PR?

aditmeno added a commit to aditmeno/helmfile that referenced this pull request Nov 15, 2025
This change migrates helmfile from Helm 3 to Helm 4, following Helm 3's
end-of-life announcement and the stable release of Helm 4.0.0.

Changes:
- Update go.mod dependency from helm.sh/helm/v3 to helm.sh/helm/v4 v4.0.0
- Update all imports to use Helm 4 versioned packages (pkg/chart/v2)
- Rename IsHelm3() to IsHelm4() with exact version check (== 4)
- Update error messages to require "helm 4.x or later"
- Fix --force-update flag to only apply to Helm 3.x (>= 3.3.2, < 4.0.0)
  as it became default behavior in Helm 4
- Reimplement GetPluginVersion() to avoid Helm 4 internal packages

Infrastructure updates:
- CI: Update to Helm v4.0.0, kubectl v1.34.2, kustomize v5.8.0
- CI: Update helm-secrets to v4.6.11, helm-diff to v3.13.2
- Dockerfiles: Update all three variants (alpine, debian, ubuntu) with
  latest tool versions and SHA256 checksums
- Documentation: Update to reflect Helm 4.x requirement

Breaking changes:
- Helmfile now requires Helm 4.x or later
- Helm 3.x is no longer supported

Dependencies:
- Requires chartify Helm 4 support: helmfile/chartify#158

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
aditmeno added a commit to aditmeno/helmfile that referenced this pull request Nov 15, 2025
This change migrates helmfile from Helm 3 to Helm 4, following Helm 3's
end-of-life announcement and the stable release of Helm 4.0.0.

Changes:
- Update go.mod dependency from helm.sh/helm/v3 to helm.sh/helm/v4 v4.0.0
- Update all imports to use Helm 4 versioned packages (pkg/chart/v2)
- Rename IsHelm3() to IsHelm4() with exact version check (== 4)
- Update error messages to require "helm 4.x or later"
- Fix --force-update flag to only apply to Helm 3.x (>= 3.3.2, < 4.0.0)
  as it became default behavior in Helm 4
- Reimplement GetPluginVersion() to avoid Helm 4 internal packages
- Handle missing plugins directory gracefully in GetPluginVersion()
- Fix azcli debug output to avoid trailing space

Infrastructure updates:
- CI: Update to Helm v4.0.0, kubectl v1.34.2, kustomize v5.8.0
- CI: Update helm-secrets to v4.6.11, helm-diff to v3.13.2
- Dockerfiles: Update all three variants (alpine, debian, ubuntu) with
  latest tool versions and SHA256 checksums
- Dockerfiles: Add --verify=false flag for Helm 4 plugin installation
- Plugins: Update helm-s3 to v0.17.0, helm-git to v1.4.1
- Documentation: Update to reflect Helm 4.x requirement

Breaking changes:
- Helmfile now requires Helm 4.x or later
- Helm 3.x is no longer supported

Dependencies:
- Requires chartify Helm 4 support: helmfile/chartify#158

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
@aditmeno aditmeno force-pushed the feat/helm-4-support branch from 874ee31 to a0cf3be Compare November 15, 2025 21:44
aditmeno added a commit to aditmeno/helmfile that referenced this pull request Nov 15, 2025
BREAKING CHANGE: This release migrates from Helm 3 to Helm 4.

Helm 3 has reached end-of-life, and this migration ensures continued
support and security updates. This is a breaking change that requires
Helm 4.x or later to be installed.

Changes:
- Update go.mod from helm.sh/helm/v3 to helm.sh/helm/v4 v4.0.0
- Update all imports to use Helm 4 versioned packages (e.g., pkg/chart/v2)
- Rename IsHelm3() to IsHelm4() with exact version check (== 4, not >=)
- Update CI workflows to use Helm v4.0.0
- Update all Dockerfiles with latest tool versions and SHA256 checksums:
  - Helm v4.0.0
  - kubectl v1.34.2
  - kustomize v5.8.0
  - minikube v1.37.0
- Update documentation to require "helm 4.x or later"
- Disable Go build cache in CI to prevent disk space issues
- Implement smart plugin verification with security enforcement option:
  - Try verification first, fall back to --verify=false if unsupported
  - Add --enforce-plugin-verification flag for security-sensitive environments
- Remove force-update logic since it's the default behavior in Helm 4:
  - Remove DisableForceUpdate field from App struct
  - Remove DisableForceUpdate from ConfigProvider interface
  - Remove --disable-force-update CLI flag
  - Update tests to reflect Helm 4 behavior
- Update Go version to 1.25.4
- Fix golangci-lint to v2.6.2 for Go 1.25.4 compatibility

Migration notes:
- Users must upgrade to Helm 4.x or later
- The --disable-force-update flag has been removed (force-update is now default)
- Plugin verification is attempted by default, with automatic fallback to --verify=false
- Use --enforce-plugin-verification flag to require signed plugins for security

Related PRs:
- Depends on chartify PR: helmfile/chartify#158

Files changed: 40 files with +291/-271 lines

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
aditmeno added a commit to aditmeno/helmfile that referenced this pull request Nov 15, 2025
BREAKING CHANGE: This release migrates from Helm 3 to Helm 4.

Helm 3 has reached end-of-life, and this migration ensures continued
support and security updates. This is a breaking change that requires
Helm 4.x or later to be installed.

Changes:
- Update go.mod from helm.sh/helm/v3 to helm.sh/helm/v4 v4.0.0
- Update all imports to use Helm 4 versioned packages (e.g., pkg/chart/v2)
- Rename IsHelm3() to IsHelm4() with exact version check (== 4, not >=)
- Update CI workflows to use Helm v4.0.0
- Update all Dockerfiles with latest tool versions and SHA256 checksums:
  - Helm v4.0.0
  - kubectl v1.34.2
  - kustomize v5.8.0
  - minikube v1.37.0
- Update documentation to require "helm 4.x or later"
- Disable Go build cache in CI to prevent disk space issues
- Implement smart plugin verification with security enforcement option:
  - Try verification first, fall back to --verify=false if unsupported
  - Add --enforce-plugin-verification flag for security-sensitive environments
- Remove force-update logic since it's the default behavior in Helm 4:
  - Remove DisableForceUpdate field from App struct
  - Remove DisableForceUpdate from ConfigProvider interface
  - Remove --disable-force-update CLI flag
  - Update tests to reflect Helm 4 behavior
- Update Go version to 1.25.4
- Fix golangci-lint to v2.6.2 for Go 1.25.4 compatibility

Migration notes:
- Users must upgrade to Helm 4.x or later
- The --disable-force-update flag has been removed (force-update is now default)
- Plugin verification is attempted by default, with automatic fallback to --verify=false
- Use --enforce-plugin-verification flag to require signed plugins for security

Related PRs:
- Depends on chartify PR: helmfile/chartify#158

Files changed: 40 files with +291/-271 lines

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
aditmeno added a commit to aditmeno/helmfile that referenced this pull request Nov 15, 2025
BREAKING CHANGE: This release migrates from Helm 3 to Helm 4.

Helm 3 has reached end-of-life, and this migration ensures continued
support and security updates. This is a breaking change that requires
Helm 4.x or later to be installed.

Changes:
- Update go.mod from helm.sh/helm/v3 to helm.sh/helm/v4 v4.0.0
- Update all imports to use Helm 4 versioned packages (e.g., pkg/chart/v2)
- Rename IsHelm3() to IsHelm4() with exact version check (== 4, not >=)
- Update CI workflows to use Helm v4.0.0
- Update all Dockerfiles with latest tool versions and SHA256 checksums:
  - Helm v4.0.0
  - kubectl v1.34.2
  - kustomize v5.8.0
  - minikube v1.37.0
- Update documentation to require "helm 4.x or later"
- Disable Go build cache in CI to prevent disk space issues
- Implement smart plugin verification with security enforcement option:
  - Try verification first, fall back to --verify=false if unsupported
  - Add --enforce-plugin-verification flag for security-sensitive environments
- Remove force-update logic since it's the default behavior in Helm 4:
  - Remove DisableForceUpdate field from App struct
  - Remove DisableForceUpdate from ConfigProvider interface
  - Remove --disable-force-update CLI flag
  - Update tests to reflect Helm 4 behavior
- Update Go version to 1.25.4
- Fix golangci-lint to v2.6.2 for Go 1.25.4 compatibility

Migration notes:
- Users must upgrade to Helm 4.x or later
- The --disable-force-update flag has been removed (force-update is now default)
- Plugin verification is attempted by default, with automatic fallback to --verify=false
- Use --enforce-plugin-verification flag to require signed plugins for security

Related PRs:
- Depends on chartify PR: helmfile/chartify#158

Files changed: 40 files with +291/-271 lines

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
aditmeno added a commit to aditmeno/helmfile that referenced this pull request Nov 15, 2025
BREAKING CHANGE: This release migrates from Helm 3 to Helm 4.

Helm 3 has reached end-of-life, and this migration ensures continued
support and security updates. This is a breaking change that requires
Helm 4.x or later to be installed.

Changes:
- Update go.mod from helm.sh/helm/v3 to helm.sh/helm/v4 v4.0.0
- Update all imports to use Helm 4 versioned packages (e.g., pkg/chart/v2)
- Rename IsHelm3() to IsHelm4() with exact version check (== 4, not >=)
- Update CI workflows to use Helm v4.0.0
- Update all Dockerfiles with latest tool versions and SHA256 checksums:
  - Helm v4.0.0
  - kubectl v1.34.2
  - kustomize v5.8.0
  - minikube v1.37.0
- Update documentation to require "helm 4.x or later"
- Disable Go build cache in CI to prevent disk space issues
- Implement smart plugin verification with security enforcement option:
  - Try verification first, fall back to --verify=false if unsupported
  - Add --enforce-plugin-verification flag for security-sensitive environments
- Remove force-update logic since it's the default behavior in Helm 4:
  - Remove DisableForceUpdate field from App struct
  - Remove DisableForceUpdate from ConfigProvider interface
  - Remove --disable-force-update CLI flag
  - Update tests to reflect Helm 4 behavior
- Update Go version to 1.25.4
- Fix golangci-lint to v2.6.2 for Go 1.25.4 compatibility

Migration notes:
- Users must upgrade to Helm 4.x or later
- The --disable-force-update flag has been removed (force-update is now default)
- Plugin verification is attempted by default, with automatic fallback to --verify=false
- Use --enforce-plugin-verification flag to require signed plugins for security

Related PRs:
- Depends on chartify PR: helmfile/chartify#158

Files changed: 40 files with +291/-271 lines

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
aditmeno added a commit to aditmeno/helmfile that referenced this pull request Nov 15, 2025
BREAKING CHANGE: This release migrates from Helm 3 to Helm 4.

Helm 3 has reached end-of-life, and this migration ensures continued
support and security updates. This is a breaking change that requires
Helm 4.x or later to be installed.

Changes:
- Update go.mod from helm.sh/helm/v3 to helm.sh/helm/v4 v4.0.0
- Update all imports to use Helm 4 versioned packages (e.g., pkg/chart/v2)
- Rename IsHelm3() to IsHelm4() with exact version check (== 4, not >=)
- Update CI workflows to use Helm v4.0.0
- Update all Dockerfiles with latest tool versions and SHA256 checksums:
  - Helm v4.0.0
  - kubectl v1.34.2
  - kustomize v5.8.0
  - minikube v1.37.0
- Update documentation to require "helm 4.x or later"
- Disable Go build cache in CI to prevent disk space issues
- Implement smart plugin verification with security enforcement option:
  - Try verification first, fall back to --verify=false if unsupported
  - Add --enforce-plugin-verification flag for security-sensitive environments
- Remove force-update logic since it's the default behavior in Helm 4:
  - Remove DisableForceUpdate field from App struct
  - Remove DisableForceUpdate from ConfigProvider interface
  - Remove --disable-force-update CLI flag
  - Update tests to reflect Helm 4 behavior
- Update Go version to 1.25.4
- Fix golangci-lint to v2.6.2 for Go 1.25.4 compatibility

Migration notes:
- Users must upgrade to Helm 4.x or later
- The --disable-force-update flag has been removed (force-update is now default)
- Plugin verification is attempted by default, with automatic fallback to --verify=false
- Use --enforce-plugin-verification flag to require signed plugins for security

Related PRs:
- Depends on chartify PR: helmfile/chartify#158

Files changed: 40 files with +291/-271 lines

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
@aditmeno aditmeno force-pushed the feat/helm-4-support branch from 048a964 to 56b3a39 Compare November 15, 2025 23:19
aditmeno added a commit to aditmeno/helmfile that referenced this pull request Nov 15, 2025
BREAKING CHANGE: This release migrates from Helm 3 to Helm 4.

Helm 3 has reached end-of-life, and this migration ensures continued
support and security updates. This is a breaking change that requires
Helm 4.x or later to be installed.

Changes:
- Update go.mod from helm.sh/helm/v3 to helm.sh/helm/v4 v4.0.0
- Update all imports to use Helm 4 versioned packages (e.g., pkg/chart/v2)
- Rename IsHelm3() to IsHelm4() with exact version check (== 4, not >=)
- Update CI workflows to use Helm v4.0.0
- Update all Dockerfiles with latest tool versions and SHA256 checksums:
  - Helm v4.0.0
  - kubectl v1.34.2
  - kustomize v5.8.0
  - minikube v1.37.0
- Update documentation to require "helm 4.x or later"
- Disable Go build cache in CI to prevent disk space issues
- Implement smart plugin verification with security enforcement option:
  - Try verification first, fall back to --verify=false if unsupported
  - Add --enforce-plugin-verification flag for security-sensitive environments
- Remove force-update logic since it's the default behavior in Helm 4:
  - Remove DisableForceUpdate field from App struct
  - Remove DisableForceUpdate from ConfigProvider interface
  - Remove --disable-force-update CLI flag
  - Update tests to reflect Helm 4 behavior
- Update Go version to 1.25.4
- Fix golangci-lint to v2.6.2 for Go 1.25.4 compatibility

Migration notes:
- Users must upgrade to Helm 4.x or later
- The --disable-force-update flag has been removed (force-update is now default)
- Plugin verification is attempted by default, with automatic fallback to --verify=false
- Use --enforce-plugin-verification flag to require signed plugins for security

Related PRs:
- Depends on chartify PR: helmfile/chartify#158

Files changed: 40 files with +291/-271 lines

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
@aditmeno aditmeno force-pushed the feat/helm-4-support branch from 56b3a39 to e8db50a Compare November 15, 2025 23:33
aditmeno added a commit to aditmeno/helmfile that referenced this pull request Nov 15, 2025
BREAKING CHANGE: This release migrates from Helm 3 to Helm 4.

Helm 3 has reached end-of-life, and this migration ensures continued
support and security updates. This is a breaking change that requires
Helm 4.x or later to be installed.

Changes:
- Update go.mod from helm.sh/helm/v3 to helm.sh/helm/v4 v4.0.0
- Update all imports to use Helm 4 versioned packages (e.g., pkg/chart/v2)
- Rename IsHelm3() to IsHelm4() with exact version check (== 4, not >=)
- Update CI workflows to use Helm v4.0.0
- Update all Dockerfiles with latest tool versions and SHA256 checksums:
  - Helm v4.0.0
  - kubectl v1.34.2
  - kustomize v5.8.0
  - minikube v1.37.0
- Update documentation to require "helm 4.x or later"
- Disable Go build cache in CI to prevent disk space issues
- Implement smart plugin verification with security enforcement option:
  - Try verification first, fall back to --verify=false if unsupported
  - Add --enforce-plugin-verification flag for security-sensitive environments
- Remove force-update logic since it's the default behavior in Helm 4:
  - Remove DisableForceUpdate field from App struct
  - Remove DisableForceUpdate from ConfigProvider interface
  - Remove --disable-force-update CLI flag
  - Update tests to reflect Helm 4 behavior
- Update Go version to 1.25.4
- Fix golangci-lint to v2.6.2 for Go 1.25.4 compatibility

Migration notes:
- Users must upgrade to Helm 4.x or later
- The --disable-force-update flag has been removed (force-update is now default)
- Plugin verification is attempted by default, with automatic fallback to --verify=false
- Use --enforce-plugin-verification flag to require signed plugins for security

Related PRs:
- Depends on chartify PR: helmfile/chartify#158

Files changed: 40 files with +291/-271 lines

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
@yxxhero
Copy link
Member

yxxhero commented Nov 16, 2025

@aditmeno why remove helm v3? we should suport helm v3 and helm v4. maybe we can remove helm v3 when helm v4 is stable.

@aditmeno aditmeno changed the title feat: Add Helm 4 support and remove Helm 3 feat: Add Helm 4 support alongside Helm 3 Nov 16, 2025
@aditmeno
Copy link
Contributor Author

@aditmeno why remove helm v3? we should suport helm v3 and helm v4. maybe we can remove helm v3 when helm v4 is stable.

I had only seen this - https://helm.sh/docs/topics/version_skew/ where it seemed like 3.19 was dropped, adding back the helm 3 config

@yxxhero
Copy link
Member

yxxhero commented Nov 16, 2025

@aditmeno please fix ci.

@aditmeno
Copy link
Contributor Author

@aditmeno please fix ci.

The CI error comes from kustomize not supporting helm v4 yet, I've marked the test to be skipped for helm 4

We can add it back after a new kustomize version has been released

@aditmeno aditmeno force-pushed the feat/helm-4-support branch from 20e0936 to 1ad2b51 Compare November 16, 2025 03:40
This commit introduces comprehensive support for both Helm 3 and Helm 4:

- Added version-specific handling in chartify and chartrepo server
- Implemented OCIPlainHTTP option for Helm 4 OCI support
- Updated CI to run matrix tests for both Helm versions
- Removed hardcoded Helm version references from tests and CLI
- Updated Helm 3 version to 3.19.2 in CI
- Skipped kustomize test for Helm 4 due to incompatibility
- Updated documentation with latest version references

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
@aditmeno aditmeno force-pushed the feat/helm-4-support branch from 1ad2b51 to 21771a3 Compare November 16, 2025 03:51
@yxxhero
Copy link
Member

yxxhero commented Nov 16, 2025

see: kubernetes-sigs/kustomize#6013

@yxxhero yxxhero merged commit 592f163 into helmfile:master Nov 16, 2025
4 checks passed
@yxxhero
Copy link
Member

yxxhero commented Nov 16, 2025

@aditmeno v0.26.0 released.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants