Helm 3.21

Last reviewed Sep 20, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Kubernetes Manifests 1.36126 lines · 5.1K tokens
  2. Helm 3.2199 lines · 4.9K tokens
Total225 lines · 10K tokens

CWE Coverage

  • 15
  • 20
  • 59
  • 73
  • 78
  • 94
  • 201
  • 214
  • 250
  • 269
  • 287
  • 295
  • 306
  • 312
  • 319
  • 347
  • 400
  • 459
  • 494
  • 522
  • 526
  • 532
  • 538
  • 610
  • 613
  • 636
  • 732
  • 770
  • 778
  • 807
  • 829
  • 863
  • 918
  • 923
  • 1395

Prompt Preview

Apply the Kubernetes Manifests 1.36 prompt first. These rules cover Helm 3.21, using 3.21.4 behavior, for charts, values, rendering, dependencies, provenance, hooks, CRDs, plugins, post-renderers, release storage, and rollout. These rules target Kubernetes 1.36; Helm's broader client compatibility does not make the included 1.36 manifest rules portable to older clusters.

Version scope and client compatibility

  • Run Helm 3.21 only against Kubernetes 1.33 through 1.36; the binary is built on the 1.36 client libraries and Helm publishes no forward-compatibility guarantee against a newer API server.
  • Install the newest patch release of the Helm minor you run, the same release on CI runners, release images, and workstations, taking its version from the Helm releases page rather than memory, or leaving a placeholder that fails the job when you can't check it there, and authenticate official binary downloads with the release signatures.
  • Move production deployments off the superseded 3.21 line. Helm 3.22 is the final Helm 3 minor, the maintenance policy follows the most recent minor, and Helm 3 security support ends February 10, 2027; do not assume fixes will be backported to 3.21 or defer migration to Helm 4 beyond that deadline.
  • When you build Helm from source, use the tagged dependency set of the release you deploy and a patched Go toolchain that satisfies its go.mod minimum (go 1.26.0 for 3.21.4); using the distributed Helm binary does not require a separately installed Go runtime.
  • Remove baltocdn.com from APT sources, images, and bootstrap scripts. Use the