Helm 3.22

Apply these Helm 3.22 rules to chart authoring and release operations. This line supports Kubernetes 1.34 through 1.37; apply the included Kubernetes manifest rules to every rendered resource, including hooks and subcharts. Treat chart input, template execution, and the identity running Helm as separate trust boundaries.

Chart input and rendering

• Define a restrictive values.schema.json for security-sensitive values and validate the final merged .Values, including parent and subchart values. Do not use --skip-schema-validation to make a failing chart deploy; resolve and review remote $ref dependencies from trusted locations or vendor them.
• Review the effective values after values.yaml, parent overrides, -f files, and --set options merge. Use --set-string or --set-json when type interpretation matters, and do not place secrets in shell arguments or committed values files.
• Treat values and chart files as data. Never pass an untrusted value or .Files.Get result to tpl, which evaluates it as a Helm template with the supplied scope.
• Keep lookup calls narrow and grant the Helm identity only the Kubernetes read permissions those calls need. A server dry run can contact the cluster and execute lookup; a client render cannot prove cluster-dependent behavior.
• Leave --enable-dns disabled for untrusted charts; if a chart requires template-time DNS lookups, restrict the runner's egress and review the names it resolves.
• Quote string values at YAML string sinks and render numeric and boolean fields with the intended type. Validate rendered