Helm 4.3

Apply these Helm 4.3 rules when building charts and deploying releases. Helm 4.3 supports Kubernetes 1.34 through 1.37; apply the included Kubernetes manifest rules to rendered templates, subcharts, and hooks. Review the exact chart and deployment identity that will be used in production.

Values, templates, and rendered resources

• Constrain values that affect image selection, privilege, network destinations, and resource names with values.schema.json. Validate the final merged values across subcharts; keep schema validation enabled and control any remote $ref destinations.
• Review the values assembled from chart defaults, multi-document values files, parent charts, and command-line overrides. Use typed input options where needed, and keep secrets out of --set arguments, source control, and CI logs.
• Render untrusted data as data. Do not evaluate user-controlled values or .Files content with tpl; it can invoke other template functions using the scope you supply.
• Limit lookup to specific required Kubernetes objects and give the rendering identity only those read rights. Use a server dry run only with a review of its cluster access; a client render cannot exercise live lookups.
• Keep --enable-dns off for untrusted charts. If template-time DNS is necessary, review the queried names and constrain egress from the Helm runner.
• Quote YAML strings, preserve intended numeric and boolean types, and check generated manifests at their actual sinks. Recheck annotations, labels, commands, and URLs after templating rather than assuming YAML validity is a