Blog on Helm

COVID-19: Extending Helm v2 Bug Fixes

Fri, 03 Apr 2020 00:00:00 +0000

As our world comes together to fight the global pandemic, the Helm maintainers want to ensure that we’re doing our part to help you maintain your critical systems while they are operating at peak demand in a time where normal development and operation schedules have had to be adjusted. When Helm v3 was released in November 2019, our original commitment was that we would offer six months of Helm v2 bug fixes, which would end May 13, 2020, followed by six more months of security fixes for Helm v2.

Helm at KubeCon + CloudNativeCon NA 2019

Fri, 15 Nov 2019 00:00:00 +0000

Next week is the annual KubeCon and CloudNativeCon in North America. The Helm project and maintainers have several things going on and we wanted to invite you to them. Helm will have two maintainer track sessions that focus on an Introduction to Helm and a Helm 3 Deep Dive. Anyone who is new to Helm or would be interested in learning how and why they should use Helm, please consider attending the Introduction to Helm.

Helm 3.0.0 has been released!

Wed, 13 Nov 2019 00:00:00 +0000

The Helm Team is proud to announce the first stable release of Helm 3. Helm 3 is the latest major release of the CLI tool. Helm 3 builds upon the success of Helm 2, continuing to meet the needs of the evolving ecosystem. The internal implementation of Helm 3 has changed considerably from Helm 2. The most apparent change is the removal of Tiller, but it’s worth checking out the other changes by diving into the new release.

Helm Community Management

Mon, 11 Nov 2019 00:00:00 +0000

Devstats and stats on GitHub are able to capture many different types of contributions to an open source project. But there is one type of contribution for which we have yet to figure out a good metric, and it has been essential for Helm’s success. That is community management. Karen Chu has handled community management for Helm since the project was first announced at the inaugural KubeCon in San Francisco.

Helm Security Audit Results

Mon, 04 Nov 2019 00:00:00 +0000

Today, the Helm Maintainers are proud to announce that we have successfully completed a 3rd party security audit for Helm 3. Helm has been recommended for public deployment. A security audit is part of the graduation criteria for CNCF projects. Specifically, the graduation criteria says: Have completed an independent and third party security audit with results published of similar scope and quality as the following example (including critical vulnerabilities addressed): https://github.

Helm Vulnerability: Client Loading and Packaging Chart Directory Containing Malicious Symlinked Content [CVE-2019-18658]

Wed, 30 Oct 2019 00:00:00 +0000

Part of the process for Helm to become a graduated CNCF project is to complete an independent and third party security audit with the results being published. As part of the audit of Helm 3 a security issue was found that also impacts Helm v2. Cure53 performed the audit and found the issue. More about the audit will be covered in a future post. The vulnerability found impacts all versions of Helm between Helm >=2.

Helm 2.15.0 Released

Tue, 22 Oct 2019 00:00:00 +0000

Helm 2.15.0 was released last week. The 2.15.0 release of Helm introduces several improvements to helm test. Several commands - helm search, helm repo list, and helm install - received the --output flag for machine-readable output. In addition to these new features (and many more!), many bugs and edge cases in Helm continue to fixed by members of the community. Several parts of the codebase have been refactored for easier maintainability, usability, and better testing.

How to migrate from Helm v2 to Helm v3

Wed, 11 Sep 2019 00:00:00 +0000

One of the most important parts of upgrading to a new major release of Helm is the migration of data. This is especially true of Helm v2 to v3 considering the architectural changes between the releases. This is where the helm-2to3 plugin comes in. It helps with this migration by supporting: Migration of Helm v2 configuration. Migration of Helm v2 releases. Clean up Helm v2 configuration, release data and Tiller deployment.

Helm v3 Beta 1 Released

Tue, 27 Aug 2019 00:00:00 +0000

Helm v3 development has hit a new milestone with the release of the first beta. This is an especially important milestone because it is the end of the effort to refactor Helm v3. The last of the intended breaking changes has landed. From this point on, Helm v3 is focused on bug fixes, stability, and preparing it for a stable release. If you are interested in Helm v3 now is a great time to test it out.

Announcing get.helm.sh

Mon, 10 Jun 2019 00:00:00 +0000

The Helm Client has long been available to download from Google Cloud Storage at the bucket https://kubernetes-helm.storage.googleapis.com. This bucket in Google Cloud has been used by Helm since before Kubernetes was part of the CNCF. The first release hosted on this bucket was Helm v2.0.0-alpha.5! Google has long been gracious in providing funding for this location. Since Helm started using it, Helm (as part of Kubernetes) moved into the CNCF, and then moved out from under the Kubernetes umbrella, becoming a sister project to Kubernetes within the CNCF.

Helm 3 Preview: Charting Our Future – Part 7: What's Next?

Mon, 13 May 2019 00:00:00 +0000

This is the seventh and final part of our Helm 3 Preview: Charting Our Future blog series. Read our previous blog post on library charts here. Helm 3.0.0-alpha.1 is the foundation upon which we’ll begin to build the next version of Helm. The features shared over the last few weeks were some of the big promises we made for Helm 3. Many of those features are still in their early stages and that is OK; the idea of an alpha release is to test out an idea, gather feedback from early adopters, and validate those assumptions.

Helm 3 Preview: Charting Our Future – Part 6: Introducing Library Charts

Thu, 09 May 2019 00:00:00 +0000

This is part 6 of 7 of our Helm 3 Preview: Charting Our Future blog series on library charts. You can find our previous blog post on the Helm chart dependencies here. Helm 3 supports a class of chart called a “library chart”. This is a chart that is shared by other charts, but does not create any release artifacts of its own. A library chart’s templates can only declare define elements.

Helm 3 Preview: Charting Our Future – Part 5: Changes to Chart Dependencies

Mon, 06 May 2019 00:00:00 +0000

This is part 5 of 7 of our Helm 3 Preview: Charting Our Future blog series about chart dependencies and some subtle differences between Helm 2 and Helm 3. (Check out our previous blog post on release management here.) Charts that were packaged (with helm package) for use with Helm 2 can be installed with Helm 3, but the chart development workflow received an overhaul, so some changes are necessary to continue developing charts with Helm 3.

Helm 3 Preview: Charting Our Future – Part 4: Release Management

Thu, 02 May 2019 00:00:00 +0000

This is part 4 of 7 of our Helm 3 Preview: Charting Our Future blog series on release management. (Check out our previous blog post on the Helm chart repositories here. In Helm 3, an application’s state is tracked in-cluster by a pair of objects: The release object: represents an instance of an application The release version secret: represents an application’s desired state at a particular instance of time (the release of a new version, for example) A helm install creates a release object and a release version secret.

Helm 3 Preview: Charting Our Future – Part 3: Chart Repositories

Mon, 29 Apr 2019 00:00:00 +0000

This is part 3 of 7 of our Helm 3 Preview: Charting Our Future blog series, discussing chart repositories. (Check out our previous blog post on the gentle goodbye to Tiller here.) At a high level, a Chart Repository is a location where Charts can be stored and shared. The Helm client packs and ships Helm Charts to a Chart Repository. Simply put, a Chart Repository is a basic HTTP server that houses an index.

Helm 3 Preview: Charting Our Future – Part 2: A Gentle Farewell to Tiller

Thu, 25 Apr 2019 00:00:00 +0000

This is part 2 of 7 of our Helm 3 Preview: Charting Our Future blog series. (Check out our previous blog post on the history of Helm here.) During the Helm 2 development cycle, we introduced Tiller as part of our integration with Google’s Deployment Manager. Tiller played an important role for teams working on a shared cluster - it made it possible for multiple different operators to interact with the same set of releases.

Helm 3 Preview: Charting Our Future – Part 1: A History of Helm

Mon, 22 Apr 2019 00:00:00 +0000

On October 15th, 2015, the project now known as Helm was born. Only one year later, the Helm community joined the Kubernetes organization as Helm 2 was fast approaching. In June 2018, the Helm community joined the CNCF as an incubating project. Fast forward to today, and Helm 3 is nearing its first alpha release. In this series of seven blog posts over the next four weeks, I’ll provide some history on Helm’s beginnings, illustrate how we got where we are today, showcase some of the new features available for the first alpha release of Helm 3, and explain how we move forward from here.

Helm Summit EU 2019

Thu, 18 Apr 2019 00:00:00 +0000

We’re beyond excited to share that Helm Summit EU 2019 is now official (h/t to CNCF)! Join the Helm community on September 11 - 12 in Amsterdam, The Netherlands at Pakhuis de Zwijger for our first European Helm Summit. Over the course of two days, we’ll discuss all things Helm and hold tutorials, working sessions, and small group discussions with new and exisiting users. Interested in… Registering? Sign up here before Aug 27 for Early Bird pricing of $250.

ChartMuseum Vulnerability: Authorization Bypass [CVE-2019-1000009]

Mon, 14 Jan 2019 00:00:00 +0000

Security researcher Bernard Wagner of Entersekt discovered a vulnerability in ChartMuseum, impacting all versions of ChartMuseum between ChartMuseum >=0.1.0 and < 0.8.1. A specially crafted chart could be uploaded that caused the uploaded archive to be saved outside of the intended location.

When ChartMuseum is configured for multitenancy the specially crafted chart could be uploaded to one tenant but saved in the location of another tenant. This includes overwriting a chart at a version in the other tenant.

Additionally, if ChartMuseum is configured to use a file system the uploaded Chart archive may be uploaded to locations outside of the storage directory. It could be uploaded to any place the ChartMuseum application binary has write permission to.

We are unaware of any public exploits caused by this issue.

Helm Vulnerability: Client Unpacking Chart that Contains Malicious Content [CVE-2019-1000008]

Mon, 14 Jan 2019 00:00:00 +0000

Security researcher Bernard Wagner of Entersekt discovered a vulnerability in the Helm client, impacting all versions of Helm between Helm >=2.0.0 and < 2.12.2. Two Helm client commands may be coerced into unpacking unsafe content from a maliciously designed chart.

A specially crafted chart may be able to unpack content into locations on the filesystem outside of the chart’s path, potentially overwriting existing files.

No version of Tiller is known to be impacted. This is a client-only issue.

The following Helm commands may unsafely unpack malformed charts onto a local folder: helm fetch --untar and helm lint some.tgz.

We are unaware of any public exploits caused by this issue.

Introducing the Helm Hub

Tue, 11 Dec 2018 00:00:00 +0000

Helm was designed with many distributed repositories in mind. Like Homebrew Taps and Debian APT repositories, Helm has the ability to add and work with many repositories. While the Helm stable and incubator repositories have been front and center from the beginning it was never our intent for these to be the only public repositories.

With this in mind, we are delighted to announce the launch of the Helm Hub. This hub provides a means for you to find charts hosted in many distributed repositories hosted by numerous people and organizations.

Introducing the Helm Org Maintainers

Thu, 04 Oct 2018 00:00:00 +0000

The first major action under the new Helm governance was to elect a set of Helm Org Maintainers. In the initial election we were looking to select 7 people to represent Helm core, charts, and other projects under the Helm umbrella. The election is now complete and I would like to introduce the first set of Org Maintainers.

Using the Community Chart Testing Tools Yourself

Tue, 25 Sep 2018 00:00:00 +0000

The Helm community charts, available as the stable and incubator repositories, have long had testing. That testing has grown and improved a significant amount in the past year; from Helm linting and testing if an application runs in a cluster to now include YAML linting, some validation on maintainers, Chart.yaml schema validation, tests on chart version increments, and more.

New Governance And Elections

Fri, 07 Sep 2018 00:00:00 +0000

Being a top level incubating CNCF project requires having a governance structure to ensure that there is a publicly documented process for making decisions regarding the project and the community. While Helm was under Kubernetes, we relied on Kubernetes governance. As part of the transition to CNCF, the Helm project is required to have its own governance structure. To handle this we set up a provisional governance with a goal of creating a long term one. After a few months we are happy to announce that the new governance structure has been written and approved.

Helm Moves To DCO

Mon, 27 Aug 2018 00:00:00 +0000

When Helm was part of the Kubernetes project it, like the rest of Kubernetes, used the CNCF Contributor License Agreement (CLA). This served Helm well for years. But, most of the CNCF projects use a Developers Certificate of Origin (DCO) instead of a CLA. The exceptions are Kubernetes and gRPC. Upon Helm becoming a CNCF project itself we were asked if we wanted to move Helm to a DCO. After some careful consideration and a little research, the Helm maintainers voted to move to a DCO.

Helm Emeritus Maintainer Rimas Mocevicius

Tue, 24 Jul 2018 00:00:00 +0000

Rimas Mocevicius ( rimusz) has become the fourth Helm Emeritus Maintainer. Rimas is one of the three original founders of Helm. Author of CoreOS Essentials (Packt, 2016) and creator of Kube Solo, Rimas is a long-time member of the Kubernetes ecosystem. Rimas was an active contributor on Helm Classic, and has been a leading voice in the community ever since. Check out Rimas’ latest blog post on Tillerless Helm.

Bringing Helm Home

Mon, 23 Jul 2018 00:00:00 +0000

Earlier this summer, we announced that Helm joined the CNCF as an official incubating project. Part of that transition involves moving the Helm project out of the Kubernetes GitHub org and into its org. We’re excited to announce that we’ve completed that process. As of last week, we have moved the Helm code repository to https://github.com/helm/helm.

Helm Enters the CNCF

Fri, 01 Jun 2018 00:00:00 +0000

Today we are happy to announce that Helm has become an official top-level CNCF project, joining the ranks of Prometheus, Linkerd, OpenTracing, and others. Helm will enter the CNCF as an incubating project as we continue to work on the next-generation Helm 3 cloud-native package manager.