Helm 4 Migration

What changed in Helm 4 (November 2025): server-side apply, improved Secrets-based release storage, namespace isolation, and breaking changes for migrating from Helm 3.

Overview

Helm 4 in one change

Helm 4.0 was released at KubeCon North America in November 2025, with the stable 4.2.2 release available in early 2026. The headline change is server-side apply (SSA) as the default, replacing the client-side apply model used since Helm 3.

> [!IMPORTANT] SSA moves the merge from the Helm client to the API server, and makes field ownership explicit.

Where the merge happens

Who merges — Helm client computes the three-way merge locally — API server, tracking field ownership via managedFields
Alignment — Helm-specific — Matches other controllers (Argo CD, Flux, kubectl)

Stricter field ownership

Charts that set a field another manager has also set (a MutatingAdmissionWebhook, kubectl edit, Argo CD) now produce a field manager conflict error. Helm 3 silently worked around these by overwriting webhook mutations and ignoring drift from manual edits.

Migration steps

Field ownership — Test in staging with SSA and watch for conflict errors
Go SDK tooling — Update import paths from v3 to v4
Plugins — Move to v4-compatible versions
CLI flags — Remove deprecated flags

> [!TIP] Teams running standard third-party charts (Bitnami, ingress-nginx, cert-manager) that already publish Helm 4 compatible versions usually find the migration largely transparent.

Key concepts

Server-side apply (SSA): Helm 4's default apply strategy. The Kubernetes API server handles resource merging using managedFields. Provides conflict detection (another manager owns a field), better admission webhook engagement, and more correct reconciliation semantics than Helm 3's client-side apply.
Field manager conflict: Error produced by SSA when Helm tries to set a field that is tracked as owned by a different manager. Resolved by: --force-conflicts (Helm takes ownership), restructuring the chart to not set the conflicting field, or removing the competing manager's ownership.
managedFields: Kubernetes object metadata field that SSA populates. Records which field manager last set each field. Shows up in kubectl get -o yaml output. Helm 4 sets field-manager: helm. Used by SSA for conflict detection and audit.
Helm SDK v4 (helm.sh/helm/v4): The Go SDK import path for Helm 4. Breaking from v3 (helm.sh/helm/v3). Plugin authors and internal tooling that imports the Helm SDK must update import paths. Helm 3 and 4 CLIs can coexist (different binaries); SDK code must pick one.
apiVersion: v2 chart compatibility: Helm 3 charts using apiVersion: v2 are compatible with Helm 4 for most cases. Charts using apiVersion: v1 (Helm 2 legacy) or requiring Helm 2-specific features (requirements.yaml separate file) require chart updates before Helm 4 deployment.

When to use it

Planning a Helm version upgrade: understand SSA implications before upgrading production clusters
Debugging conflict errors: understanding field manager ownership is necessary to resolve SSA conflicts
Writing new charts: Helm 4 SSA behavior should inform how you structure chart templates
Evaluating Argo CD + Helm 4 compatibility: both use SSA, which requires careful field manager coordination

Interview questions

Explain server-side apply and how it changes the Helm upgrade behavior.
What are the breaking changes in Helm 4 that a platform team needs to address before migrating?
How do you debug and resolve field manager conflicts in Helm 4?
What does the Helm 4 migration path look like for a team running 50+ charts in production?
What is the status of Helm 3 and what is the support timeline?