github.com/fluxcd/helm-controller

Changelog

v1.6.3 changelog

Container images

• docker.io/fluxcd/helm-controller:v1.6.3
• ghcr.io/fluxcd/helm-controller:v1.6.3

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

Release date: 2026-07-23

This patch release fixes empty lines vanishing from rendered chart manifests, and releases being marked as tested when their Helm test hooks never ran.

Fixes:

• Fix vanishing empty lines #1545
• Fix HasBeenTested for all corner cases #1548

Improvements:

• ci: parallelize e2e job to speed it up #1543

Changelog

v1.6.2 changelog

Container images

• docker.io/fluxcd/helm-controller:v1.6.2
• ghcr.io/fluxcd/helm-controller:v1.6.2

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

Release date: 2026-07-07

This patch release disables Flux variable substitution on the HelmRelease CRD. The CRD is now annotated with kustomize.toolkit.fluxcd.io/substitute: disabled so that Kustomizations with post-build substitution enabled no longer corrupt the CRD schema when it contains ${...} sequences.

Fixes:

• Disable variable substitution in CRDs #1538

Changelog

v1.6.1 changelog

Container images

• docker.io/fluxcd/helm-controller:v1.6.1
• ghcr.io/fluxcd/helm-controller:v1.6.1

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

Release date: 2026-06-30

This patch release updates Kubernetes to 1.36.2, Helm to v4.2.2 and the fluxcd/pkg dependencies. It also adds kubectl categories to the HelmRelease CRD and documents the controller's command-line options.

Improvements:

• Add categories to the HelmRelease CRD #1527
• Document controller options #1531
• Update fluxcd/pkg dependencies #1529

Changelog

v1.6.0 changelog

Container images

• docker.io/fluxcd/helm-controller:v1.6.0
• ghcr.io/fluxcd/helm-controller:v1.6.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

Release date: 2026-06-17

This minor release continues aligning Flux with Helm v4, adding support for Helm's post-render strategies along with several new HelmRelease configuration options and improved drift observability.

⚠️ Breaking change: the default post-render strategy is now combined, to stay aligned with Helm v4.2's default for sending hooks to post-renderers. Users relying on the previous Helm v3 behavior can either enable the UseHelm3Defaults feature gate (which switches the default back to nohooks) or pin the behavior per HelmRelease via .spec.postRenderStrategy.

HelmRelease

Helm's post-render strategies are now supported through the new .spec.postRenderStrategy field, which controls how hooks are passed to post-renderers. The accepted values are nohooks, combined and separate. The default is combined to stay aligned with Helm v4.2, switching to nohooks when the UseHelm3Defaults feature gate is enabled.

A new .spec.upgrade.chartNameChangeStrategy field controls what happens when a HelmRelease's chart name changes. The default Reinstall keeps the current behavior of uninstalling and reinstalling the release, while InPlaceUpdate performs an in-place Helm upgrade instead, re-introducing on an opt-in basis the behavior present before Flux 2.2.

valuesFrom entries now accept a literal field. When set to true, the referenced value is used verbatim instead of being parsed with Helm's --set syntax, allowing arbitrary file content (JSON blobs, multi-line YAML, HOCON, etc.) that would otherwise be misinterpreted by the strvals parser.

A new Drifted condition is now set on the HelmRelease to improve the observability of drift detection.

Improvements:

• Add post-render strategy support and conditional defaults #1470
• Support helm release upgrade on helm chart name change #1447
• Add literal field to valuesFrom #1503
• Add Drifted condition to HelmRelease #1367
• Migrate DependencyReference to shared apis/meta type #1502
• Update source-controller API to v1.9.0 #1519
• Various dependency updates #1467, #1472, #1507, #1509, #1513, #1514, #1515, #1517

Changelog

v1.5.5 changelog

Container images

• docker.io/fluxcd/helm-controller:v1.5.5
• ghcr.io/fluxcd/helm-controller:v1.5.5

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC.
To verify the images and their provenance (SLSA level 3), please see the security documentation.

Release date: 2026-05-20

This patch release fixes several reliability issues. HTTP artifact fetches could block indefinitely and stall reconciliations, the Kubernetes client transport accumulated a new retry wrapper on every reconcile causing unbounded memory growth, non-CRD objects placed under a chart's crds/ directory were force-applied, and the Helm test action failed to find releases with names longer than 53 characters. It also moves Helm back to upstream v4.2.0 (off the Flux fork) and updates Kubernetes and fluxcd/pkg dependencies.

Fixes:

• Add configurable HTTP timeout for artifact fetching #1497
• Move retryingRoundTripper wrapping to constructor #1487
• Ignore non-CRD objects under crds/ #1496
• Use ShortenName for release name in Test action #1498

Improvements:

• Update Helm to v4.2.0 #1482
• Upgrade k8s to 1.36.1, c-r to 0.24.1, cli-utils to 1.2.1 #1495
• Update fluxcd/pkg dependencies #1483

Release date: 2026-04-21

This patch release fixes a post-renderer conflict between overlapping hooks and templates, and preserves line endings in SplitManifests for downstream YAML parsers. It also ensures force-replace is ignored when server-side apply is enabled.

Fixes:

• Ignore force replace when server-side apply is enabled #1456
• Fix post-renderer conflict of overlapping hooks and templates #1461

Release date: 2026-03-16

This patch release fixes templating errors for charts that include --- in the content, e.g. YAML separators, embedded scripts, CAs inside ConfigMaps, etc. Some of the errors that could be encountered due to this issue are:

• invalid document separator: ---apiVersion: v1
• wrong node kind

Fixes:

• Fix multi-doc parser of --- for post renderers #1442

Release date: 2026-03-12

This patch release fixes reconciliation queue behavior for source watch events while a HelmRelease is already reconciling the watched revision. It also comes with Helm 4.1.3, which fixes a Go templates bug where the YAML document separator --- could be concatenated to apiVersion as ---apiVersion, and introduces the DefaultToRetryOnFailure feature gate to improve the experience when CancelHealthCheckOnNewRevision is enabled by ensuring canceled HelmReleases do not get stuck when no retry strategy is configured.

Fixes:

• Fix enqueing the same revision while reconciling #1430

Improvements:

• Introduce DefaultToRetryOnFailure feature gate #1431
• Update fluxcd/pkg dependencies #1436

Release date: 2026-02-27

This patch release fixes health check logic for StatefulSets during rolling updates when the Pods are Pending/Unschedulable.

Fixes:

• Fix health check logic for StatefulSets during rolling updates #1424

Improvements:

• Add note about MTTR only for kstatus #1416
• Remove no longer needed workaround for Flux 2.8 #1420

Release date: 2026-02-20

This minor release comes with Helm v4 support, server-side apply for Helm releases, and various bug fixes and improvements.

⚠️ The v2beta2 APIs were removed. Before upgrading the CRDs, Flux users must run flux migrate to migrate the cluster storage off v2beta2.

HelmRelease

The controller now uses Helm v4, and, with this change, new default behaviors are being introduced (breaking changes) to keep Flux and Helm aligned:

• Apply method is now defaulting to server-side apply for new HelmReleases.
• Health checks now default to using kstatus for assessing readiness and failures of applied resources.

Those defaults can be changed back to Helm v3's defaults by setting the feature gate UseHelm3Defaults. Alternatively, fine-tuning the apply and health check methods is also possible on a per-HelmRelease basis by using the following fields:

• .spec.install.serverSideApply (boolean, default defined by UseHelm3Defaults)
• .spec.upgrade.serverSideApply (enabled, disabled or auto, defaults to auto)
• .spec.rollback.serverSideApply (enabled, disabled or auto, defaults to auto)
• .spec.waitStrategy.name (poller or legacy, default defined by UseHelm3Defaults)

Note that Helm persists the apply method in the release storage, hence why the auto value is an option for upgrade and rollback actions. When set to auto, the controller will reuse the apply method used in the last successful release revision as recorded in the Helm storage, defaulting to client-side apply. This means that existing HelmReleases will continue to use client-side apply until their .spec is updated with .spec.{upgrade|rollback}.serverSideApply: enabled.

The poller health check strategy uses kstatus to check the status of applied resources, while the legacy strategy uses Helm v3's built-in health checking behavior.

The controller now can be configured to cancel in-progress health checks when a new reconciliation request is received, reducing the mean time to recovery (MTTR) in case of failed deployments. This feature is enabled by the CancelHealthCheckOnNewRevision feature gate. Note that enabling this feature gate will not cancel apply operations, and will only cancel health checks for managed resources. Waiting for Helm hooks and tests will not be cancelled. Note also that this feature is only available with the poller health check strategy.

Still on the health check subject, custom health checks via CEL expressions are now supported for HelmRelease via the .spec.healthCheckExprs field, similar to the Kustomization API. Please see the CEL cheatsheet for more information.

The --override-manager=<manager> flag has been added for server-side apply drift detection and correction. This flag can be passed multiple times. Note that drift detection and correction in helm-controller is completely unrelated to Helm v4's server-side apply support, and was implemented long before Helm v4 was released.

The DirectSourceFetch feature gate has been introduced for bypassing the cache when fetching source objects on reconciliations.

For improved observability, inventory tracking has been added via .status.inventory. Hooks and tests are not tracked in this field. Only resources present in the Helm storage and CRDs are tracked.

Also for improved observability, the controller now tracks the action (install, upgrade, rollback, uninstall, uninstall-remediation) in snapshots: .status.history[].action.

General updates

In addition, the Kubernetes dependencies have been updated to v1.35.0, Kustomize has been updated to v5.8.1 and the controller is now built with Go 1.26.

Fixes:

• Fix state when configuration set back to current state following upgrade failure #1369
• Fix waiting and erroring out on garbage-collected Jobs #1402
• Fix controller not reconciling conditions for in-sync release #1411
• Fix postRenderers not causing new upgrade when applied during ongoing upgrade #1412

Improvements:

• Upgrade Helm to v4 #1383 #1403
• Add ServerSideApply field to HelmRelease API #1384
• Add .status.inventory to track managed objects #1385
• Add support for custom health checks via CEL expressions #1389
• Add --override-manager flag for server-side apply drift detection #1365
• Reduce the mean time to recovery (MTTR) in case of failed deployments #1392
• Track action in snapshots #1399
• Add DirectSourceFetch feature gate to bypass cache for source objects #1407
• Remove deprecated APIs in group helm.toolkit.fluxcd.io/v2beta2 #1404
• Remove adoption of resources in old API versions #1396
• Remove duplicated struct json tag #1377
• Various dependency updates #1395 #1406 #1408 #1410

Release date: 2025-11-27

This patch release fixes the HelmRelease .status.history filling up etcd when the RetryOnFailure strategy is used.

Fixes:

• Fix history truncation logic for RetryOnFailure #1360

Release date: 2025-11-19

This patch release fixes the error no URLLoader registered and Azure Workload Identity in Azure China Cloud. It also adds a feature gate to disable the ConfigMap and Secret watchers, DisableConfigWatchers.

Improvements:

• Add feature gate for disabling config watchers #1353
• Upgrade k8s to 1.34.2, c-r to 0.22.4 and helm to 3.19.2 #1350
• Upgrade Helm to 3.19.1 #1346

Release date: 2025-10-28

This patch release comes with various fixes and improvements.

Fixes:

• Fix status reporting for RetryOnFailure strategy #1338

Improvements:

• Allow fetching charts from a local source-watcher #1341

Release date: 2025-10-08

This patch release comes with various dependency updates.

The controller is now built with Go 1.25.2 which includes fixes for vulnerabilities in the Go stdlib: CVE-2025-58183, CVE-2025-58188 and many others. The full list of security fixes can be found here.

Improvements:

• Update dependencies to Kubernetes v1.34.1 and Go 1.25.2 #1329

Release date: 2025-10-06

This patch release fixes the controller setting the Ready condition to Unknown redundantly during reconciliation.

Fixes:

• Remove redundant Ready condition setter #1323
• Fix docs example for kubeconfig workload identity #1315

Release date: 2025-09-25

This minor release comes with various bug fixes and improvements.

⚠️ The v2beta1 APIs were removed. Before upgrading the CRDs, Flux users must run flux migrate to migrate the cluster storage off v2beta1.

The controller now supports ExternalArtifact Helm chart sources under the feature gate ExternalArtifact.

A new RetryOnFailure strategy has been added for automatic retries on Helm release failures.

Dependencies can now be evaluated using CEL expressions via the new readyExpr field, providing more flexible and powerful dependency readiness checks.

Support for workload identity authentication has been added for remote clusters. This is supported both at the controller and object levels. For object-level, enable the feature gate ObjectLevelWorkloadIdentity.

In addition, the Kubernetes dependencies have been updated to v1.34, Helm has been updated to v3.19 and various other controller dependencies have been updated to their latest version. The controller is now built with Go 1.25.

Fixes:

• Fix continuous drift due to unstable hashing of values #1267
• Fix watch index conflict between HelmChart and OCIRepository kinds #1266
• Fix requeue interval for SourceNotReady #1276

Improvements:

• [RFC-0010] Add workload identity auth for remote clusters #1249
• [RFC-0010] Support all Azure clouds for remote clusters #1262
• [RFC-0010] Add multi-tenancy lockdown for kubeconfig #1284
• [RFC-0010] Add object-level configuration validation #1286
• [RFC-0012] Add ExternalArtifact feature gate and reconciliation support #1293
• [RFC-0012] Add support for ExternalArtifact revision with digest #1296
• Remove deprecated helm.toolkit.fluxcd.io/v2beta1 API group #1280
• Add RetryOnFailure lifecycle management strategy #1281
• Add CEL expressions for dependency readiness checks with readyExpr field #1271
• Add label selector for watching ConfigMaps and Secrets #1258
• Add common labels and annotations support with Kustomize post-renderer #1223
• Record last Helm release action duration in status #1282
• CI improvements with fluxcd/gha-workflows #1305 #1307
• Various dependency updates #1304 #1247 #1297

Release date: 2025-05-28

This minor release comes with various bug fixes and improvements.

The controller now supports the DisableChartDigestTracking feature gate, which allows disabling appending the digest of OCI Helm charts to the chart version. This is useful for charts that do not follow Helm's recommendation of using the app version instead of the chart version as a label in the manifests.

In addition, the Kubernetes dependencies have been updated to v1.33, Helm has been updated to v3.17.3 and various other controller dependencies have been updated to their latest version. The controller is now built with Go 1.24.

Fixes:

• Fix returning wrong error value in Kubernetes HTTP client #1188

Improvements:

• Add DisableChartDigestTracking feature gate #1212
• Various dependency updates #1227 #1221 #1220 #1218 #1206 #1209 #1204

Release date: 2025-02-19

This minor release comes with various bug fixes and improvements.

In addition, the Kubernetes dependencies have been updated to v1.32.1, Helm has been updated to v3.17.1 and various other controller dependencies have been updated to their latest version.

Fixes:

• Replace _ with + when verifying the chart version matches the OCI artifact tag #1102
• fix: handle "leader changed" errors #1084
• Make ValuesReference an alias for backwards compat #1126
• Fix install and upgrade applying subchart CRDs when condition is false #1123
• fix: use HelmRelease max history for rollback remediation #1169

Improvements:

• Refactor values composition to use pkg/chartutil #1122
• docs: Rendering the final Values locally #1127
• Add disableTakeOwnership to Helm install/upgrade actions #1140
• Various dependency updates #1103 #1121 #1129 #1142 #1160 #1158 #1165 #1168 #1171 #1167 #1173 #1170