Last checked and updated on 04 May 2026
What Is New in Helm 3.17 (summary table)
| Category | Highlights |
|---|---|
| New Features |
|
| Improvements |
|
| Bug Fixes |
|
| Security |
|
| Deprecated / Removed |
|
What are the major change groups in Helm 3.17?
OCI enhancements
Helm now accepts an OCI digest directly, letting you pull and install a chart without a tag name. This shortens CI pipelines that rely on immutable digests.
Ownership handling
The --take-ownership flag gives the installing user control over resource adoption during upgrades, reducing manual cleanup of orphaned objects.
Metadata enrichment
Chart metadata output now includes annotations and dependencies, making it easier for automation tools to discover chart relationships without unpacking the archive.
Authentication & authorizer flexibility
Username/password can be passed to helm push and dependency commands, and the SDK’s authorizer is now configurable, supporting custom token providers and corporate registries.
Template utilities & permission changes
The new toYamlPretty function produces readable YAML in templates, and the kubeconfig permission check has been removed, simplifying local development environments.
FAQ
How do I install a chart using an OCI digest?
Use helm install myrel myrepo/chart@sha256:abcdef.... The digest is verified against the registry before the chart is unpacked.
What does the --take-ownership flag actually do?
It tells Helm to adopt existing resources that match the release’s selectors, preventing “resource already exists” errors during upgrades.
Can I still see chart annotations after the metadata change?
Yes. Running helm get metadata RELEASE now prints the annotations field alongside version and description.
How do I provide credentials for an OCI registry?
Supply --username USER --password PASS on helm push or on helm dependency build. The credentials are passed to the underlying ORAS client.
Is the removal of the kubeconfig permission check safe for production?
The check was only a convenience guard for local setups. Production clusters typically manage kubeconfig files via RBAC and secret management, so the change does not affect runtime security.