Helm

v2.16.11

Helm v2.16.11 is a security (patch) release. Users are strongly recommended to update to this release. It fixes four notable security issues for which we have opened security advisories. More information on the security advisory can be found on the security advisory page.

Most of the issues were discovered by Trail of Bits during their CNCF-sponsored audit of the Helm codebase. We are grateful for Trail of Bits' detailed and thorough analysis of the Helm codebase. In addition, a Helm core maintainer identified one more issue.

The community keeps growing, and we'd love to see you there!

• Join the discussion in Kubernetes Slack:
  • for questions and just to hang out
  • for discussing PRs, code, and bugs
• Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
• Test, debug, and contribute charts: GitHub/helm/charts

Notable Changes

The main security issues are:

• The plugin name field is not properly sanitized
• Alias names in Chart.yaml are not properly sanitized
• The index.yaml file for repositories is not parsed in strict mode, enabling duplicate entries
• The plugin.yaml file for repositories is not parsed in strict mode, enabling duplicate entries

Installation and Upgrading

Download Helm v2.16.11. The common platform binaries are here:

• MacOS amd64 (checksum / e29337c497b481edd5fc436f04182ae7e939a4783a50bdd4b5a5a07eb60a810f)
• Linux amd64 (checksum / 7eeb6c01cd0f25223c885887669b57cebaf7a0552cff94c748f1c28e4df55ce2)
• Linux arm (checksum / d47dbb1bc0dfc18affb051d5b4a5eafe8f68f2717a84849e86af5425efd69ead)
• Linux arm64 (checksum / a6baba468b732823488e4e564ea4857d1f013a1b7e597a36e6118bc736173e33)
• Linux i386 (checksum / b3515890601bddce52db3c13a7c1bceca41904d2fa2375e5c11a2218ab0ca537)
• Linux ppc64le (checksum / abb60635b042812a6997430d438c3cbde49e8816291608d5cbf835302001ae4c)
• Linux s390x (checksum / e29337c497b481edd5fc436f04182ae7e939a4783a50bdd4b5a5a07eb60a810f)
• Windows amd64 (checksum / e263f01a1e45a53aa9816aa8fc360bc8520cf448d7bf09fe30cca4e181acbe47)

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

• v2.17.0 will be the LAST RELEASE of Helm v2

Changelog

• fix formatting error (#8758) 73b28bab84490d18ab1b71489a574ee18e229eea (Matt Butcher)
• fix: use yaml annotations for yaml.v2 validation 077ffec4149aed43ba43942841473399afe4d3d1 (Matthew Fisher)
• validate plugin metadata before loading c8d6b01d72c9604e43ee70d0d78fadd54c2d8499 (Matthew Fisher)
• backported fixes from helm3 6aab63765f99050b115f0aec3d6350c85e8da946 (Matt Butcher)
• Fixing broken vanity URL in dependencies a9337d8762e9191120126e088775c0b565c07667 (Matt Farina)