Helm Installation Guide

Install Helm 4 on Linux, macOS and Windows, verify the binary signature, configure repositories and learn the new Helm 4 features such as OCI digest installs and server-side apply.

Helm is the package manager for Kubernetes. This guide installs Helm 4 (the current release line), verifies the binary, configures chart repositories and walks through the commands you use every day.

Helm 4 is the current release

Helm 4 keeps Helm 3 charts working unchanged, but changes a few defaults. The most important ones for you: post-renderers are now plugins, helm registry login takes a domain name only, new releases are installed with server-side apply, and --atomic / --force were renamed to --rollback-on-failure / --force-replace. If you have automation that depends on Helm 3 behaviour, pin the version explicitly.

Prerequisites

A Kubernetes cluster (or a local one — see Minikube)
kubectl installed and configured
curl and tar for the manual installation
For OCI registries: helm registry login and a token with push/pull rights

Installation Instructions

The Official Script (Works on Every Platform)

The Helm project publishes an installer script that detects your OS and architecture:

curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-4
chmod 700 get_helm.sh
./get_helm.sh

You can pipe it directly if you prefer, but downloading first lets you read the script before running it.

From the Official Binary Release

# Pin the version you want to install
HELM_VERSION=v4.3.1
 
# Download and verify the checksum
curl -fsSL -O "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
curl -fsSL -O "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz.sha256sum"
sha256sum -c "helm-${HELM_VERSION}-linux-amd64.tar.gz.sha256sum"
 
# Extract and install
tar -xzf "helm-${HELM_VERSION}-linux-amd64.tar.gz"
sudo install -o root -g root -m 0755 linux-amd64/helm /usr/local/bin/helm
 
# Verify
helm version

Replace linux-amd64 with linux-arm64, darwin-amd64, darwin-arm64 or windows-amd64.zip for your platform.

From Package Managers

Debian / Ubuntu (apt)

The Helm community maintains a Debian package hosted on Buildkite. The key is fingerprint-checked before it is installed:

HELM_BUILDKITE_APT_KEY_ID="DDF78C3E6EBB2D2CC223C95C62BA89D07698DBC6"
 
sudo apt-get install curl gpg --yes
 
curl -fsSL https://packages.buildkite.com/helm-linux/helm-debian/gpgkey > "${TMPDIR:-/tmp}/helm.asc"
 
# Ensure the key ID matches to prevent a compromised repository
if [ "$(gpg --import --import-options=show-only --with-colons "${TMPDIR:-/tmp}/helm.asc" \
        | awk -F: '$1 == "fpr" {print $10}' | head -n 1)" != "${HELM_BUILDKITE_APT_KEY_ID}" ]; then
  echo "ERROR: Unexpected Helm APT key ID: potential key compromise"
  exit 1
fi
 
# Remove configuration left by earlier versions of these instructions
sudo rm -f /etc/apt/sources.list.d/helm-stable-debian.list /usr/share/keyrings/helm.gpg
 
sudo install -m 0644 -Dt /etc/apt/keyrings/ "${TMPDIR:-/tmp}/helm.asc"
 
sudo tee /etc/apt/sources.list.d/helm-stable-debian.sources > /dev/null <<EOF
Types: deb
URIs: https://packages.buildkite.com/helm-linux/helm-debian/any/
Suites: any
Components: main
Signed-By: /etc/apt/keyrings/helm.asc
EOF
 
sudo apt-get update
sudo apt-get install helm

RHEL / CentOS / Fedora (dnf)

# Fedora 35 and newer ship Helm in the official repositories
sudo dnf install helm

Other distributions (snap)

sudo snap install helm --classic

Verifying the Release Signature

Every Helm release is signed. Verifying it protects you against tampered downloads:

# 1. Verify the SHA256 checksum
sha256sum -c helm-v4.3.1-linux-amd64.tar.gz.sha256sum
 
# 2. Import the Helm maintainer keys (once, into a location you control)
curl https://raw.githubusercontent.com/helm/helm/main/KEYS | gpg --import
 
# 3. Verify the signature
gpg --verify helm-v4.3.1-linux-amd64.tar.gz.asc helm-v4.3.1-linux-amd64.tar.gz
# gpg: Good signature from "Helm Maintainer"

Keep your own copy of the keys

Import the maintainer keys once and store them somewhere you control. If the repository is ever compromised and the keys are swapped, your local copy lets you detect it.

Basic Configuration

Manage Chart Repositories

# Add a classic chart repository
helm repo add bitnami https://charts.bitnami.com/bitnami
 
# Refresh the local cache
helm repo update
 
# List the configured repositories
helm repo list
 
# Search across the configured repositories
helm search repo nginx

The old stable repository is archived

https://charts.helm.sh/stable is no longer maintained, and Bitnami now publishes most of its charts to an OCI registry. When a classic repository stops working, pull the chart from OCI instead (see below) or from another registry such as Artifact Hub.

Install from an OCI Registry

Helm 4 supports OCI registries natively, and Helm 4 can install a chart by digest so the exact same bits are always deployed:

# Log in to the registry (domain only — no scheme or path)
helm registry login registry-1.docker.io
 
# Install the latest chart from an OCI registry
helm install myapp oci://registry-1.docker.io/bitnamicharts/nginx
 
# Install a specific chart by digest for supply chain safety
helm install myapp oci://registry-1.docker.io/bitnamicharts/nginx@sha256:<digest>

Working with Releases

# Search for a chart
helm search repo nginx
 
# Install a release
helm install my-release bitnami/nginx
 
# List releases
helm list
 
# Upgrade a release
helm upgrade my-release bitnami/nginx
 
# Roll back to a previous revision
helm history my-release
helm rollback my-release 1
 
# Uninstall
helm uninstall my-release

Template Locally Before Deploying

# Render the manifests without touching the cluster
helm template my-release bitnami/nginx
 
# Render with custom values
helm template my-release bitnami/nginx -f values-prod.yaml
 
# Validate against the live cluster (Helm 4 also reports resource status)
helm install my-release bitnami/nginx --dry-run --debug

Troubleshooting

Best Practices

Version control your charts

helm create mychart
helm lint mychart
helm package mychart
helm repo index .

Always use values files for environment differences

# values.yaml
replicaCount: 3
image:
  repository: nginx
  tag: "1.27"

helm install -f values-prod.yaml myrelease ./mychart

Pin chart versions

helm install my-release bitnami/nginx --version 15.4.2

Diff before you upgrade

helm plugin install https://github.com/databus23/helm-diff
helm diff upgrade my-release bitnami/nginx --version 15.4.3

Lint and test in CI

helm lint mychart
helm install myrelease ./mychart --dry-run --debug
helm unittest ./mychart

Sign the charts you publish

gpg --quick-generate-key "Helm User"
helm package --sign mychart
helm verify mychart-0.1.0.tgz

What's New in Helm 4

Feature	What it means for you
Server-side apply	New releases are applied with SSA by default; existing client-side releases keep their behaviour when upgraded
OCI digest installs	`helm install app oci://repo/chart@sha256:...` guarantees the exact artifact
Multi-document values	Split complex configuration across several YAML files
kstatus watcher	`helm status` reports the real state of each deployed resource
WebAssembly plugins	New optional plugin runtime; existing plugins keep working
Renamed flags	`--atomic` → `--rollback-on-failure`, `--force` → `--force-replace`

Next Steps

Kubernetes

Install Kubernetes v1.37 with kubeadm, kubelet and kubectl from the official pkgs.k8s.io repositories, configure containerd, install a CNI and join worker nodes.

Istio

Install Istio 1.31 with istioctl, choose the right configuration profile, enable sidecar or ambient mode, install the observability add-ons and verify the mesh.

On This Page

Prerequisites
Installation Instructions
Verifying the Release Signature
Basic Configuration
Troubleshooting
Best Practices
What's New in Helm 4
Next Steps