pkg.sopackage field notes

brew / rank 136

Install helm with Homebrew

Kubernetes package manager. Version 4.2.3 via Homebrew; verified 2026-07-09.

Install commandSecurity notes

agent safety

Agent safety answer

helm manages Kubernetes release state and can deploy workloads into clusters.

Credential access

Uses kubeconfig, cluster tokens, chart repository credentials, and values files that may contain secrets.

Remote mutation

Can install, upgrade, rollback, or delete cluster releases.

Publish/artifact risk

Can package charts and deploy application artifacts to production clusters.

Recommended control

Gate helm install, upgrade, rollback, uninstall, and repo credential changes.

Agent-use guidance

Allow template/lint reads; require approval before any cluster mutation or chart publication.

install

Additional install commands

macOS

Homebrewverified · 100%
brew install helm

provider-native install command

overview

Package summary

Kubernetes package manager

Commands and aliases

  • helm

history

Project history and usage

Helm is the Kubernetes package manager. Its documentation defines charts as Helm packages, repositories as places where charts are collected and shared, and releases as chart instances installed into a Kubernetes cluster.

Helm is historically important because it brought package-manager ideas such as repositories, installable archives, dependency metadata, upgrades, rollbacks, and release history into Kubernetes application delivery.

Project history

The Helm project traces its first version to November 2015 at the first KubeCon. The Helm team describes Helm 1, also known as Helm Classic, as modeled on Homebrew and aimed at helping individual developers package Kubernetes resources and deploy them into clusters.

In January 2016, Deis' Helm team joined forces with Google, Skippbox, and Bitnami to build a new version focused on teams and a growing Kubernetes user community. That work led to the Helm 2 architecture and the chart ecosystem that many Kubernetes users adopted.

Helm joined the Cloud Native Computing Foundation in June 2018. Helm 3 reached its first stable release in November 2019, removing Tiller, refactoring the Go SDK for broader use, and changing internals while preserving the chart-centered workflow for users familiar with Helm 2.

Adoption history

Helm adoption tracked the growth of Kubernetes itself. Its docs describe chart repositories, `helm search`, `helm install`, `helm upgrade`, `helm rollback`, `helm get`, and `helm uninstall` as ordinary package operations for cluster workloads.

The Helm 3 release post describes a large contributor base and thousands of community members maintaining charts through Helm Hub-era infrastructure. The chart discovery story later centered on Artifact Hub, which the Helm docs use for `helm search hub`.

Package-manager adoption for the CLI is broad: the supplied metadata lists Homebrew, Alpine, Fedora, MacPorts, Nix, Arch, Scoop, winget, and openSUSE packaging for the Kubernetes-oriented Helm CLI.

How it is used

Users add chart repositories, search for charts, install a chart as a named release, pass values with YAML files or `--set`, upgrade releases, inspect status and values, roll back revisions, and uninstall releases.

Helm charts package Kubernetes resource definitions alongside metadata and default values. A chart can be installed many times into a cluster, producing separate releases with their own names and histories.

Helm's local repository configuration is stored in `repositories.yaml` under the user's Helm config directory. Because repository entries can include credentials, that file is also treated as a credentials location in the curation data.

Why package nerds care

Helm is one of the clearest examples of package-manager culture crossing into infrastructure. It has packages, repositories, dependency declarations, install and upgrade verbs, versioned releases, rollback history, and a registry/discovery ecosystem, but the installed artifacts are Kubernetes resources rather than files under `/usr`.

The Helm 2 to Helm 3 transition is also package-history material: removing Tiller reduced cluster-side moving parts and aligned Helm more closely with Kubernetes RBAC and client-side release management expectations.

For maintainers, Helm created a new packaging discipline around chart metadata, values schema, generated documentation, provenance, OCI distribution, and chart repository layout.

Timeline

  • 2015: Helm 1 released at the first KubeCon.
  • 2016: Deis, Google, Skippbox, and Bitnami collaborate on the next Helm generation.
  • 2018: Helm joins the Cloud Native Computing Foundation.
  • 2019: Helm 3.0.0 stable release published.
  • 2020: Helm celebrates CNCF graduation.
  • 2020s: Helm chart discovery and search workflows use Artifact Hub in official documentation.

Related projects

  • Kubernetes is the deployment platform Helm packages target.
  • Homebrew inspired Helm Classic's package-manager model.
  • Deis, Google, Skippbox, and Bitnami are named in the Helm 3 history as early collaborators.
  • Artifact Hub is the chart discovery service used by `helm search hub`.
  • helm-docs and helm-ls are neighboring tools for chart documentation and editor assistance.

security posture

Risk level: orange

Kubernetes package manager.

Risk classifier

orange risk · high confidence · infrastructure

Why

  • Kubernetes package manager

Signals

  • override:helm

Install behavior

  • No Homebrew bottle metadata was recorded.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

macOS
~/Library/Preferences/helm/repositories.yaml
Unix
~/.config/helm/repositories.yaml

Credential files

Credential-bearing paths to review before unattended agent runs.

macOS
~/Library/Preferences/helm/repositories.yaml
Unix
~/.config/helm/repositories.yaml

executables

Installed executables

CommandKindExposureNote
helmexecutableindexed executableDiscovered from the local executable index.

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-08-03
manager version4.2.3
manager updated2026-07-09
local dataunknown
upstreamnot available
latest detectednot detected
  • okNo freshness warnings were generated.

install metadata

Package metadata

Package keybrew:helm
Version4.2.3
Package managerHomebrew
Homepagehttps://helm.sh/
Repositoryhttps://github.com/helm/helm
Last updated2026-07-09T22:27:01Z
Pulseupdated
Bottlenot recorded
Servicenone declared

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • curated agent safety answer
  • curated configuration and credential file locations
  • curated package history
  • pkgdb category and tag curation