Helm Meets WebAssembly: Secure Extensibility Without Replacing Kubernetes

Shivay Lamba - / Bruce Gain - ReveCom

Helm 4 introduced a WebAssembly based plugin system that turns Helm from a monolithic CLI into a programmable, policy-aware platform for Kubernetes application delivery. By running plugins inside a Wasm sandbox via Extism, Helm significantly reduces the risk of native binaries, while allowing plugins to be written in multiple languages and shipped as a single cross-platform artifact.

This talk presents the architecture of the new plugin system and contrasts it with Helm 3’s subprocess-based model. Attendees will learn how Wasm plugins improve supply-chain and runtime security through mandatory signing and verification, clearer provenance, while still keeping Helm “batteries included” for default behavior.

The session discusses how platform teams can standardize organizational policies and custom template logic without forking Helm core. Through this talk we show why Helm’s Wasm support does not move the ecosystem closer to a “post-Kubernetes” world and why that’s a good thing. Attendees will gain a clear mental model of where WebAssembly adds real value today: as an isolation and portability primitive embedded inside existing cloud-native workflows, not as a replacement for Kubernetes or Helm itself.