Terraform Helm Provider v3.3.0: Helm 3.20.2 Upgrade and Manifest Diff Notice

Introduction

HashiCorp released v3.3.0 of the terraform-provider-helm on Aug 28, 2026. This is a dependency-focused release: it bumps the vendored Helm binary and several Kubernetes client libraries, and includes a behavioral note for anyone using the experiments.manifest feature. There are no new resources, data sources, or schema changes in this release.

What Is New

Helm engine upgraded to 3.20.2

The provider now vendors Helm 3.20.2, up from 3.18.5 (GH-1807). This affects chart templating and rendering behavior to match whatever changes shipped in upstream Helm between those two versions. If you rely on Helm CLI behavior parity, review the upstream Helm changelog for 3.19.x/3.20.x before upgrading in production.

Kubernetes client libraries bumped

Several k8s.io packages were upgraded from 0.33.3 to 0.35.1, including:

• k8s.io/api
• k8s.io/apimachinery
• k8s.io/cli-runtime
• k8s.io/client-go
• k8s.io/kubectl

Also bumped: sigs.k8s.io/structured-merge-diff from v4.6.0 to v6.3.0, and golang.org/x/crypto from 0.49.0 to 0.52.0 (GH-1807, GH-1871).

These are transitive dependency updates with no direct HCL-facing API changes, but they keep the provider's Kubernetes API compatibility window current with newer cluster versions.

One-time diff for experiments.manifest users

If you have the provider's manifest experiment enabled, note this:

provider "helm" {
  experiments {
    manifest = true
  }
}

With experiments.manifest enabled, the stored manifest no longer includes creationTimestamp: null for rendered Secret resources. Expect a one-time diff on the first plan after upgrading. According to the release notes, nothing is applied to the cluster — the diff is cosmetic, reflecting the stored manifest state change, not an actual resource mutation (GH-1807).

Run terraform plan first and review the diff before applying, so the change doesn't surprise anyone reviewing the plan output in CI.

Upgrade Steps

Pin the provider version in your configuration:

terraform {
  required_providers {
    helm = {
      source  = "hashicorp/helm"
      version = "~> 3.3.0"
    }
  }
}

Then re-initialize:

terraform init -upgrade

If you use a lock file, update it explicitly:

terraform providers lock -platform=linux_amd64 -platform=darwin_arm64 hashicorp/helm

Verify

Confirm the provider version in use:

terraform version

Check the provider block resolved:

terraform providers

If experiments.manifest is enabled, run a plan to review the expected one-time manifest diff before applying:

terraform plan

Confirm the diff only touches stored manifest metadata (no actual Kubernetes object changes), then proceed with terraform apply as normal.

Conclusion

v3.3.0 of the Terraform Helm provider is a maintenance release: newer Helm engine, refreshed Kubernetes client libraries, and a documented one-time diff for manifest-experiment users. No breaking schema changes are called out in the release notes. Pin the version, run terraform init -upgrade, and check terraform plan output before applying if you use experiments.manifest. For full details, see the release page.