# Nova: finding outdated and deprecated Helm charts already in your cluster > Nova scans a Kubernetes cluster for installed Helm charts, cross-checks them against all known Helm repositories, and reports where a newer version exists or where the version in use is deprecated. It also checks container images for outdated versions, and since 3.12.0 the images have moved registries, become signed and immutable, with floating tags withdrawn. **FairwindsOps/nova** — Find outdated or deprecated Helm charts running in your cluster. - Repository: https://github.com/FairwindsOps/nova - Website: https://fairwinds.com - Stars: 877 · Forks: 49 - Language: Go - License: Apache-2.0 - Published: 2026-10-20 · Updated: 2026-10-20 · Language: en - Canonical page: https://hysenlabs.com/projects/fairwindsops-nova ## What it checks, and where the answer comes from Nova scans your cluster for installed Helm charts, then cross-checks them against all known Helm repositories. If it finds an updated version of the chart you are using, or notices that your current version is deprecated, it will let you know. The scanning half is therefore a read of the live cluster state, and the comparison half is a query of the chart repositories your cluster is configured to use. That is the whole model, and it explains both what the tool is good at and where its blind spots are. A chart that was installed from a repository Nova does not know about will not be cross-checked, and a chart that was installed by pointing at a tarball rather than at a repository may not be recognised as installed at all. The README also notes that Nova can scan the cluster for out of date container images, so the same idea applies beyond Helm. The primary language is Go, the licence is Apache-2.0, and the last push was on 2026-10-18. ## The registry move in 3.12.0 broke every floating tag The most operationally significant change in the project is the one in the notice at the top of the readme, and it is dated as a migration from v3.11.15 to v3.12.0. Starting with v3.12.0 the images moved to us-docker.pkg.dev/fairwinds-ops/oss/nova, and quay.io/fairwinds/nova is deprecated. The required action is a straight substitution in whatever references the old path: ```diff - quay.io/fairwinds/nova: + us-docker.pkg.dev/fairwinds-ops/oss/nova: ``` The second half of the change is the one that catches people out. The images are now signed, the tags are immutable, and the floating tags v3, v3.11 and latest no longer exist. The documented way to reference an image is a full version tag: ``` us-docker.pkg.dev/fairwinds-ops/oss/nova:v.. ``` Or, better for a production deployment, pinned by digest: ``` us-docker.pkg.dev/fairwinds-ops/oss/nova@sha256: ``` So a cluster that was pulling nova:latest on a schedule will simply stop finding that tag, and any manifest, pipeline or GitOps repository that referenced the old registry path needs updating at the same time as the tool is upgraded. ## Helm and the Kubernetes client libraries are the bulk of the dependencies The go.mod tells you what Nova has to do to do its job, and the list is dominated by Helm and the Kubernetes client libraries. It depends on helm.sh/helm/v3 at 3.20.2, which is the part that knows how to talk to chart repositories and how to interpret a chart version, and on the k8s.io api, apimachinery and client-go packages at 0.35.4, with controller-runtime at 0.23.3 for the machinery around talking to a cluster. Comparing versions is the job of Masterminds/semver, and the container image half of the tool is served by google/go-containerregistry, which is what lets it read image tags and digests from a registry. On the command line side it uses cobra for the command structure, viper for configuration, and pkg/errors for error wrapping, with testify for the tests. The module itself declares Go 1.27.1, and the semantic version comparison library and the Helm library being pinned exactly rather than with a caret tells you they are not upgraded casually, since either one changing behaviour would change what Nova reports. ## Building it locally, and the cross compilation target The Makefile is conventional Go with a couple of details worth knowing. The all target runs lint and test, and the build target produces a binary named nova with the version and commit stamped in through linker flags, with the version defaulting to local-dev when it has not been set by the release process. The lint target runs golangci-lint, and the test target runs the Go tests with benchmarks and coverage enabled, then runs go vet with the output redirected to a report file, and finally turns the coverage profile into an HTML report. The reportcard target runs goreportcard-cli with a target of 100, which is a stricter bar than most projects set. The build-docker target depends on build-linux, which is a cross compilation with CGO disabled, and the docker build still tags the old quay.io path with a dev suffix, which is a leftover worth noting now that the registry has moved. ## The container image is minimal and runs as nobody The Dockerfile is short and says something about how the project thinks about supply chain. The base is alpine 3.24.1, and the image carries the usual Open Container Initiative labels for the author, vendor, title, description, documentation, source, url and licence. Two packages are added explicitly, the CA bundle for TLS and an upgrade of libcrypto3 and libssl3, and the build then switches to the nobody user, copies the single binary in, and sets the entrypoint to it. So the running image contains an Alpine base, two crypto libraries, a CA bundle and one statically linked Go binary, with no shell and no package manager for anyone who gets into it. The licence label in the metadata says Apache License 2.0, matching the licence field on the repository, and the label description spells out what the tool is in a sentence, that it is a cli tool to find outdated or deprecated Helm charts running in your Kubernetes cluster. ## It sits in a family of Kubernetes audit tools The readme points at the other Fairwinds projects, and the grouping is instructive because each one covers a different kind of drift. Polaris audits, enforces and builds policies for Kubernetes resources, including more than twenty built-in checks for best practices. Goldilocks right-sizes your Kubernetes Deployments by comparing your memory and CPU settings against actual usage. Pluto detects Kubernetes resources that have been deprecated or removed in future versions, which is a different question from Nova's, since it is about the API surface rather than about the version of a chart you installed. rbac-manager simplifies the management of RBAC in your clusters. For a team that has all of these problems, running several of these tools is the normal arrangement rather than a sign that any one of them is incomplete. There is also a commercial platform, Fairwinds Insights, for teams that want to run the checks across multiple clusters, track results over time and integrate with Slack, Datadog and Jira, and Nova itself is MIT style open source with Apache 2.0. ## Conclusion Nova suits a platform team that deploys with Helm and wants to know which of the charts in a running cluster have moved on, and it suits a team that also wants the same treatment for container images. It does not suit a cluster where releases are managed declaratively from Git with no Helm history to read, because the tool starts from what is installed. Before you run it, note that the images moved to a Google Artifact Registry path at version 3.12.0, that the old quay.io path is deprecated, and that the floating tags v3, v3.11 and latest no longer exist, so your manifests have to be rewritten to a full version tag or a digest. ## FAQ ### What does Nova check in a Kubernetes cluster? It scans for installed Helm charts and cross-checks them against all known Helm repositories, reporting where a newer version exists or where the installed version is deprecated. It can also scan the cluster for out of date container images. ### What changed in Nova 3.12.0 that I have to act on? The images moved to us-docker.pkg.dev/fairwinds-ops/oss/nova and the old quay.io path is deprecated. The images are now signed, the tags are immutable, and the floating tags v3, v3.11 and latest no longer exist, so you must reference a full version tag or pin by digest. ### Does Nova still support the old quay.io image path? The quay.io/fairwinds/nova path is deprecated as of v3.12.0, and the required action is to replace it with the us-docker.pkg.dev/fairwinds-ops/oss/nova path in whatever references it. ### How is Nova built and tested? The Makefile builds a binary named nova with the version and commit stamped in through linker flags, lints with golangci-lint, runs the tests with benchmarks and coverage, runs go vet into a report file, and generates an HTML coverage report. There is a cross compilation target with CGO disabled and a docker build target on top of it. ## Sources - [FairwindsOps/nova on GitHub](https://github.com/FairwindsOps/nova) - [License: Apache-2.0](https://github.com/FairwindsOps/nova/blob/master/LICENSE) - [Project website](https://fairwinds.com) - [README](https://github.com/FairwindsOps/nova/blob/master/README.md) - [Releases](https://github.com/FairwindsOps/nova/releases) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/fairwindsops-nova