Home / Knowledge hub / Helm chart security
Knowledge hub
Helm chart security
Reviewing the packaged Kubernetes templates you install, and what they switch on.
What it means
A Helm chart is a package of Kubernetes templates plus default settings, usually in a file called values.yaml. When you run helm install, Helm fills the templates with those values and sends the result to the cluster. Helm chart security is the habit of reading what that result will actually create.
The point is that a chart is code you did not write, running with the rights of whoever installs it. One chart can create services, storage, accounts and permissions in a single command. The defaults are chosen for convenience, and convenience and safe settings often disagree.
Why it matters
A chart from a public repository can open a service to the internet, run a container as privileged, or ship a default admin password that thousands of other installs share. Nobody has to break in. The setting was simply there when you installed it.
Charts also carry cluster permissions. A chart that asks for broad rights hands that power to the software inside it, and to anyone who finds a flaw in that software. Auditors asking how third-party components are approved will want to see that someone looked.
How it shows up
You meet charts when installing databases, ingress controllers, monitoring and your own services. Run helm template to see the real manifests before installing. Look for privileged containers, host paths, public load balancers, wide roles and passwords left at their defaults in values files.
Repeating mistakes: installing the newest version without reading the diff, pinning nothing, and trusting a chart because it is popular. Helm can sign and verify charts with PGP provenance files, which proves who published a chart, not that its settings are safe. Pin versions and review upgrades like code changes.
Questions people ask
Helm chart security, answered
Is a signed Helm chart a safe Helm chart?
No. Helm provenance files let you verify that a chart came from a known publisher and was not altered. They say nothing about the settings inside.
A signed chart can still run a privileged container or open a public port. Review the rendered output as well as the signature.
How do I see what a chart will create before I install it?
Run helm template with your values file. It prints the Kubernetes manifests without touching the cluster. You can read them, or pass them to a policy checker.
Many teams also use helm install --dry-run against the cluster for the same preview.
Do default values matter if I override some of them?
Yes. Only the values you override change. Everything else keeps the chart author's default, including passwords, service types and resource limits.
Read the full default file once, not just the settings you intended to change.
Is Helm itself a security risk?
Helm 3 removed Tiller, the in-cluster component that made Helm 2 a concern. Helm now uses your own Kubernetes credentials.
The risk that remains is the content of the charts and the rights of the account that installs them.
Who should review our charts?
Whoever approves a new dependency should approve a new chart. Treat a chart upgrade as a code change, with a diff and a second pair of eyes.
Policy checks in the pipeline can catch the repeat offenders, such as privileged containers, automatically.
Sources
Where this comes from
Related
Terms that sit next to this one
Kubernetes RBAC
Rules for which accounts and services may do what inside a Kubernetes cluster.
Privileged container
A container given near-host powers, so a flaw inside it is a flaw in the host.
Pod security standards
Built-in Kubernetes levels that restrict risky settings in pods.
Infrastructure as code
Describing servers and networks in files so they can be reviewed and repeated.
Container registry
The store that holds your images, which needs its own access control.
What did the chart switch on?
Cyberlop tests the running application, so a chart setting that exposes a service or leaves a default password shows up as a finding with the request and the response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.