Skip to main content
Mapagam

Implementing Chart Security

1. Signing Chart Packages

Property Description Value
name Chart name myapp
version Chart version 1.0.0
signatures Signature status true

Example: Signing Chart Package

helm package myapp --sign --key "my-key"

2. Verifying Chart Signatures

Property Description Value
signature Signature verification status verified
keyId Key ID used for signing ABC123
signatureType Type of signature gpg

Example: Verifying Chart Signature

helm verify myapp-1.0.0.tgz

3. Using GPG Keys

Property Description Value
keyId GPG key ID ABC123
keyName Name of GPG key my-key
keyType Type of GPG key rsa

Example: Creating GPG Key

gpg --gen-key

4. Creating Provenance File

Property Description Value
provenanceFile Provenance file name myapp-1.0.0.tgz.prov
checksum Checksum of chart sha256:abc123...
signature Signature of provenance file base64:abc123...

Example: Creating Provenance File

helm package myapp --sign --key "my-key"

5. Validating Chart Integrity

Property Description Value
checksum Chart checksum sha256:abc123...
signature Signature verification status verified
integrityCheck Integrity check result pass

Example: Validating Chart Integrity

helm verify myapp-1.0.0.tgz

6. Implementing RBAC in Charts

Property Description Value
rbacEnabled RBAC enabled in chart true
roles Roles defined in chart admin, viewer
roleBindings Role bindings defined in chart admin-binding, viewer-binding

Example: RBAC in Chart

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: admin-role
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]

7. Setting Security Context

Property Description Value
runAsUser User ID to run as 1000
runAsGroup Group ID to run as 2000
fsGroup File system group ID 3000

Example: Setting Security Context

securityContext:
  runAsUser: 1000
  runAsGroup: 2000
  fsGroup: 3000

8. Using Network Policies

Property Description Value
networkPolicyEnabled Network policy enabled true
policyType Type of network policy ingress, egress
allowedCIDR Allowed CIDR ranges 10.0.0.0/8

Example: Network Policy in Chart

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-internal
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - ipBlock:
            cidr: 10.0.0.0/8

9. Scanning Charts for Vulnerabilities

Property Description Value
scanner Vulnerability scanner used Trivy
vulnerabilitiesFound Number of vulnerabilities found 2
severityLevel Severity level of vulnerabilities high

Example: Scanning Chart for Vulnerabilities

trivy chart myapp-1.0.0.tgz

10. Following Security Best Practices

Best Practice Description Status
useLatestVersion Use latest stable version of chart enabled
signCharts Sign all charts before deployment enabled
scanForVulnerabilities Scan charts for vulnerabilities enabled

Summary of Best Practices

  • Sign all charts before deployment
  • Scan charts for vulnerabilities using Trivy or similar tools
  • Use latest stable versions of charts and dependencies
  • Implement RBAC and network policies in charts

11. Validating Image Sources

Property Description Value
imageSource Image source URL registry.example.com/myapp:1.0.0
imageDigest Image digest for verification sha256:abc123...
imageRegistry Image registry used registry.example.com

Example: Validating Image Source

image:
  repository: registry.example.com/myapp
  tag: 1.0.0
  digest: sha256:abc123...

Was this article helpful?

Related Cheat Sheets