Securing Helm Chart Deployments
Overview
Helm is the Kubernetes package manager. Securing Helm deployments requires validating chart provenance, scanning templates for security misconfigurations, enforcing pod security contexts, managing secrets securely, and controlling RBAC for Helm operations.
When to Use
- When deploying or configuring securing helm chart deployments capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Common Misconfigurations & Verification
The trap with Helm is that hardened values.yaml defaults are silently dropped before they reach the cluster:
- Values that never render: a
securityContext block in values.yaml does nothing unless the template actually references it ({{- toYaml .Values.securityContext | nindent 12 }}). Many third-party charts ignore your values or nest them under a different key, so runAsNonRoot/readOnlyRootFilesystem/drop: [ALL] quietly vanish.
- Overrides win last: a later
-f values-prod.yaml or --set can re-enable privileged, hostNetwork, or automountServiceAccountToken: true; the effective manifest is what matters, not the chart default.
- Scanning the chart, not the release: running kubesec/trivy on the chart source misses values-driven config - always scan the rendered output.
- Unverified provenance / mutable images:
helm install without --verify, or image.tag instead of a digest, breaks supply-chain assumptions.
Verify: render with the exact prod values (helm template <rel> ./chart -f values-prod.yaml > rendered.yaml) and scan that file (kubesec scan rendered.yaml, trivy config rendered.yaml, kube-linter lint rendered.yaml); then confirm on the live release with helm get manifest <rel> and kubectl get pod <p> -o jsonpath='{.spec.containers[*].securityContext}' that the context survived. Confirm helm verify/--verify passes against a known-good keyring.
Prerequisites
- Helm 3.12+ installed
- kubectl with cluster access
- GnuPG for chart signing/verification
- kubesec or checkov for template scanning
Chart Provenance and Integrity
Sign a Helm Chart
gpg --full-generate-key
helm package ./mychart --sign --key "helm-signing@example.com" --keyring ~/.gnupg/pubring.gpg
helm verify mychart-0.1.0.tgz --keyring ~/.gnupg/pubring.gpg
Verify Chart Before Install
helm pull myrepo/mychart --verify --keyring /path/to/keyring.gpg
cat mychart-0.1.0.tgz.prov
Template Security Scanning
Render and Scan Templates
helm template myrelease ./mychart --values values-prod.yaml > rendered.yaml
kubesec scan rendered.yaml
checkov -f rendered.yaml --framework kubernetes
trivy config rendered.yaml
kube-linter lint rendered.yaml
Helm Lint for Misconfigurations
helm lint ./mychart --values values-prod.yaml --strict
helm lint ./mychart --debug
Security Context Enforcement in values.yaml
securityContext:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 3000
fsGroup: 2000
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
podSecurityContext:
seccompProfile:
type: RuntimeDefault
resources:
limits:
cpu: 500m
memory: 512Mi
requests:
cpu: 100m
memory: 128Mi
networkPolicy:
enabled: true
serviceAccount:
create: true
automountServiceAccountToken: false
image:
pullPolicy: Always
Template with Security Contexts
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "mychart.fullname" . }}
spec:
template:
spec:
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
containers:
- name: {{ .Chart.Name }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
resources:
{{- toYaml .Values.resources | nindent 12 }}
Secrets Management
Use External Secrets (Not Helm Values)
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: {{ include "mychart.fullname" . }}-secrets
spec:
refreshInterval: 1h
secretStoreRef:
name: aws-secretsmanager
kind: ClusterSecretStore
target:
name: {{ include "mychart.fullname" . }}-secrets
data:
- secretKey: db-password
remoteRef:
key: production/database
property: password
helm-secrets Plugin
helm plugin install https://github.com/jkroepke/helm-secrets
helm secrets encrypt values-secrets.yaml
helm secrets install myrelease ./mychart -f values.yaml -f values-secrets.yaml
helm secrets edit values-secrets.yaml
RBAC for Helm Operations
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: helm-deployer
namespace: production
rules:
- apiGroups: ["", "apps", "batch", "networking.k8s.io"]
resources: ["deployments", "services", "configmaps", "secrets", "ingresses", "jobs"]
verbs: ["get", "list", "create", "update", "patch", "delete"]
- apiGroups: [""]
resources: ["pods", "pods/log"]
verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: helm-deployer-binding
namespace: production
subjects:
- kind: ServiceAccount
name:
CI/CD Helm Security Pipeline
name: Helm Chart Security
on:
pull_request:
paths: ['charts/**']
jobs:
lint-and-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Helm lint
run: helm lint ./charts/mychart --strict
- name: Render templates
run: helm template test ./charts/mychart -f charts/mychart/values.yaml > rendered.yaml
- name: Scan with kube-linter
uses: stackrox/kube-linter-action@v1
with:
directory: rendered.yaml
- name: Scan with trivy
uses: aquasecurity/trivy-action@master
Best Practices
- Sign charts with GPG and verify before installation
- Render and scan templates before deploying to catch misconfigurations
- Enforce security contexts in values.yaml defaults
- Never store secrets in Helm values - use external secrets or helm-secrets plugin
- Use image digests instead of tags for immutable references
- Restrict Helm RBAC to least privilege per namespace
- Pin chart versions in requirements - never use
latest
- Lint strictly in CI with
--strict flag
- Review third-party charts before deploying to production
- Use Helm test hooks to validate deployments post-install
