メニュー
Secure Helm chart deployments by validating chart integrity, scanning templates for misconfigurations, and enforcing security contexts in Kubernetes releases. Use when working with securing helm chart deployments.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/oyi77/1ai-skills --skill securing-helm-chart-deploymentsコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Android and mobile application security testing — emulators, rooting, traffic interception, dynamic instrumentation. Use when testing mobile apps for vulnerabilities, reversing APKs, or bypassing security controls on Android.
Self-reflection + Self-criticism + Auto-learning from corrections + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when working with self improving.
Plan and execute a comprehensive red team engagement covering reconnaissance through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's detection and response capabilities. Use when working with conducting full scope red team engagement.
SOC 職業分類に基づく
SKILL.md を表示中
| name | securing-helm-chart-deployments |
| description | Secure Helm chart deployments by validating chart integrity, scanning templates for misconfigurations, and enforcing security contexts in Kubernetes releases. Use when working with securing helm chart deployments. |
| domain | cybersecurity |
| subdomain | container-security |
| tags | ["helm","kubernetes","chart-security","supply-chain","configuration-security","deployment"] |
| version | 1.0 |
| author | oyi77 |
| license | Apache-2.0 |
| nist_csf | ["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"] |
Helm is the Kubernetes package manager. Securing Helm deployments requires validating chart provenance, scanning templates for security misconfigurations, enforcing pod security contexts, managing secrets securely, and controlling RBAC for Helm operations.
Trigger phrases:
"securing helm chart deployments"
"Secure Helm chart deployments by validating chart integrity, scanning templates "
When deploying or configuring securing helm chart deployments capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
This section covers chart provenance and integrity for securing helm chart deployments.
# Generate GPG key for signing
gpg --full-generate-key
# Package and sign chart
helm package ./mychart --sign --key "helm-signing@example.com" --keyring ~/.gnupg/pubring.gpg
# Verify chart signature
helm verify mychart-0.1.0.tgz --keyring ~/.gnupg/pubring.gpg
# Verify chart from repository
helm pull myrepo/mychart --verify --keyring /path/to/keyring.gpg
# Check chart provenance file
cat mychart-0.1.0.tgz.prov
This section covers template security scanning for securing helm chart deployments.
# Render templates without deploying
helm template myrelease ./mychart --values values-prod.yaml > rendered.yaml
# Scan with kubesec
kubesec scan rendered.yaml
# Scan with checkov
checkov -f rendered.yaml --framework kubernetes
# Scan with trivy
trivy config rendered.yaml
# Scan with kube-linter
kube-linter lint rendered.yaml
# Lint chart
helm lint ./mychart --values values-prod.yaml --strict
# Lint with debug output
helm lint ./mychart --debug
# values.yaml - Security hardened defaults
securityContext:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 3000
fsGroup: 2000
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
podSecurityContext:
seccompProfile:
type: RuntimeDefault
resources:
limits:
cpu: 500m
memory: 512Mi
requests:
cpu: 100m
memory: 128Mi
networkPolicy:
enabled: true
serviceAccount:
create: true
automountServiceAccountToken: false
image:
pullPolicy: Always
# Use digest instead of tag for immutability
# tag: "1.0.0"
# digest: "sha256:abc123..."
# templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "mychart.fullname" . }}
spec:
template:
spec:
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
containers:
- name: {{ .Chart.Name }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
resources:
{{- toYaml .Values.resources | nindent 12 }}
This section covers secrets management for securing helm chart deployments.
# templates/external-secret.yaml
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: {{ include "mychart.fullname" . }}-secrets
spec:
refreshInterval: 1h
secretStoreRef:
name: aws-secretsmanager
kind: ClusterSecretStore
target:
name: {{ include "mychart.fullname" . }}-secrets
data:
- secretKey: db-password
remoteRef:
key: production/database
property: password
# Install helm-secrets plugin
helm plugin install https://github.com/jkroepke/helm-secrets
# Encrypt values file
helm secrets encrypt values-secrets.yaml
# Deploy with encrypted secrets
helm secrets install myrelease ./mychart -f values.yaml -f values-secrets.yaml
# Decrypt for editing
helm secrets edit values-secrets.yaml
# helm-deployer-role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: helm-deployer
namespace: production
rules:
- apiGroups: ["", "apps", "batch", "networking.k8s.io"]
resources: ["deployments", "services", "configmaps", "secrets", "ingresses", "jobs"]
verbs: ["get", "list", "create", "update", "patch", "delete"]
- apiGroups: [""]
resources: ["pods", "pods/log"]
verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: helm-deployer-binding
namespace: production
subjects:
- kind: ServiceAccount
name: helm-deployer
namespace: production
roleRef:
kind: Role
name: helm-deployer
apiGroup: rbac.authorization.k8s.io
# .github/workflows/helm-security.yaml
name: Helm Chart Security
on:
pull_request:
paths: ['charts/**']
jobs:
lint-and-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Helm lint
run: helm lint ./charts/mychart --strict
- name: Render templates
run: helm template test ./charts/mychart -f charts/mychart/values.yaml > rendered.yaml
- name: Scan with kube-linter
uses: stackrox/kube-linter-action@v1
with:
directory: rendered.yaml
- name: Scan with trivy
uses: aquasecurity/trivy-action@master
with:
scan-type: config
scan-ref: rendered.yaml
- name: Scan with checkov
uses: bridgecrewio/checkov-action@master
with:
file: rendered.yaml
framework: kubernetes
latest--strict flag| Rationalization | Reality |
|---|---|
| "We are too small to be targeted" | Automated attacks target everyone. Size does not matter. |
| "Security slows us down" | A breach slows you down 100x more. Build security in from the start. |
| "We will fix it after launch" | Vulnerabilities in production are exploited within hours. Fix before deploy. |