What problem does it solve?
Helm charts often ship with hardened defaults that silently vanish before reaching the cluster: security contexts in values.yaml that templates never render, overrides that re-enable privileged mode, and unverified chart provenance. This Skill provides the commands and patterns to verify that security controls actually survive into the deployed release.
Core Features & Use Cases
- Chart Provenance Verification: Sign charts with GPG and verify signatures with helm verify before installation to protect the supply chain.
- Rendered Manifest Scanning: Render templates with production values and scan the output with kubesec, trivy, checkov, and kube-linter to catch values-driven misconfigurations.
- Security Context Enforcement: Apply hardened values.yaml defaults including runAsNonRoot, readOnlyRootFilesystem, dropped capabilities, and seccomp profiles, then confirm they persist in the live release.
- Use Case: Before promoting a third-party chart to production, render it with your exact prod values, scan the rendered YAML, verify the GPG signature, and confirm the pod securityContext on the live cluster matches expectations.
Quick Start
Render my Helm chart with the production values file and scan the output for security misconfigurations, then verify the chart signature before installing.
