How do you secure and manage third-party Helm charts and container images?

One lightweight option is to vendor the charts into your configuration repository with a tool such as vendir. That gives you a reviewed, versioned copy of each chart and makes changes visible in normal code review. You can combine that with automated scanning in CI rather than trying to inspect everything manually.

Keep a declarative list of the charts and images you approve in a configuration repository. A pipeline can fetch them, scan the images, and publish approved artifacts to an internal registry. Deployments then reference the internal registry instead of pulling directly from public registries. This also lets you enforce immutable tags and avoid accidentally replacing an existing artifact when an upstream publisher reuses a tag.

Don’t plan on manually rebuilding and maintaining every image pulled by every chart. That quickly becomes a full-time maintenance project for a small team. A more manageable approach is to pin versions, mirror the upstream artifacts, scan them, monitor for newly disclosed vulnerabilities, and only rebuild or replace images when your risk policy requires it.

For the images, scan them with something like Trivy before allowing a new version into your internal registry. For the Helm templates and Kubernetes configuration themselves, use a policy or misconfiguration scanner such as KICS. Put both checks into the release pipeline so the process is repeatable.