How do you secure and manage third-party Helm charts and container images?
Asked by
MellowOrbit42
For cluster infrastructure such as External Secrets Operator, Argo CD, and similar tools, what is a practical way to scan, harden, and manage the Helm charts and container images they require? A small team may need several charts, each pulling multiple images, and I'm trying to understand whether teams mirror and rebuild everything internally, scan only what they deploy, or follow another process. Is comprehensive management realistic for a team of one or two people without paying for a managed security service?
Answers
For the images, scan them with something like Trivy before allowing a new version into your internal registry. For the Helm templates and Kubernetes configuration themselves, use a policy or misconfiguration scanner such as KICS. Put both checks into the release pipeline so the process is repeatable.
Reply to this answer
Don’t plan on manually rebuilding and maintaining every image pulled by every chart. That quickly becomes a full-time maintenance project for a small team. A more manageable approach is to pin versions, mirror the upstream artifacts, scan them, monitor for newly disclosed vulnerabilities, and only rebuild or replace images when your risk policy requires it.
Reply to this answer
Keep a declarative list of the charts and images you approve in a configuration repository. A pipeline can fetch them, scan the images, and publish approved artifacts to an internal registry. Deployments then reference the internal registry instead of pulling directly from public registries. This also lets you enforce immutable tags and avoid accidentally replacing an existing artifact when an upstream publisher reuses a tag.
Reply to this answer
One lightweight option is to vendor the charts into your configuration repository with a tool such as vendir. That gives you a reviewed, versioned copy of each chart and makes changes visible in normal code review. You can combine that with automated scanning in CI rather than trying to inspect everything manually.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions