How do you secure and scan third-party Helm charts and images?
Asked by
MellowPine47
For cluster infrastructure such as External Secrets Operator and Argo CD, I may need several third-party Helm charts, each pulling multiple container images. Aside from paying for a managed option like Chainguard, how are small teams handling chart and image scanning, hardening, provenance, and artifact management? Is it practical for a team of one or two people to manage this themselves, or is there a more sustainable workflow?
Answers
For container images, use an internal registry and run a scanner such as Trivy before promoting new versions. If you also want to check the Helm templates and configuration, tools like KICS can scan the chart output or related infrastructure code.
Reply to this answer
One lightweight approach is to use a tool such as vendir to pull the Helm charts into a configuration repository and commit the exact versions there. That gives you reproducible inputs and makes upgrades visible in code review.
Reply to this answer
Keep a declarative list of approved charts and images in a Git repository. A pipeline downloads them, scans the images, and copies approved artifacts into an internal registry. Deployments reference only that registry. This also lets you enforce immutable tags and avoid accidentally replacing an existing artifact when an upstream chart or image changes unexpectedly.
Reply to this answer
I would avoid rebuilding and maintaining every image pulled by these charts yourself. That can quickly turn into a full-time maintenance task. A more manageable model is to pin versions, scan and promote upstream artifacts, mirror them internally, and only rebuild when there is a specific vulnerability or compliance requirement.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions