<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-helm-chart-security
description: >-
  Audit Helm charts for security misconfigurations including insecure defaults,
  missing security contexts, exposed services, hardcoded secrets, and non-compliant
  pod specifications using automated scanning and manual review techniques.
domain: cybersecurity
subdomain: container-security
tags:
  - helm
  - chart-security
  - template-audit
  - supply-chain
  - kubernetes
  - configuration-review
  - checkov
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1610"]
---

# Auditing Helm Chart Security

## Overview

Helm charts package Kubernetes manifests with configurable values, but insecure
defaults, missing security contexts, hardcoded secrets, and overly permissive
RBAC create risks when charts are deployed without review. This skill covers
automated scanning with Checkov, Kubeaudit, and Pluto, manual template review
techniques, and supply chain verification for third-party charts.

Mode: `[MODE: BLUE]` — Configuration security audit.

## Prerequisites

| Requirement | Details |
|---|---|
| Helm >= 3.14 installed | Required |
| Checkov >= 3.0 for IaC scanning | Required |
| `kubeaudit` for Kubernetes manifest auditing | Required |
| `pluto` for deprecated API detection | Required |
| Access to chart source or rendered templates | Required |

## Key Concepts

### Core Techniques

Refer to the parent container-security skill for detailed command references and
attack/defense techniques relevant to this area.

```bash
# Run the automated audit agent
node scripts/agent.js --action audit --output /tmp/auditing-helm-chart-security-audit.json
```

### Automation

The `scripts/agent.js` tool provides automated scanning and analysis capabilities.
See `references/api-reference.md` for complete tool and API documentation.

## Workflow

### Step 1: Collect Data

```bash
node scripts/agent.js --action audit --output /tmp/auditing-helm-chart-security-results.json
```

### Step 2: Review Findings

```bash
cat /tmp/auditing-helm-chart-security-results.json | jq '.findings[] | select(.severity == "critical" or .severity == "high")'
```

### Step 3: Remediate

Address findings by severity, starting with critical items. Re-run the audit
to verify remediation effectiveness.

## Detection

```yaml
title: Auditing Helm Chart Security Detection
id: 62e8c3ca-9245-4c28-b44d-dce95226ff52
status: experimental
description: Detects suspicious activity related to auditing helm chart security techniques in container security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1610
  - attack.execution
falsepositives:
  - Container orchestration platform performing routine health checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Auditing Helm Chart Security Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1610 |

## Verification

- [ ] Automated scan completed with zero critical findings
- [ ] All high-severity findings have remediation plans
- [ ] Configuration changes validated in staging before production
- [ ] Detection rules deployed and alerting verified
- [ ] Documentation updated with current security posture

## References

- [Helm Security Best Practices](https://helm.sh/docs/chart_best_practices/)
- [Checkov Helm Scanning](https://www.checkov.io/7.Scan%20Examples/Helm.html)
- [Artifact Hub Security](https://artifacthub.io/)
