<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Helm Chart Security — API Reference

## Helm CLI

```bash
# Render templates to stdout
helm template RELEASE CHART [--namespace NS] [-f values.yaml]

# Dry-run install against cluster
helm install RELEASE CHART --dry-run --debug

# Verify chart signature
helm verify CHART.tgz [--keyring pubkeys.gpg]

# Pull with verification
helm pull REPO/CHART --verify --keyring pubkeys.gpg

# Show chart metadata and values
helm show chart REPO/CHART
helm show values REPO/CHART
```

## Chart Structure

| Path | Description |
|------|-------------|
| `Chart.yaml` | Metadata (name, version, appVersion) |
| `values.yaml` | Default configuration values |
| `templates/` | Kubernetes manifest templates |
| `templates/NOTES.txt` | Post-install instructions |
| `charts/` | Dependency sub-charts |

## Security-Critical Values

| Pattern | Risk | Recommendation |
|---------|------|----------------|
| `password:` | Critical | Use external secrets operator |
| `privileged: true` | Critical | Set to false |
| `runAsRoot: true` | High | Use runAsNonRoot |
| `hostNetwork: true` | High | Disable for workloads |
| `resources: {}` | Medium | Define limits and requests |
