<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-helm-chart-security
description: >-
  Audit Helm charts for security misconfigurations including insecure defaults,
  exposed secrets in values, missing security contexts, RBAC over-provisioning,
  and unsigned chart provenance in Helm repositories.
domain: cybersecurity
subdomain: cloud-native-security
tags:
  - helm
  - chart-security
  - supply-chain
  - rbac
  - security-context
  - values-audit
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1610"]
---

# Auditing Helm Chart Security

## Overview

Helm charts package Kubernetes manifests with default values that often ship
insecure — privileged containers, missing network policies, hardcoded secrets,
and over-permissive RBAC. This skill audits charts pre-deploy and validates
chart provenance via signature verification.

Mode: `[MODE: BLUE]` — Audit chart security. `[MODE: ARCHITECT]` — Secure chart design.

## Prerequisites

| Requirement | Details |
|---|---|
| Helm >= 3.14 installed | Required |
| kubectl access to target cluster | Required |
| Chart source (local directory or repository URL) | Required |

## Key Concepts

### Scan Chart Templates

```bash
# Render templates without installing
helm template my-release ./chart --namespace production | \
  kubectl apply --dry-run=server -f -

# Check for hardcoded secrets in values
grep -rn "password\|secret\|token\|key" chart/values.yaml

# Render and scan with kubesec
helm template my-release ./chart | kubesec scan -
```

### Verify Chart Provenance

```bash
# Verify chart signature
helm verify ./chart-0.1.0.tgz

# Pull with provenance check
helm pull repo/chart --verify --keyring pubkeys.gpg

# Check chart digest
helm show chart repo/chart | grep -i digest
```

### Security Context Audit

```bash
# Find containers without readOnlyRootFilesystem
helm template my-release ./chart -o json | \
  jq '.. | .securityContext? // empty |
  select(.readOnlyRootFilesystem != true)'

# Check for resource limits
helm template my-release ./chart -o json | \
  jq '.. | .resources? // empty | select(.limits == null)'
```

### RBAC Template Audit

```bash
# Extract RBAC resources from chart
helm template my-release ./chart | \
  yq eval 'select(.kind == "ClusterRole" or .kind == "Role")' -

# Find wildcard rules in chart RBAC
helm template my-release ./chart -o json | \
  jq '.. | select(.kind? == "ClusterRole") |
  .rules[] | select(.verbs[]? == "*" or .resources[]? == "*")'
```

## Workflow

```bash
node scripts/agent.js --action audit --chart ./my-chart
cat /tmp/helm-audit.json | jq '.findings[] | select(.severity == "high")'
helm template my-release ./my-chart -f hardened-values.yaml | kubectl apply --dry-run=server -f -
```

## Detection

```yaml
title: Auditing Helm Chart Security Detection
id: ba562bb5-60d9-4977-89a1-6d230dd9de1e
status: experimental
description: Detects suspicious activity related to auditing helm chart security techniques in cloud native security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1610
  - attack.privilege_escalation
falsepositives:
  - Kubernetes controller reconciliation loops during cluster updates
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Auditing Helm Chart Security Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1610 |

## Verification

- [ ] No hardcoded secrets in values.yaml or templates
- [ ] All containers define securityContext with runAsNonRoot, readOnlyRootFilesystem
- [ ] Resource limits and requests set for every container
- [ ] RBAC templates follow least-privilege (no wildcards)
- [ ] Chart provenance verified via Helm GPG signature
- [ ] NetworkPolicy templates included in chart

## References

- [Helm Security Best Practices](https://helm.sh/docs/chart_best_practices/)
- [Helm Provenance and Integrity](https://helm.sh/docs/topics/provenance/)
- [Kubesec — Kubernetes Resource Analyzer](https://kubesec.io/)
- [CIS Kubernetes Benchmark — RBAC](https://www.cisecurity.org/benchmark/kubernetes)
