Security & Best Practices

Hardening Helm charts with Pod Security Standards, least-privilege RBAC, supply chain verification, and policy enforcement.

Lesson 20 — Helm Charts: From Templates to Production Kubernetes

Pod Security Standards & securityContext

Kubernetes defines three Pod Security Standards. Target Restricted for all production workloads.

# templates/deployment.yaml
spec:
  template:
    spec:
      securityContext:                          # Pod-level
        runAsNonRoot: {{ .Values.podSecurityContext.runAsNonRoot | default true }}
        fsGroup: {{ .Values.podSecurityContext.fsGroup | default 1000 }}
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: {{ .Chart.Name }}
          securityContext:                      # Container-level
            readOnlyRootFilesystem: {{ .Values.securityContext.readOnlyRootFilesystem | default true }}
            allowPrivilegeEscalation: {{ .Values.securityContext.allowPrivilegeEscalation | default false }}
            capabilities:
              drop: ["ALL"]

Image Pull Secrets & Private Registries

Authenticate to private container registries using imagePullSecrets. Two approaches:

spec:
  template:
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}

# values.yaml
imagePullSecrets:
  - name: registry-creds

apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "myapp.fullname" . }}
imagePullSecrets:
  - name: {{ .Values.registry.secretName }}

Least-Privilege RBAC

Every application should run under its own ServiceAccount with only the permissions it needs — never use the default ServiceAccount.

# templates/role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ include "myapp.fullname" . }}
rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "watch"]
    resourceNames: ["{{ include "myapp.fullname" . }}-config"]   # scope to specific resources
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get"]
    resourceNames: ["{{ include "myapp.fullname" . }}-secret"]

# templates/rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ include "myapp.fullname" . }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ include "myapp.fullname" . }}
subjects:
  - kind: ServiceAccount
    name: {{ include "myapp.fullname" . }}
    namespace: {{ .Release.Namespace }}

Supply Chain Security

Protect your deployment pipeline from tampered charts and images.

• Chart signing — helm package --sign --key mykey ./mychart creates a .prov provenance file
• Chart verification — helm install --verify myrelease ./mychart-1.0.0.tgz
• Image digest pinning — use image@sha256:... instead of mutable tags
• Never use :latest — mutable tags break reproducibility

# values.yaml - pin by digest
image:
  repository: ghcr.io/myorg/myapp
  digest: "sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4"
  tag: ""    # ignored when digest is set

# templates/deployment.yaml
image: "{{ .Values.image.repository }}{{- if .Values.image.digest }}@{{ .Values.image.digest }}{{- else }}:{{ .Values.image.tag }}{{- end }}"

Resource Limits & Network Security

resources:
  requests:
    cpu: "100m"
    memory: "128Mi"
  limits:
    cpu: "500m"
    memory: "512Mi"

apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
spec:
  limits:
    - default:
        cpu: "500m"
        memory: "256Mi"
      defaultRequest:
        cpu: "100m"
        memory: "128Mi"
      type: Container

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ include "myapp.fullname" . }}
spec:
  podSelector:
    matchLabels:
      {{- include "myapp.selectorLabels" . | nindent 6 }}
  policyTypes: ["Ingress", "Egress"]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - port: 8080
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: database
      ports:
        - port: 5432
    - to:                         # Allow DNS
        - namespaceSelector: {}
      ports:
        - port: 53
          protocol: UDP

Secrets Hygiene & Policy Enforcement

# Install with runtime secrets
helm install myapp ./mychart \
  --set secrets.dbPassword="$DB_PASS" \
  --set secrets.apiKey="$API_KEY"

# Audit with kube-score
helm template myapp ./mychart | \
  kube-score score -

# Audit with Polaris
polaris audit --helm-chart ./mychart

# Gatekeeper ConstraintTemplate
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels

Chart Audit Checklist

Review every chart against these criteria before deploying to production:

• runAsNonRoot: true and readOnlyRootFilesystem: true on all containers
• allowPrivilegeEscalation: false and capabilities.drop: ["ALL"]
• Resource requests and limits set on every container
• No :latest tags — use specific versions or digests
• RBAC uses exact resources and verbs — no wildcards
• NetworkPolicies restrict both ingress and egress
• No secrets hardcoded in values.yaml or templates
• Dedicated ServiceAccount per workload (not default)
• automountServiceAccountToken: false if the app does not call the Kubernetes API