Charts

25 charts

Stacks charts

Hardened Helm charts in the stacks category. Each deploys our hardened image pinned by its signed digest, with production defaults.

0 CVE
mysql-ha-stack
Operator-managed HA MySQL-compatible database in one install: MariaDB Operator + a 3-node Galera cluster (synchronous multi-primary replication,…
chart v0.0.2 · app v26.10.1
StacksstandardUnknown
0 CVE
observability-stack
Hardened, operator-free observability stack: Prometheus + Grafana + Alertmanager + kube-state-metrics + node-exporter + cAdvisor, wired together for…
chart v0.0.23 · app v2.20.0
StacksstandardUnknown
0 CVE
pki-stack
Hardened internal PKI in one install: step-ca (your own certificate authority) + cert-manager (certificate lifecycle) + step-issuer (cert-manager…
chart v0.0.2 · app v1.0.0
StacksstandardUnknown
0 CVE
policy-stack
Hardened Kubernetes policy in one install: Kyverno (admission policies and background scans that write PolicyReports) + Policy Reporter (those…
chart v0.0.4 · app v1.0.0
StacksstandardUnknown
0 CVE
postgres-ha-stack
Hardened PostgreSQL HA stack: a 3-node Patroni cluster with automatic failover, PgBouncer pooling in front of the elected leader, postgres_exporter…
chart v0.0.7 · app v1.0.0
StacksstandardUnknown
0 CVE
profiling-stack
Hardened continuous profiling stack: Grafana Pyroscope (profile store and query) + Grafana with the Pyroscope datasource provisioned.
chart v0.0.2 · app v1.0.0
StacksstandardUnknown
0 CVE
registry-stack
One self-hosted artifact registry in one install: Harbor (container images and OCI Helm charts, with Trivy scanning) + Terralist (a private…
chart v0.0.2 · app v1.0.0
StacksstandardUnknown
0 CVE
search-stack
Hardened search with a UI in one install: OpenSearch (search and analytics engine, HA cluster or one node) + OpenSearch Dashboards (Discover,…
chart v0.0.2 · app v3.8.0
StacksstandardUnknown
0 CVE
secrets-stack
OpenBao behind Keycloak sign-in: OpenBao auto-unseals and configures itself on first start (KV v2, OIDC for people, JWT for workloads, a break-glass…
chart v0.0.10 · app v1.0.0
StacksstandardUnknown
0 CVE
sigstore-stack
Self-hosted Sigstore: the Fulcio certificate authority, the Rekor v2 transparency log and the Timestamp Authority in one install, for keyless signing…
chart v0.0.4 · app v1.0.0
StacksstandardUnknown
0 CVE
streaming-stack
Hardened event-streaming stack: a KRaft Kafka cluster, the Karapace schema registry and REST proxy, and the AKHQ web console, wired together in one…
chart v0.0.9 · app v1.0.0
StacksstandardUnknown
0 CVE
supply-chain-stack
Admission-time supply-chain control: Kyverno admits only QuenchWorks images signed by the QuenchWorks build workflows (cosign keyless, checked…
chart v0.0.4 · app v1.0.0
StacksstandardUnknown