Charts

136 charts

Hardened Helm charts

Each chart deploys our hardened image pinned by its signed digest, with sensible production defaults. Cosign-signed and published as an ArtifactHub verified publisher. 136 charts.

A+
airflow
Apache Airflow, the programmatic workflow orchestration platform for authoring, scheduling, and monitoring DAGs. Built clean-room from source as a Python venv on Wolfi (python-3.12, official constraints), nonroot on a hardened read-only-rootfs base. Ships the 3.2 line (older lines carry unfixed CVEs in Airflow itself). Runs api-server + scheduler + dag-processor + triggerer (and Celery workers) from one image; needs PostgreSQL (and Redis for CeleryExecutor), provided by the chart.
chart v0.1.6 · app v3.3.0
WorkflowstandardApache-2.0
B 2
Alertmanager
Companion to Prometheus that routes, groups, deduplicates, and silences alerts and dispatches them to email, Slack, PagerDuty, and more.
chart v0.0.10 · app v0.33.1
ObservabilitystandardApache-2.0
D 3
Atlantis
Terraform pull-request automation that runs plan on PRs and apply from PR comments, enforcing reviewed, Git-driven infrastructure changes with state locking.
chart v0.0.12 · app v0.46.0
GitOpsstandardApache-2.0
B 1
authelia
Open-source authentication and authorization server providing single sign-on and two-factor authentication via a web portal, designed as a companion for reverse proxies. Packaged from Authelia's official prebuilt binary; needs a config plus a SQLite or PostgreSQL storage backend.
chart v0.0.11 · app v4.39.20
IdentitystandardApache-2.0
B 1
authentik
Self-hosted identity provider (OIDC, SAML, LDAP, SCIM) with flows, policies, and application/provider management. Built clean-room from source on Wolfi as a four-language image (nodejs web UI, Go server/proxy, Rust worker, Python/Django core via uv) on a hardened nonroot base; FIPS mode is not forced and the license-gated MaxMind GeoIP download is omitted. Needs PostgreSQL and Redis at runtime, provided by the chart.
chart v0.1.9 · app v2026.5.6
Secrets & identitystandardMIT
B 1
Caddy
Web server and reverse proxy with fully automatic HTTPS via Let's Encrypt and a simple Caddyfile config.
chart v0.0.12 · app v2.11.4
GatewaystandardApache-2.0
B 2
cadence
Fault-tolerant, stateful workflow orchestration engine by Uber. Ships the cadence server and CLI as static Go binaries on a hardened nonroot Wolfi base; Cassandra or a SQL store is the operator's concern.
chart v0.0.6 · app v1.4.1
WorkflowstandardMIT
A+
Cassandra
Distributed wide-column NoSQL store built for linear horizontal scale and high availability with no single point of failure, tuned for heavy writes.
chart v0.0.14 · app v5.0.8
Wide-columnstandardApache-2.0
B 1
centrifugo
Scalable real-time messaging server (WebSocket, SSE, GRPC) with channels, presence, and JWT auth. Built from source as a static Go binary on a hardened nonroot Wolfi base.
chart v0.0.6 · app v6.9.1
MessagingstandardApache-2.0
0 CVE
cert-manager
Hardened cert-manager image, built from source on Wolfi.
chart v0.0.5 · app v1.21.0
DatastorestandardUnknown
A+
ClickHouse
Column-oriented OLAP database for real-time analytical queries over very large datasets, with high ingest rates and fast aggregations.
chart v0.0.12 · app v26.7.1.1315
AnalyticalstandardApache-2.0
0 CVE
CockroachDB
Hardened cockroachdb image, built from source on Wolfi.
chart v0.0.7 · app v26.2.2
DatastorestandardUnknown