Charts

136 charts

Hardened Helm charts

Each chart deploys our hardened image pinned by its signed digest, with sensible production defaults. Cosign-signed and published as an ArtifactHub verified publisher. 136 charts.

B 1
spicedb
Zanzibar-style authorization database for fine-grained permissions over gRPC. From source on a hardened nonroot Wolfi base; the operator supplies the datastore (in-memory, postgres, or cockroach).
chart v · app v1.56.0
IdentitystandardApache-2.0
B 2
step-ca
Online private certificate authority and ACME server for issuing X.509 and SSH certificates. Single static Go binary on a hardened nonroot Wolfi base; config and data live under a writable volume.
chart v · app v0.30.2
Security & supply chainstandardApache-2.0
B 1
Tempo
Distributed tracing backend from Grafana that ingests OpenTelemetry, Jaeger, and Zipkin spans and stores them cheaply in object storage. Licensed AGPL.
chart v · app v3.0.2
ObservabilitystandardAGPL-3.0
B 3
Temporal
Durable workflow orchestration engine that persists execution state so long-running, multi-step processes survive crashes and resume exactly where they left off.
chart v · app v1.31.2
WorkflowstandardMIT
0 CVE
thanos
Hardened thanos image, built from source on Wolfi.
chart v0.0.7 · app v0.42.3
DatastorestandardUnknown
A+
tigerbeetle
Distributed financial-grade accounting database for high-throughput double-entry bookkeeping. Ships a single self-contained static Zig binary; speaks its own binary protocol (not HTTP) on port 3000.
chart v · app v0.17.9
DatabasestandardApache-2.0
A+
timescaledb
PostgreSQL 17 plus the open TimescaleDB extension (Apache-only edition), adding hypertables, continuous aggregates, and time-series functions for high-ingest metrics and event data. Built clean-licensed from source on Wolfi (no TSL community code).
chart v · app v2.29.0
Time seriesstandardApache-2.0
A+
tomcat
Apache Tomcat, the widely used open-source Java servlet container and web/application server for running Jakarta Servlet, JSP, and WebSocket web applications.
chart v · app v11.0.24
GatewaycriticalApache-2.0
0 CVE
tracing-stack
Hardened, operator-free distributed tracing stack: Tempo (trace store/query) + Grafana (Tempo datasource + trace exploration) + an OpenTelemetry Collector gateway that receives OTLP from your apps and forwards spans to Tempo.
chart v0.0.4 · app v1.0.0
StacksstandardUnknown
B 1
Traefik
Cloud-native reverse proxy and load balancer with automatic service discovery, dynamic config, and built-in Let's Encrypt TLS.
chart v · app v3.7.9
GatewaystandardMIT
B 1
tyk
Full-featured API gateway with rate limiting, auth, and quotas. Single static Go binary on a hardened nonroot Wolfi base; Redis is a runtime dependency the operator provides.
chart v · app v5.13.1
GatewaystandardMPL-2.0
A+
typesense
Fast, typo-tolerant search engine with an instant-search REST API and a self-contained embedded store (no external database), tuned for low-latency site and in-app search.
chart v · app v30.2
SearchstandardGPL-3.0