Charts

280 charts

Hardened Helm charts

Each chart deploys our hardened image pinned by its signed digest, with sensible production defaults. Cosign-signed and published as an ArtifactHub verified publisher. 280 charts.

A 2
spire
SPIRE, the SPIFFE runtime that attests nodes and workloads and issues them short-lived X.509 and JWT identities (spire-server and spire-agent in one…
chart v · app v1.15.3
IdentitystandardApache-2.0
A+
squid
Caching forward proxy for HTTP and HTTPS (CONNECT). Pods reach the outside through it, and it caches repeat fetches in memory. The default config…
chart v · app v7.6
CachestandardGPL-2.0+
A 2
step-ca
Online private certificate authority and ACME server for issuing X.509 and SSH certificates. Single static Go binary on a hardened nonroot Wolfi…
chart v · app v0.30.2
Security & supply chainstandardApache-2.0
A 1
step-issuer
step-issuer, smallstep's cert-manager external issuer. StepIssuer and StepClusterIssuer resources sign cert-manager CertificateRequests through a…
chart v · app v0.12.0
Security & supply chainstandardApache-2.0
0 CVE
streaming-stack
Hardened event-streaming stack: a KRaft Kafka cluster, the Karapace schema registry and REST proxy, and the AKHQ web console, wired together in one…
chart v0.0.9 · app v1.0.0
StacksstandardUnknown
0 CVE
supply-chain-stack
Admission-time supply-chain control: Kyverno admits only QuenchWorks images signed by the QuenchWorks build workflows (cosign keyless, checked…
chart v0.0.4 · app v1.0.0
StacksstandardUnknown
A 3
tekton
Kubernetes-native CI/CD pipelines. Ships the Tekton Pipelines controller, webhook, resolvers, and pod-injected helper binaries, built from source on…
chart v · app v1.17.0
CI/CD & registrystandardApache-2.0
A 1
Tempo
Distributed tracing backend from Grafana that ingests OpenTelemetry, Jaeger, and Zipkin spans and stores them cheaply in object storage. Licensed…
chart v · app v3.0.3
ObservabilitystandardAGPL-3.0
A 3
Temporal
Durable workflow orchestration engine that persists execution state so long-running, multi-step processes survive crashes and resume exactly where…
chart v · app v1.32.0
WorkflowstandardMIT
A 1
terralist
Terralist, a private Terraform and OpenTofu registry for modules and providers (registry protocol, web UI, OAuth login, API keys). Built from source,…
chart v · app v0.11.0
RegistrystandardMPL-2.0
A+
tetragon
Tetragon eBPF runtime-security agent and the tetra CLI, built from source. Watches process execution, file access and network activity in the kernel,…
chart v · app v1.7.1
Security & supply chainstandardApache-2.0
A 1
thanos
Highly-available Prometheus setup with unlimited metric retention via object storage, adding a global query view, downsampling, and compaction across…
chart v · app v0.42.4
ObservabilitystandardApache-2.0