Charts

140 charts

Hardened Helm charts

Each chart deploys our hardened image pinned by its signed digest, with sensible production defaults. Cosign-signed and published as an ArtifactHub verified publisher. 140 charts.

B 1
sealed-secrets
Sealed Secrets, the controller that lets you commit encrypted secrets to Git safely. A cluster-side private key decrypts SealedSecret resources into ordinary Kubernetes Secrets, so the encrypted form is the only thing that ever leaves the cluster.
chart v · app v0.38.4
Security & supply chainstandardApache-2.0
B 1
SeaweedFS
Fast distributed storage for blobs, objects, and files (S3 API) built on Facebook's Haystack design, with O(1) disk seeks for billions of small files. Default object store after MinIO restricted its community edition.
chart v · app v4.40
Object storagestandardApache-2.0
0 CVE
skywalking
Hardened skywalking image, built from source on Wolfi.
chart v0.0.4 · app v10.4.0
DatastorestandardUnknown
D 4
Solr
Enterprise search platform built on Apache Lucene, offering full-text search, faceting, and indexing over large document collections.
chart v · app v10.0.0
SearchlowApache-2.0
B 1
spicedb
Zanzibar-style authorization database for fine-grained permissions over gRPC. From source on a hardened nonroot Wolfi base; the operator supplies the datastore (in-memory, postgres, or cockroach).
chart v · app v1.56.0
IdentitystandardApache-2.0
B 2
step-ca
Online private certificate authority and ACME server for issuing X.509 and SSH certificates. Single static Go binary on a hardened nonroot Wolfi base; config and data live under a writable volume.
chart v · app v0.30.2
Security & supply chainstandardApache-2.0
B 1
Tempo
Distributed tracing backend from Grafana that ingests OpenTelemetry, Jaeger, and Zipkin spans and stores them cheaply in object storage. Licensed AGPL.
chart v · app v3.0.2
ObservabilitystandardAGPL-3.0
B 3
Temporal
Durable workflow orchestration engine that persists execution state so long-running, multi-step processes survive crashes and resume exactly where they left off.
chart v · app v1.31.2
WorkflowstandardMIT
0 CVE
thanos
Hardened thanos image, built from source on Wolfi.
chart v0.0.9 · app v0.42.4
DatastorestandardUnknown
A+
tigerbeetle
Distributed financial-grade accounting database for high-throughput double-entry bookkeeping. Ships a single self-contained static Zig binary; speaks its own binary protocol (not HTTP) on port 3000.
chart v · app v0.17.9
DatabasestandardApache-2.0
A+
timescaledb
PostgreSQL 17 plus the open TimescaleDB extension (Apache-only edition), adding hypertables, continuous aggregates, and time-series functions for high-ingest metrics and event data. Built clean-licensed from source on Wolfi (no TSL community code).
chart v · app v2.29.0
Time seriesstandardApache-2.0
C 3
tomcat
Apache Tomcat, the widely used open-source Java servlet container and web/application server for running Jakarta Servlet, JSP, and WebSocket web applications.
chart v · app v11.0.24
GatewaycriticalApache-2.0