Charts

140 charts

Hardened Helm charts

Each chart deploys our hardened image pinned by its signed digest, with sensible production defaults. Cosign-signed and published as an ArtifactHub verified publisher. 140 charts.

0 CVE
tracing-stack
Hardened, operator-free distributed tracing stack: Tempo (trace store/query) + Grafana (Tempo datasource + trace exploration) + an OpenTelemetry Collector gateway that receives OTLP from your apps and forwards spans to Tempo.
chart v0.0.5 · app v1.0.0
StacksstandardUnknown
B 1
Traefik
Cloud-native reverse proxy and load balancer with automatic service discovery, dynamic config, and built-in Let's Encrypt TLS.
chart v · app v3.7.10
GatewaystandardMIT
B 1
tyk
Full-featured API gateway with rate limiting, auth, and quotas. Single static Go binary on a hardened nonroot Wolfi base; Redis is a runtime dependency the operator provides.
chart v · app v5.13.1
GatewaystandardMPL-2.0
A+
typesense
Fast, typo-tolerant search engine with an instant-search REST API and a self-contained embedded store (no external database), tuned for low-latency site and in-app search.
chart v · app v30.2
SearchstandardGPL-3.0
A+
Valkey
BSD-licensed in-memory key-value store, the truly-open community fork of Redis 7.2. QuenchWorks' default cache and the recommended Redis drop-in replacement.
chart v · app v9.1.1
CachecriticalBSD-3-Clause
A+
varnish
HTTP reverse-proxy cache (web accelerator) that fronts an origin and serves its responses from memory, cutting backend load and tail latency. Caching policy is VCL, which varnishd compiles to native code at startup. The chart supplies the VCL and the backend.
chart v · app v9.0.3
CachestandardBSD-2-Clause
B 1
vault
Secrets and encryption management for tokens, keys, and certificates, with dynamic secrets, leasing, and PKI. Shipped under the Business Source License 1.1, which is not OSI-approved; OpenBao (MPL-2.0) is the open drop-in fork. Built from source with the web UI included; the chart supports multi-node raft HA. The 1.20.x line is CVE-blocked upstream and not shipped.
chart v · app v2.0.3
SecretslowBUSL-1.1
A+
Vector
High-performance observability pipeline that collects, transforms, and routes logs, metrics, and traces between sources and sinks.
chart v · app v0.56.0
ObservabilitystandardMPL-2.0
B 1
velero
CNCF backup and disaster-recovery tool for Kubernetes cluster resources and persistent volumes. Single static Go binary on a hardened nonroot Wolfi base; object-store and snapshot backends are the operator's choice.
chart v · app v1.18.2
Storage & platformstandardApache-2.0
A+
victorialogs
Fast, cost-efficient logs database with the LogsQL query language. Single static Go binary on a hardened nonroot Wolfi base; log data lives on a writable volume.
chart v · app v1.51.0
ObservabilitystandardApache-2.0
A+
VictoriaMetrics
Fast, cost-efficient time-series database that speaks PromQL and Prometheus remote_write. Drop-in long-term storage or full replacement for Prometheus.
chart v · app v1.148.0
Time serieslowApache-2.0
B 2
vikunja
Self-hosted to-do and project management app (lists, kanban, gantt, calendar) serving both the API and the Vue web UI. From source with the UI embedded on a hardened nonroot Wolfi base; SQLite or an external SQL database.
chart v · app v2.3.0
Apps & productivitystandardAGPL-3.0+