Charts

281 charts

Hardened Helm charts

Each chart deploys our hardened image pinned by its signed digest, with sensible production defaults. Cosign-signed and published as an ArtifactHub verified publisher. 281 charts.

A 1
policy-reporter
Policy Reporter, Kyverno's PolicyReport aggregator. Watches PolicyReport results from Kyverno and other engines, serves them over a REST API and…
chart v · app v3.10.0
Security & supply chainstandardMIT
0 CVE
policy-stack
Hardened Kubernetes policy in one install: Kyverno (admission policies and background scans that write PolicyReports) + Policy Reporter (those…
chart v0.0.4 · app v1.0.0
StacksstandardUnknown
0 CVE
postgres-ha-stack
Hardened PostgreSQL HA stack: a 3-node Patroni cluster with automatic failover, PgBouncer pooling in front of the elected leader, postgres_exporter…
chart v0.0.7 · app v1.0.0
StacksstandardUnknown
A+
PostgreSQL
Advanced open-source relational database (v18.x) with strong SQL, ACID transactions, JSON, and a rich extension ecosystem. Ships pgvector for vector…
chart v · app v18.6
RelationalcriticalPostgreSQL
A+
PostgreSQL + DocumentDB
PostgreSQL 17 plus the open DocumentDB extension, providing BSON document storage and queries. The storage backend that powers FerretDB v2.
chart v · app v0.107.0
DocumentstandardMIT
A+
postgrest
REST API server that serves a RESTful API directly from a PostgreSQL schema. Shipped as upstream's official prebuilt static binary.
chart v · app v16.3
Databases & enginesstandardMIT
A+
powerdns
PowerDNS Authoritative Server, built from the release tarball. Serves zones from LMDB by default, which needs no schema and supports DNSSEC and zone…
chart v · app v5.1.4
CoordinationstandardGPL-2.0
A+
powerdns-recursor
PowerDNS Recursor, the caching DNS resolver, built from the release tarball. Serves resolution to RFC 1918 and CGN clients by default (never an open…
chart v · app v5.4.7
CoordinationstandardGPL-2.0
A+
prefect
Prefect, the Python-native workflow orchestration server for data pipelines. prefect from PyPI in a Python 3.13 venv on a hardened nonroot Wolfi…
chart v · app v3.8.8
WorkflowstandardApache-2.0
0 CVE
profiling-stack
Hardened continuous profiling stack: Grafana Pyroscope (profile store and query) + Grafana with the Pyroscope datasource provisioned.
chart v0.0.4 · app v1.0.0
StacksstandardUnknown
A 2
Prometheus
Metrics collection, storage, and alerting system that scrapes targets and runs PromQL queries. The de-facto cloud-native monitoring TSDB.
chart v · app v3.15.0
ObservabilitystandardApache-2.0
A+
proxysql
MySQL-protocol proxy that pools connections, splits reads from writes, routes queries by rule, and fails over between backends. Configured through…
chart v · app v3.0.9
RelationalstandardGPL-3.0+