Charts

278 charts

Hardened Helm charts

Each chart deploys our hardened image pinned by its signed digest, with sensible production defaults. Cosign-signed and published as an ArtifactHub verified publisher. 278 charts.

A 2
Atlantis
Terraform pull-request automation that runs plan on PRs and apply from PR comments, enforcing reviewed, Git-driven infrastructure changes with state…
chart v0.0.20 · app v0.48.0
GitOpsstandardApache-2.0
A 1
authelia
Open-source authentication and authorization server providing single sign-on and two-factor authentication via a web portal, designed as a companion…
chart v0.0.30 · app v4.39.28
IdentitystandardApache-2.0
A+
authentik
Self-hosted identity provider (OIDC, SAML, LDAP, SCIM) with flows, policies, and application/provider management. Built clean-room from source on…
chart v0.1.32 · app v2026.8.3
Secrets & identitystandardMIT
0 CVE
backup-stack
Hardened Kubernetes backup: Velero with its AWS plugin, backing up to SeaweedFS over S3 in the same install, with generated keys, a bucket created at…
chart v0.0.8 · app v1.0.0
StacksstandardUnknown
A+
bind
ISC BIND 9, the authoritative and recursive DNS server (9.20 stable line). Wolfi's source-built named, nonroot on port 5353, with a default…
chart v0.0.2 · app v9.20.29
CoordinationstandardMPL-2.0
A 1
blackbox-exporter
Prometheus exporter that probes endpoints externally over HTTP, HTTPS, TCP, DNS, and ICMP for black-box uptime and latency monitoring.
chart v0.0.3 · app v0.28.0
Metrics/ExporterstandardApache-2.0
A 4
buildkit
BuildKit, the concurrent container image build engine behind docker build, as the rootless variant: buildkitd runs under rootlesskit as uid 1001 on…
chart v0.0.5 · app v0.33.1
Security & supply chainstandardApache-2.0
0 CVE
cache-stack
Hardened cache stack with metrics: Valkey (Redis-compatible) with a redis_exporter sidecar, Prometheus discovering it in the release namespace, and…
chart v0.0.6 · app v1.0.0
StacksstandardUnknown
A 1
Caddy
Web server and reverse proxy with fully automatic HTTPS via Let's Encrypt and a simple Caddyfile config.
chart v0.0.17 · app v2.11.7
GatewaystandardApache-2.0
A 2
cadence
Fault-tolerant, stateful workflow orchestration engine by Uber. Ships the cadence server and CLI as static Go binaries on a hardened nonroot Wolfi…
chart v0.0.22 · app v1.4.2
WorkflowstandardMIT
A+
Cassandra
Distributed wide-column NoSQL store built for linear horizontal scale and high availability with no single point of failure, tuned for heavy writes.
chart v0.0.24 · app v5.0.9
Wide-columnstandardApache-2.0
A 1
centrifugo
Scalable real-time messaging server (WebSocket, SSE, GRPC) with channels, presence, and JWT auth. Built from source as a static Go binary on a…
chart v0.0.14 · app v6.9.7
MessagingstandardApache-2.0