Charts

140 charts

Hardened Helm charts

Each chart deploys our hardened image pinned by its signed digest, with sensible production defaults. Cosign-signed and published as an ArtifactHub verified publisher. 140 charts.

A+
httpd
Apache HTTP Server, the long-standing open-source web server and reverse proxy for serving static content and fronting application backends (mod_proxy).
chart v0.0.5 · app v2.4.68
GatewaycriticalApache-2.0
0 CVE
identity-stack
Hardened, operator-free self-hosted SSO/identity stack: Keycloak (OIDC/SAML identity provider) + PostgreSQL (Keycloak's database) + oauth2-proxy (an auth proxy you place in front of any upstream app to authenticate users against Keycloak), wired together so you get single sign-on in front of your apps out of the box.
chart v0.0.6 · app v1.0.0
StacksstandardUnknown
C 2
InfluxDB
Time-series database purpose-built for ingesting and querying metrics, events, and IoT/sensor data at high write rates.
chart v0.0.12 · app v2.9.1
Time seriesstandardMIT
D 5
ingress-nginx
The Kubernetes NGINX Ingress Controller. Routes external HTTP/HTTPS traffic to in-cluster Services via Ingress resources, with TLS termination, path/host routing, and an admission webhook. The chart wires its RBAC, IngressClass, and webhook.
chart v0.0.7 · app v1.15.8
GatewaystandardApache-2.0
B 1
jaeger
Distributed tracing platform (Jaeger v2, OpenTelemetry-collector based) with an embedded query UI. From source on a hardened nonroot Wolfi base; in-memory storage by default, badger under a volume.
chart v0.0.6 · app v2.19.0
ObservabilitystandardApache-2.0
C 4
jenkins
The leading open-source automation server for building, testing, and deploying software, with thousands of plugins. Ships the architecture-independent jenkins.war LTS line on a hardened Wolfi JRE.
chart v0.0.7 · app v2.572
CI/CD & registrystandardMIT
C 3
Kafka
Distributed event-streaming platform for high-throughput, durable, replayable publish-subscribe pipelines and stream processing.
chart v0.0.15 · app v4.3.1
MessagingcriticalApache-2.0
D 5
Keycloak
Open-source identity and access management server providing SSO, user federation, and OAuth2/OIDC and SAML for apps and APIs.
chart v0.0.15 · app v26.7.0
IdentitystandardApache-2.0
A+
kong
API gateway and ingress controller on a patched OpenResty, with routing, auth, rate limiting, and a plugin ecosystem. Built from source against current OpenSSL rather than Kong's pinned older crypto; ships the Admin API without the Kong Manager GUI, whose assets are not built from source upstream.
chart v · app v3.9.3
GatewaystandardApache-2.0
B 2
kuma
CNCF service mesh control plane (Envoy-based) for multi-zone and multi-cluster meshes. Ships kuma-cp and kumactl with an embedded GUI, built from source on a hardened nonroot Wolfi base; default in-memory store runs standalone.
chart v0.0.7 · app v2.14.0
Coordination & meshstandardApache-2.0
0 CVE
lgtm-stack
Hardened, operator-free LGTM observability superset in one install: Loki (logs) + Grafana (the single pane) + Tempo (traces) + VictoriaMetrics (Prometheus-compatible metrics) + an OpenTelemetry Collector (OTLP ingest) + Alertmanager.
chart v0.0.5 · app v1.0.0
StacksstandardUnknown
B 1
livekit
WebRTC SFU server for scalable real-time audio, video, and data. Single static Go binary on a hardened nonroot Wolfi base; config via mounted YAML or LIVEKIT_ env.
chart v0.0.7 · app v1.13.4
Media & streamingstandardApache-2.0