Charts

140 charts

Hardened Helm charts

Each chart deploys our hardened image pinned by its signed digest, with sensible production defaults. Cosign-signed and published as an ArtifactHub verified publisher. 140 charts.

B 1
opa
Open Policy Agent, the CNCF general-purpose policy engine. Evaluates Rego policies over JSON and YAML to enforce authorization, admission control, and configuration rules across the stack.
chart v · app v1.19.0
Security & supply chainstandardApache-2.0
B 1
OpenBao
Open-source secrets and encryption management for tokens, keys, and certificates, with dynamic secrets and leasing. The Linux Foundation MPL-2.0 community fork of HashiCorp Vault.
chart v · app v2.6.1
SecretsstandardMPL-2.0
A+
openfga
Fine-grained authorization engine (Zanzibar-style relationship-based access control) over HTTP and gRPC. From source on a hardened nonroot Wolfi base; datastore is the operator's choice.
chart v · app v1.18.1
IdentitystandardApache-2.0
A+
openldap
OpenLDAP slapd, the reference open-source LDAP directory server, with the LMDB (back-mdb) backend and the client tools. Runs nonroot on unprivileged ports 1389/1636 and backs directory-driven auth for the identity stack.
chart v · app v2.6.13
IdentitystandardOLDAP-2.8
D 58
OpenSearch
Search and analytics suite with a Kibana-style dashboards UI. The Apache-2.0 community fork of Elasticsearch and the recommended open alternative.
chart v · app v3.7.0
SearchstandardApache-2.0
B 1
OpenTelemetry Collector
OpenTelemetry Collector that receives, processes, and exports traces, metrics, and logs, a vendor-neutral pipeline for telemetry routing.
chart v · app v0.157.0
ObservabilitystandardApache-2.0
B 2
perses
CNCF dashboards and observability visualization tool with an embedded React UI and 24 default panel/datasource plugins. From source (Node UI build embedded in a static Go binary) on a hardened nonroot Wolfi base.
chart v · app v0.53.1
ObservabilitystandardApache-2.0
A+
pgbouncer
Lightweight connection pooler for PostgreSQL that fronts thousands of client connections with a small backend pool, cutting per-connection overhead.
chart v · app v1.25.2
RelationalstandardISC
A+
pgpool
PostgreSQL connection pooler, load balancer and query router. Pools client connections, spreads read-only queries across streaming-replication standbys, and detaches a backend that fails its health check.
chart v · app v4.7.2
RelationalstandardHPND
A+
phpmyadmin
phpMyAdmin, the web console for MySQL and MariaDB. Built from the official release tarball on a hardened Wolfi php-8.3-fpm + nginx runtime (nonroot, read-only rootfs, supervisord), with the stale vendored composer deps (twig, symfony/cache, symfony/process, sodium_compat) re-resolved to their fixed releases and the bundled js-cookie prototype-pollution hole patched. Stateless — the chart is a Deployment that supplies config.inc.php via a ConfigMap, keeps the blowfish_secret across upgrades, and can bundle MariaDB.
chart v · app v5.2.3
Apps & productivitystandardGPL-2.0
B 2
pocketbase
Open-source backend in a single file with an embedded SQLite database, auth, file storage, realtime subscriptions, and an admin dashboard over a REST API. Pure-Go static binary (UI embedded) on a hardened nonroot Wolfi base; state on a writable volume.
chart v · app v0.39.5
Apps & productivitystandardMIT
A+
PostgreSQL
Advanced open-source relational database (v18.x) with strong SQL, ACID transactions, JSON, and a rich extension ecosystem. The catalog's default SQL engine.
chart v · app v18.4
RelationalcriticalPostgreSQL