Blindly installing public charts — the supply chain risk

Blindly installing public charts is a supply chain risk. This lesson walks why, the fix (review every chart), verifying signatures, the trusted repositories, and the operational discipline.

The supply chain risk

flowchart LR
    A[Public chart] --> B{Trust}
    B -->|Trusted| C["Trusted repo: Bitnami, ingress-nginx"]
    B -->|Unverified| D["Risk: backdoor, privilege escalation, broad RBAC"]
    D --> E[Production cluster compromised]

Public charts may contain:

• Privileged containers. Pods that run with privileged: true, breaking out of the container.
• Broad RBAC. ClusterRoles with * verbs, granting excessive permissions.
• Backdoors. Malicious code that exfiltrates data or creates backdoor access.
• Hidden dependencies. Network calls to unknown endpoints, downloading additional code.

A team that installs a public chart without reviewing it may be installing a backdoor.

The review process

flowchart LR
    A[Public chart candidate] --> B[Download]
    B --> C["helm template: render manifests"]
    C --> D["Inspect: privileged? broad RBAC?"]
    D --> E{Acceptable?}
    E -->|No| F[Reject]
    E -->|Yes| G[Verify signature]
    G --> H{Signature valid?}
    H -->|No| F
    H -->|Yes| I[Document and install]

The review process:

1. Download the chart. helm pull chart-name --version X.Y.Z.
2. Render the manifests. helm template myrelease chart.tgz to see what would be installed.
3. Inspect. Look for privileged containers, broad RBAC, NetworkPolicies, hidden dependencies.
4. Verify signature. helm verify chart.tgz (for provenance-signed charts) or cosign verify.
5. Document. Record the approval: who reviewed, what was checked, when.

Helm provenance

# Verify a chart with provenance
helm verify --keyring path/to/keyring.gpg chart.tgz

# Output:
# Signed by: ...
# Hash match: sha256:...

Helm charts can be signed with GPG keys. The provenance file includes the chart’s hash and the signer’s key. Verification confirms the chart was signed by the claimed signer and has not been modified.

OCI signing with cosign

# Sign the chart with cosign
cosign sign --key cosign.key registry.example.com/chart:1.0.0

# Verify
cosign verify --key cosign.pub registry.example.com/chart:1.0.0

Cosign signs OCI artifacts (including OCI-stored charts). Verification confirms authenticity and integrity.

Trusted repositories

flowchart LR
    A[Trusted] --> B[Bitnami]
    A --> C["ingress-nginx (kubernetes-ingress)"]
    A --> D["cert-manager (jetstack)"]
    A --> E["Argo CD (argoproj)"]
    A --> F["Prometheus (prometheus-community)"]

Trusted repositories (maintained by the project authors or known vendors):

• Bitnami — application packages.
• ingress-nginx — Kubernetes community ingress controller.
• cert-manager — Jetstack cert-manager.
• Argo CD — Argo project.
• Prometheus — prometheus-community.

Trusted repositories still need review, but the baseline risk is lower.

Quiz

The operational discipline

Blind chart installs in production rest on five non-negotiable elements:

• Review every chart. Render, inspect, document.
• Verify signatures. Helm provenance or cosign.
• Use trusted repositories. Bitnami, project repos.
• Document the approval. Who reviewed, when, what was checked.
• Audit the installed charts. Periodic review of every chart in the cluster.

The discipline is to treat every public chart as untrusted until reviewed. A chart that has not been reviewed is a chart that has not earned the right to run in production.