HackBlue

Tools · Containers and Kubernetes security · 17 / 20

Reviewing a Helm chart before installing it: rendered manifests, RBAC, and privileges

Render a third-party chart with helm template, scan the output, and check the RBAC, securityContext, hostPath, and service exposure it would create.

9 min read · practice only with authorization

A chart is someone else’s YAML

Installing a chart creates whatever its templates produce, often including ClusterRoles, service accounts, and DaemonSets with host access. Reading the values file is not enough because templates may add objects conditionally. Render the chart with your values and review the actual manifests.

Render and scan

helm template produces the manifests without touching the cluster. Pipe them into a scanner and a few targeted greps.

Snippet
helm repo add bitnami https://charts.bitnami.com/bitnami
helm pull bitnami/redis --version 20.0.0 --untar
helm template lab ./redis -f my-values.yaml > rendered.yaml

trivy config rendered.yaml
yq 'select(.kind=="ClusterRole" or .kind=="Role") | .metadata.name, .rules' rendered.yaml
grep -nE 'privileged: true|hostPath:|hostNetwork: true|hostPID: true|type: LoadBalancer' rendered.yaml

Lab: review checklist

Pick any popular chart and render it. Fill in a short review: which kinds of objects it creates, whether any ClusterRole grants secrets, wildcard verbs, or escalate; whether containers run as non-root with dropped capabilities; whether any service is exposed outside the cluster; and which image tags or digests are used. Change values to fix what you can, such as setting securityContext fields, and re-render to confirm.

Operating charts safely

Pin chart versions, keep your values file in Git, verify chart provenance where the publisher signs charts, and diff rendered output on upgrades with helm diff so new permissions do not slip in unnoticed.

Diagram

Chart review

  1. Pull and pin

    Download a specific chart version.

  2. Render

    Generate manifests with your values.

    Command
    helm template lab ./chart -f values.yaml > rendered.yaml
  3. Scan and read

    Run trivy config; review RBAC, securityContext, host access, services.

  4. Diff on upgrade

    Compare rendered output before each upgrade.

Check yourself

1. Which command shows exactly what a chart would create without installing it?

2. Which object in a rendered chart deserves the closest RBAC review?

3. How do you catch new permissions introduced by a chart upgrade?