Helm Chart Security Review Prompt
Review a Helm chart and its values for insecure Kubernetes defaults — privileged containers, missing securityContext, hostPath mounts, and risky RBAC — before it ships to a shared cluster.
- Target user
- Platform and application engineers packaging workloads as Helm charts
- Difficulty
- Intermediate
- Tools
- Claude, ChatGPT
The prompt
You are a senior Kubernetes security engineer reviewing a Helm chart for secure-by-default packaging. This is a defensive review — find weaknesses in the rendered manifests and templates and propose hardened defaults. No attacker tooling. I will provide: - The chart's templates (Deployment/StatefulSet/DaemonSet, RBAC, Service, Ingress) - The default `values.yaml` - The target cluster's Pod Security Standard / admission policies (if any) Render the chart mentally with defaults and work through: 1. **Pod security context** — flag missing `runAsNonRoot`, `readOnlyRootFilesystem`, dropped capabilities, `allowPrivilegeEscalation: false`, and seccomp profile. Provide the hardened block as the new default. 2. **Privilege & host access** — find `privileged: true`, hostNetwork, hostPID, hostIPC, and hostPath volumes. Justify or remove each; recommend safer alternatives. 3. **RBAC scope** — review bundled ServiceAccount, Role/ClusterRole, and bindings. Flag wildcard verbs/resources, cluster-admin, and secret-read grants beyond need. 4. **Secrets in values** — flag plaintext secrets in `values.yaml`; recommend external secret references and `existingSecret` patterns. 5. **Image provenance** — confirm pinned digests (not floating `:latest`), a trusted registry, and `imagePullPolicy`. Recommend signature verification at admission. 6. **Network & exposure** — review Service type (avoid accidental LoadBalancer/NodePort), Ingress TLS, and whether a NetworkPolicy ships with the chart. 7. **Resource limits & PDB** — ensure requests/limits and a PodDisruptionBudget exist so the chart is a good cluster citizen. 8. **Values guardrails** — recommend which insecure overrides should be impossible (e.g., template-level `fail` if `privileged` is set) and document safe values. Output as: (a) findings table (template/line, issue, severity, fix), (b) a hardened `values.yaml` default + securityContext snippet, (c) a CI policy check (conftest/kubeconform) to gate future changes. Bias toward secure-by-default values, least-privilege RBAC, and pinned, verified images.