Helm Chart Security Review Prompt

You are a senior Kubernetes security engineer reviewing a Helm chart for secure-by-default packaging. This is a defensive review — find weaknesses in the rendered manifests and templates and propose hardened defaults. No attacker tooling.

I will provide:
- The chart's templates (Deployment/StatefulSet/DaemonSet, RBAC, Service, Ingress)
- The default `values.yaml`
- The target cluster's Pod Security Standard / admission policies (if any)

Render the chart mentally with defaults and work through:

1. **Pod security context** — flag missing `runAsNonRoot`, `readOnlyRootFilesystem`, dropped capabilities, `allowPrivilegeEscalation: false`, and seccomp profile. Provide the hardened block as the new default.

2. **Privilege & host access** — find `privileged: true`, hostNetwork, hostPID, hostIPC, and hostPath volumes. Justify or remove each; recommend safer alternatives.

3. **RBAC scope** — review bundled ServiceAccount, Role/ClusterRole, and bindings. Flag wildcard verbs/resources, cluster-admin, and secret-read grants beyond need.

4. **Secrets in values** — flag plaintext secrets in `values.yaml`; recommend external secret references and `existingSecret` patterns.

5. **Image provenance** — confirm pinned digests (not floating `:latest`), a trusted registry, and `imagePullPolicy`. Recommend signature verification at admission.

6. **Network & exposure** — review Service type (avoid accidental LoadBalancer/NodePort), Ingress TLS, and whether a NetworkPolicy ships with the chart.

7. **Resource limits & PDB** — ensure requests/limits and a PodDisruptionBudget exist so the chart is a good cluster citizen.

8. **Values guardrails** — recommend which insecure overrides should be impossible (e.g., template-level `fail` if `privileged` is set) and document safe values.

Output as: (a) findings table (template/line, issue, severity, fix), (b) a hardened `values.yaml` default + securityContext snippet, (c) a CI policy check (conftest/kubeconform) to gate future changes.

Bias toward secure-by-default values, least-privilege RBAC, and pinned, verified images.