E-HEL
Helm
Kubernetes package manager, used in a cloud assessment to inspect chart configurations and installed releases for misconfigurations.
OVERVIEW
Helm (github.com/helm/helm) is the de facto package manager for Kubernetes, packaging applications as versioned charts with a `values.yaml` that controls everything from replica counts to security contexts, RBAC objects, and exposed services — during a cloud/Kubernetes assessment, `helm list` across namespaces and `helm get values`/`helm get manifest` on each release turn into a fast inventory of what's actually deployed and how it's configured.
Because charts are frequently installed with default or barely-reviewed values, common findings show up directly in that output: containers running as root, missing resource limits, overly permissive ServiceAccounts and RBAC bindings bundled with a chart, or Services unintentionally exposed via LoadBalancer/NodePort — all visible without needing to reverse-engineer raw manifests from scratch.
USE CASES
Practical use cases
- 01
Inventorying every installed release across namespaces with `helm list --all-namespaces`.
- 02
Reviewing a release's effective values (`helm get values`) for insecure defaults left unchanged.
- 03
Diffing a release's rendered manifest (`helm get manifest`) against the chart's documented security recommendations.
- 04
Checking chart repositories in use and pinned versions for known-vulnerable chart releases.
QUICK START
Once cluster access is in hand, to inventory installed Helm releases and review their chart values for insecure defaults.
- Confirm the Kubernetes cluster and namespaces in question are inside the agreed scope.
- Get a kubeconfig with at least read access, and confirm Helm can reach the cluster (`helm list --all-namespaces`).
- For each release of interest, pull its values and rendered manifest with `helm get values` and `helm get manifest`.
- Flag insecure defaults (root containers, broad RBAC, exposed Services) for deeper manual review against the chart's source.
helm list --all-namespaces && helm get values <release> -n <namespace>BEFORE YOU RUN IT
What to check before running it
Helm operations run through the Kubernetes API using the current kubeconfig context — actions are subject to whatever audit logging the cluster has enabled, not a Helm-specific log.
`helm get values` without `--all` shows only user-supplied overrides by default; use `helm get values --all` to see the full effective configuration including chart defaults.
Helm can install, upgrade, and delete releases just as easily as it can inspect them — stick to read-only subcommands (`list`, `get`, `status`, `history`) unless changes are explicitly in scope.