Implementing Chart Security

helm package ./chart --sign --key 'release-bot' --keyring secring.gpg
# Produces chart-1.4.2.tgz + chart-1.4.2.tgz.prov
helm verify chart-1.4.2.tgz --keyring pubring.gpg

helm install api oci://ghcr.io/acme/charts/api \
  --version 1.4.2 --verify --keyring pubring.gpg

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ include "myapp.fullname" . }}
rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    resourceNames: ["{{ include "myapp.fullname" . }}-config"]
    verbs: ["get", "watch"]

spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    fsGroup: 10001
    seccompProfile: { type: RuntimeDefault }
  containers:
    - name: app
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities: { drop: ["ALL"] }

{{- if .Values.networkPolicy.enabled }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ include "myapp.fullname" . }}
spec:
  podSelector:
    matchLabels: {{- include "myapp.selectorLabels" . | nindent 6 }}
  policyTypes: [Ingress]
  ingress:
    - from:
        - namespaceSelector:
            matchLabels: { name: web }
      ports:
        - port: {{ .Values.service.port }}
{{- end }}