Skip to content
chant Docs Demo

Security

llms.txt lists every page for an agent
Optional: hand this page to your coding agentThe steps work by hand too.
Show the whole prompt
Read https://intentius.io/chant/lexicons/helm/security/.
Run `npx chant lint` on this project's Helm chart and fix every WHM401 to WHM407 finding as the page shows: pinned image tags, security contexts, resource requests, and `HelmExternalSecret` in place of inline Secret data.
Run `npx chant build` and `helm template` on the result, and open a pull request.
Do not write a secret's value into any file or the pull request.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

Secret management

Section titled “Secret management”

Avoid inline secrets in Kubernetes Secret manifests. Use ExternalSecret or SealedSecret instead:

import { HelmExternalSecret } from "@intentius/chant-lexicon-helm";


const { externalSecret, values } = HelmExternalSecret({
  name: "app-secrets",
  secretStoreName: "vault",
  data: {
    DB_PASSWORD: "secret/data/db-password",
    API_KEY: "secret/data/api-key",
  },
});

WHM407 warns when a kind: Secret template contains inline data values without an ExternalSecret or SealedSecret in the chart.

Security context best practices

Section titled “Security context best practices”

Always set security context on pods and containers:

spec: {
  securityContext: {
    runAsNonRoot: true,
    runAsUser: 1000,
  },
  containers: [{
    securityContext: {
      readOnlyRootFilesystem: true,
      allowPrivilegeEscalation: false,
    },
  }],
}
Section titled “Related checks”
CheckSeverityDescription
WHM401warningImage uses :latest tag or no tag
WHM402warningrunAsNonRoot not set
WHM403inforeadOnlyRootFilesystem not set
WHM404errorprivileged: true detected
WHM405warningResource spec missing cpu/memory
WHM406infoCRD lifecycle limitation
WHM407warningSecret with inline data

Image pinning

Section titled “Image pinning”

Always pin container images to specific tags or digests:

// Bad — triggers WHM401
image: "nginx:latest"
image: "nginx"


// Good
image: printf("%s:%s", values.image.repository, values.image.tag)

Set a specific default tag in your values:

const valuesSchema = new Values({
  image: {
    repository: "nginx",
    tag: "1.25.0",       // Pinned version
    pullPolicy: "IfNotPresent",
  },
});

chant