Security And Provenance

The public catalog is not a security certification. It addresses a practical review problem: prove which objects were rendered, scanned, approved, delivered, and observed.

Why It Helps

Helm values can hide important security choices: generated passwords, broad RBAC, privileged containers, image tags, CRDs, webhooks, and controller behavior. ConfigHub does not make those choices disappear. It makes them visible enough to review and attaches decisions to the rendered object set.

Controls

AreaWhat the model gives you
Rendered objectsReview the actual Kubernetes objects before delivery, not only values files.
SecretsSeparate, reference, or require external Secrets where appropriate. Do not hide placeholder credentials.
Scans and gatesRun policy and security checks against explicit desired state before delivery.
OCI deliveryPublish a reviewed bundle so the controller pulls the same bytes that were checked.
ReceiptsRecord what was rendered, delivered, observed, accepted, blocked, or refused.

Current Limits

Some evidence is partial by design. A digest proves integrity only inside a known trust chain. A scan finding needs a decision. A green render does not prove that the target has the right cloud identity, storage, or runtime policy.