Why It Helps
Helm values can hide important security choices: generated passwords, broad RBAC, privileged containers, image tags, CRDs, webhooks, and controller behavior. ConfigHub does not make those choices disappear. It makes them visible enough to review and attaches decisions to the rendered object set.
Controls
| Area | What the model gives you |
|---|---|
| Rendered objects | Review the actual Kubernetes objects before delivery, not only values files. |
| Secrets | Separate, reference, or require external Secrets where appropriate. Do not hide placeholder credentials. |
| Scans and gates | Run policy and security checks against explicit desired state before delivery. |
| OCI delivery | Publish a reviewed bundle so the controller pulls the same bytes that were checked. |
| Receipts | Record what was rendered, delivered, observed, accepted, blocked, or refused. |
Current Limits
Some evidence is partial by design. A digest proves integrity only inside a known trust chain. A scan finding needs a decision. A green render does not prove that the target has the right cloud identity, storage, or runtime policy.