How do you operate Helm securely and at scale across an organization?

Question

Accepted Answer

A few things, starting with the big Helm 3 change: Tiller is gone. Helm 2 had Tiller, a privileged in-cluster component that was a real security liability; Helm 3 removed it, so Helm now acts with the user own kubeconfig and respects Kubernetes RBAC. That means I control who can deploy what and where through normal RBAC and namespace scoping, rather than a shared privileged service. For trust in the charts themselves, I use provenance: helm package --sign produces a signed .prov file and helm install --verify checks it, and I vet third-party charts instead of installing arbitrary ones blindly, since a chart can create anything. For distribution and reproducibility, I host internal charts in an OCI registry, pin both chart versions and image versions, ideally by digest, and scan the rendered manifests and referenced images in CI. And for hygiene at scale: keep secrets out of values entirely using SOPS or an external secrets operator, enforce a values.schema.json so misconfigured values fail fast, and back it with admission policy like OPA Gatekeeper or Kyverno so whatever a chart renders still has to meet org standards, non-root, resource limits, approved registries. The theme is treat charts as supply-chain artifacts: signed, pinned, scanned, RBAC-scoped, and policy-checked.

Answer

Why was removing Tiller a security improvement?

Tiller ran in-cluster with broad privileges and was a shared, often over-permissioned attack surface. Helm 3 uses the caller own credentials and RBAC, so there is no privileged shared component to compromise or abuse.

Answer

How do you trust a third-party Helm chart?

Verify provenance/signature (--verify against the .prov), pin the version/digest, render and review the manifests (helm template), scan images, and enforce admission policy so even a trusted chart cannot violate org standards.

How do you operate Helm securely and at scale across an organization?

How do you operate Helm securely and at scale across an organization?

The follow-ups they ask next

What the interviewer is listening for

What sinks the answer

If you genuinely do not know

Keep going with helm

Knowing the answer is not the same as recalling it under pressure