Helm / Helm OCI

Introduction

JFrog Xray scans Helm charts and Helm OCI charts used in Kubernetes deployments.

A chart doesn't hold application code of its own. It points to the container images it deploys. Xray reads the chart, finds those images, scans them, and shows the results on the chart itself. This gives you one security answer for the chart you deploy, instead of checking each image separately.

If you have JFrog Advanced Security, Xray also runs contextual analysis, Secrets, Services, and Applications scans on those images, and shows those results on the chart.

Capabilities

Capability	Source Code Scanning	Binary Scanning
Vulnerability Matching (CVEs)	❌	✅ (images the chart deploys)
License Detection	❌	✅ (images the chart deploys)
Malicious Package Detection	❌	✅ (images the chart deploys)
Operational Risk	-	-
Smart Remediation	❌	❌

The following scans are also available on charts and require JFrog Advanced Security.

Capability	Supported
Vulnerabilities Contextual Analysis	✅ (images the chart deploys)
Secrets Detection	✅ (images the chart deploys)
Services Misconfigurations	✅ (images the chart deploys)
Applications Misconfigurations	✅ (images the chart deploys)

Xray doesn't review the chart's own configuration files for misconfigurations. For more information, see Prerequisites and Limitations.

Binary Scanning

When you store a chart in an Artifactory Helm or Helm OCI repository, Xray checks which container images the chart deploys. It looks those images up in Artifactory and scans them, then shows those findings on the chart. The images don't need to be indexed by Xray.

Supported Package Formats

Format	Supported
Helm Charts (.tgz)	✅
Helm OCI	✅

How It Works

You store a chart in a Helm or Helm OCI repository that Xray indexes.
Xray reads the chart and lists the container images it deploys.
Xray looks those images up in Artifactory and scans them. Images that aren't stored in Artifactory are skipped.
The findings from those images appear on the chart, so you can see the chart's security status in one place.
With JFrog Advanced Security, contextual analysis, Secrets, Services, and Applications results appear on the chart as well.

Configuration

To enable JFrog Advanced Security scans for the chart repository:

Navigate to Administration > Xray Settings > Indexed Resources, or Applications > Xray > Scans List.
Select the Helm or Helm OCI chart repository and click Configure.
Under the Advanced Security category, turn on the scans you need: Vulnerabilities Contextual Analysis, Secrets, Services, and Applications.

Enable the Advanced Security scans on the chart repository only. The container images the chart deploys don't need to be indexed by Xray, and you don't need to repeat those settings on the image repositories.

For more information, see Enable Advanced Scans for Repositories.

Prerequisites and Limitations

Contextual analysis, Secrets, Services, and Applications scans on charts require JFrog Advanced Security.
Xray scans the container images a chart deploys. It doesn't check the chart's own files, such as templates or values, for misconfigurations.
Store the chart in Artifactory. Xray looks up the container images the chart deploys in Artifactory and scans them. Those images don't need to be indexed by Xray. Images that aren't stored in Artifactory are skipped, so the chart shows results for the images Xray was able to scan.
Services and Applications findings on a chart come from the container images, not from the chart's configuration.