Helm / Helm OCI

Introduction

JFrog Xray scans Helm charts and Helm OCI charts used in Kubernetes deployments.

A chart doesn't hold application code of its own. It points to the container images it deploys. Xray reads the chart, finds those images, scans them, and shows the results on the chart itself. This gives you one security answer for the chart you deploy, instead of checking each image separately.

If you have JFrog Advanced Security, Xray also runs contextual analysis, Secrets, Services, and Applications scans on those images, and shows those results on the chart.

---

Capabilities

The following capabilities are available for Helm charts.

The following scans are also available on charts and require JFrog Advanced Security.

Xray doesn't review the chart's own configuration files for misconfigurations. For more information, see Prerequisites and Limitations.

---

Binary Scanning

When you store a chart in a JFrog Artifactory Helm or Helm OCI repository, Xray checks which container images the chart deploys. It looks those images up in Artifactory and scans them, then shows those findings on the chart. The images don't need to be indexed by Xray.

Supported Package Formats

The following package formats are supported for Helm charts.

How Helm Chart Scanning Works

1. A chart is stored in a Helm or Helm OCI repository that Xray indexes.
2. Xray reads the chart and lists the container images it deploys.
3. Xray looks those images up in Artifactory and scans them. Images that aren't stored in Artifactory are skipped.
4. The findings from those images appear on the chart, so you can see the chart's security status in one place.
5. With JFrog Advanced Security, contextual analysis, Secrets, Services, and Applications results appear on the chart as well.

---

Enable Advanced Security Scans for Helm Charts

JFrog Advanced Security scans on a Helm chart show contextual analysis, Secrets, Services, and Applications results from the images the chart deploys.

To enable JFrog Advanced Security scans for the chart repository:

1. Navigate to one of the following locations:
   • Administration > Xray Settings > Indexed Resources
   • Applications > Xray > Scans List
2. Select the Helm or Helm OCI chart repository and click Configure.
3. Under the Advanced Security category, turn on the scans you need: Vulnerabilities Contextual Analysis, Secrets, Services, and Applications.

Enable the Advanced Security scans on the chart repository only. The container images the chart deploys don't need to be indexed by Xray, and you don't need to repeat those settings on the image repositories.

For more information, see Enable Advanced Scans for Repositories.

---

Prerequisites and Limitations

• Contextual analysis, Secrets, Services, and Applications scans on charts require JFrog Advanced Security.
• Xray scans the container images a chart deploys. It doesn't check the chart's own files, such as templates or values, for misconfigurations.
• The chart must be stored in Artifactory. Xray looks up the container images the chart deploys in Artifactory and scans them. Those images don't need to be indexed by Xray. Images that aren't stored in Artifactory are skipped, so the chart shows results for the images Xray was able to scan.
• Services and Applications findings on a chart come from the container images, not from the chart's configuration.

---

Related Topics

• Supported Technologies
• Enable Advanced Scans for Repositories
• Supported Technologies (JFrog Advanced Security)
• Docker / OCI