secobs-charts

Go to root documentation
Go to index of charts evaluation

Artifact Hub’s Helm charts evaluation

Source: Artifact Hub
Evaluation date: 2022-12-07, 18:31:10

Pod Security Standards (PSS)

Pod Security Standards (PSS) define three levels of security (restricted, baseline and privileged) that can be enforced for pods in a namespace. Evaluation done with psa-checker command line tool, that checks into Kubernetes objects that can create pods.

Category	Quantity	Percentage
Total	9278	100.0%
Privileged	779	8.4%
Baseline	4806	51.8%
Restricted	42	0.45%
Error_download	408	4.4%
Empty_no_object	187	2.02%
Error_template	1006	10.84%
No_pod_object_but_crd	1340	14.44%
No_pod_object	191	2.06%
Version_not_evaluable	519	5.59%

Legend:

• PSS level:
  • Privileged: Pod specs makes use of privileged settings, the most insecure. Containers are able to access host capabilities.
  • Baseline: Pod specs without extra security or extra privileges. Doesn’t account for CRD that may create pods.
  • Restricted: Pod specs follow the best security practices, like requiring containers to not run as root, and drop extra capabilities. Doesn’t account for CRDs that may create pods.
• Error_download: Downloading the template from original source wasn’t possible.
• Error_template: Rendering the template without providing parameters resulted in error.
• No_pod_object_but_crd: The chart didn’t render any object that can create pods, but has CRD that could do so.
• No_pod_object_no_crd: The chart didn’t render any object that can create pods nor CRDs.
• Version_not_evaluable: The cart includes deployment, daemonset, etc. of v1beta1 that can’t be evaluated by the library.

Operator evaluation with BadRobot score

BadRobot evaluates how secure Kubernetes operators are. For each operator included in a chart, a score is calculated with a set of security practices. The closer to zero the score, the better.

Score	Number of charts
Non-evaluable	1414
Blank score	167
No workload	0
Score == 0	2538
[0, -50)	7175
[-50, -100)	383
[-100, -150)	85
[-150, -200)	26
[-200, -250)	14
[-250, -300)	7
[-300, -350)	3
[-350, -400)	1
[-400, -450)	1
[-450, -500)	0
[-500, -550)	1
[-550, -600)	0
[-600, -650)	0
[-650, -700)	1

Charts list

Alphabetical list of all repositories (number of charts in parenthesis):

main  A(1415)  B(473)  C(1009)  D(424)  E(233)  F(273)  G(552)  H(240)  I(228)  J(181)  K(440)  L(235)  M(400)  N(203)  O(481)  P(468)  Q(15)  R(361)  S(839)  T(194)  U(37)  V(99)  W(388)  X(2)  Y(58)  Z(30)