No. Helm does not track resources created by hooks as part of the release, so helm uninstall will not remove them. The Helm docs say you cannot rely on uninstall to remove resources created in a hook. Use a hook deletion policy or a Job TTL, and read hooks before you install a chart.
What a hook is
A hook is an ordinary Kubernetes manifest inside a chart with a special annotation. It runs at a set point in the release lifecycle: pre-install, post-install, pre-upgrade, post-upgrade, pre-delete, post-delete, pre-rollback, post-rollback, or when you run helm test. For Job and Pod hooks, Helm waits for the hook to finish, and a failure fails the release.
Because hooks are templates, they can read chart values and release data.
Why hooks matter for supply chain review
A hook is code that runs in your cluster at install time, often before the main workload exists. It can be a Job with its own image, its own service account and its own permissions. People review the Deployment and skip the Job in the hooks folder. That is the gap.
| Hook behavior | What to check |
|---|---|
| Runs before resources are created | What image, what service account, what commands |
| Not part of the release record | It can outlive uninstall unless a policy removes it |
| Weighted ordering | Ascending order by weight, default 0, written as a string |
| Failure fails the release | A broken hook can leave partial state |
Deletion policies
The docs list three delete policies. The default, before-hook-creation, deletes the previous hook resource before a new one starts. Hook-succeeded deletes it after success, and hook-failed deletes it on failure. To keep a hook resource on purpose, annotate it with the resource policy value keep.
Steps for reviewing a chart's hooks
- Run helm template and filter the output for the hook annotation.
- For each hook, note the kind, image, service account and command.
- Check that the images are pinned by digest and scanned.
- Confirm each hook has a deletion policy, or set a TTL on Jobs so finished pods do not pile up.
- After a test uninstall in a scratch namespace, list what is left behind and decide if it matters.
If a hook created cluster scoped objects, a namespace delete will not clean them. Look for ClusterRoles and bindings that a pre-install hook added.
Related: how to scan a Helm chart for misconfigurations.
Quick check
Do hook resources show up in helm get manifest?
Helm does not manage them as part of the release, so check hooks separately with the Helm hook listing commands for your version.
Are hooks a security risk by themselves?
They are a normal feature. The risk is unreviewed code with real permissions, so review them like any workload.
Safeguard scans the images and dependencies in your deployment sources, and a free scan is at https://gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
