To scan a Helm chart, render it with helm template using the same values file you deploy with, then scan the resulting Kubernetes YAML. Raw template files contain placeholders and conditionals, so a scanner reading them cannot know what will really be applied.
Why render first
A chart is a template. Whether a container runs privileged, mounts a host path or exposes a service can depend on a value set at install time. The template command renders the chart locally and prints the manifests. Helm's documentation notes that values normally looked up in the cluster are faked and server side checks, such as API support, are skipped, so it works without a cluster.
What to scan
| Target | Catches | Misses |
|---|---|---|
| Raw template files | Obvious hardcoded issues | Anything driven by values |
| Rendered output with prod values | Real settings that will be applied | Cluster state, RBAC, image contents |
| Rendered output with default values | Chart defaults for third party charts | Your overrides |
Steps
- Render with each environment's values file, one run per environment.
- Write the output to a directory using the output directory flag, or pipe it to the scanner.
- Scan the rendered files against your baseline, such as the Pod Security Standards.
- Check values files for secrets. Keep real credentials out of values files in source control.
- For third party charts, pin the chart version and scan the rendered default output before first install.
- Re-scan when the chart version or values change.
Example
helm template my-release ./chart -f values-prod.yaml --output-dir ./rendered
Then point your manifest scanner at the rendered directory.
Watch out for
- Flags that skip schema validation. Helm offers options to disable OpenAPI and schema validation. Leave them off in CI unless you have a reason.
- Charts that pull in sub charts. Render covers them, raw file scans may not.
- Image references. The manifests name images but do not describe their contents, so scan those separately. See how to scan a Dockerfile versus a built image.
How Safeguard helps
Safeguard offers dependency scanning and SBOMs, reachability analysis, and autonomous remediation with fix pull requests, which is off by default with every category on Manual. The free scan is the easiest first step.
Quick check
Do I need a cluster to scan a Helm chart?
No. The template command renders locally and skips server side checks.
Should I scan default values or production values?
Production values, because they decide what is actually applied. Also scan defaults for third party charts before first install.
Sources
- Helm documentation, helm template (fetched 19 October 2026).
Last reviewed: 19 October 2026.
