Cert Exporter

Docker Hardened Image

A Prometheus exporter that publishes certificate expirations from disk and Kubernetes secrets

SPIFFE CSI Driver

Docker Hardened Image

Kubernetes CSI driver that injects the SPIFFE Workload API socket into workload pods as an ephemeral inline volume.

Tailscale Operator Helm chart

Docker Hardened Image

Helm chart for the Tailscale Kubernetes Operator, which manages Tailscale resources including ingress, egress, subnet routers, and proxies within a cluster.

Handshake service for kernel TLS consumers

Calico Node Driver Registrar

Docker Hardened Image

CSI node driver registrar repackaged by Calico to register the Calico CSI driver with the kubelet.

APISIX Helm chart

Docker Hardened Image

Apache APISIX is a dynamic, real-time, high-performance API Gateway.

Sealed Secrets Kubeseal

Docker Hardened Image

Kubeseal is the client side tool for Sealed Secrets to encrypt secrets.

Pinniped CLI

Docker Hardened Image

Pinniped CLI is a command-line utility for interacting with Pinniped

Socket CLI

Docker Hardened Image

Socket CLI scans npm, pnpm, and yarn projects for supply-chain security risks -- malicious packages, typosquats, and known vulnerabilities -- from the command line and CI pipelines.

Snyk CLI

Docker Hardened Image

Find and fix vulnerabilities in code, dependencies, containers, and infrastructure as code

Calico Pod2Daemon FlexVol

Docker Hardened Image

Calico FlexVolume driver installer for secure connections from Kubernetes pods to local daemons.

Tailscale Kubernetes Operator

Docker Hardened Image

Manages Tailscale resources on a Kubernetes cluster, including exposing Services on a tailnet and running Tailscale subnet routers, exit nodes, and proxies.

Harbor Helm chart

Docker Hardened Image

Harbor - An open source trusted cloud native registry that stores, signs, and scans content

StackHawk MCP Server

Docker Hardened Image

A Model Context Protocol server that connects AI assistants and LLM-powered IDEs to the StackHawk application security testing platform.

AuthService

Docker Hardened Image

Envoy external authorization service that moves OIDC/OAuth2 token acquisition out of application code and into the Istio mesh

Zscaler MCP Server

Docker Hardened Image

A Model Context Protocol server that connects AI assistants and LLM-powered IDEs to the Zscaler Zero Trust Exchange platform.

Falco

Docker Hardened Image

Falco is a CNCF-graduated cloud-native runtime security tool that uses a modern eBPF probe to monitor syscalls and detect anomalous application and container behavior in real time.

Amazon EKS Pod Identity Webhook

Docker Hardened Image

The Amazon EKS Pod Identity Webhook is a Kubernetes mutating admission webhook that injects AWS IAM Roles for Service Accounts (IRSA) credentials into pods, letting workloads assume an IAM role via a projected service account token instead of long-lived credentials.

Stunnel

Docker Hardened Image

stunnel is a TLS proxy that adds SSL/TLS encryption to TCP services with no native TLS support, forwarding plaintext traffic between clients and backends without modifying the underlying application.

Kyverno Policies Helm chart

Docker Hardened Image

Kubernetes Pod Security Standards implemented as Kyverno policies.

AWS Provider for Secrets Store CSI Driver

Docker Hardened Image

The AWS provider for the Secrets Store CSI Driver fetches secrets from AWS Secrets Manager and AWS Systems Manager Parameter Store and mounts them into Kubernetes pods as files, supporting both IRSA and EKS Pod Identity authentication.

Forklift Validation

Docker Hardened Image

OPA REST server that enforces Rego migration policies for the Forklift VM migration operator.

Ory Oathkeeper Maester

Docker Hardened Image

Kubernetes controller that watches Ory Oathkeeper Rule custom resources and renders them into the access rules ConfigMap or file that Ory Oathkeeper consumes.

Trust-Manager Helm chart

Docker Hardened Image

trust-manager manages TLS trust bundles in Kubernetes and OpenShift clusters.

Secrets Store CSI Driver CRDs

Docker Hardened Image

Packages the Secrets Store CSI Driver CustomResourceDefinitions together with kubectl, so a cluster can register SecretProviderClass and SecretProviderClassPodStatus before the driver itself is deployed.