Automated Security Repair for Helm Charts

We aim to evaluate and compare open-source static analyzers for Helm Charts, a package manager to deploy applications on Kubernetes (K8s). Specifically, we developed a pipeline to measure what misconfigurations are found by each tool, to provide automatic misconfiguration repair, and whether this latter breaks application functionalities. To evaluate our approach, we analyzed the 60 most common Helm Charts available on Artifact Hub, seven open-source Helm Charts analyzers, and generated functionality profiles for each chart application. We found several bugs and inconsistency issues with the tools, which we reported on respective tool repositories, and concluded that such tools that should provide automatic security repair still require significant manual intervention.