kube-proxy

kube-proxy

Chainguard's redistribution of the kube-proxy Helm chart, pre-configured with hardened Chainguard Images.

Prerequisites

Authentication is required to access this chart and its images. First, authenticate with Chainguard and configure your environment:

chainctl auth login
chainctl auth configure-docker --pull-token --save
helm registry login cgr.dev

Create an image pull secret for the cluster:

kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace kube-system

Installation

helm install kube-proxy oci://cgr.dev/ORGANIZATION/charts/kube-proxy \
  --namespace kube-system \
  --set imagePullSecrets[0].name=cgr-pull-secret \
  --set apiServer.endpoint=https://YOUR_API_SERVER_ENDPOINT

About This Chart

This is a redistribution of the upstream kube-proxy Helm chart. All upstream configuration options and documentation apply.

For full documentation, see: https://github.com/stevehipwell/helm-charts/tree/main/charts/kube-proxy

Chainguard Customizations

apiServer.endpoint defaults to https://kubernetes.default.svc (the standard in-cluster DNS name for the Kubernetes API server), making the field optional. In environments where cluster DNS is not reachable — for example when kube-proxy runs with hostNetwork: true — override the default with the API server's IP address:

helm install kube-proxy oci://cgr.dev/ORGANIZATION/charts/kube-proxy \
  --set apiServer.endpoint=https://YOUR_API_SERVER_IP:PORT