Not just charts that get you running — charts that get you running right. Secure by default. Honest defaults. Zero shortcuts.
Each chart is built once, built properly, and stays that way.
Every decision is deliberate. Nothing is here by accident.
Non-root containers, dropped capabilities, seccompProfile: RuntimeDefault, and readOnlyRootFilesystem — on from day one, not retrofitted later.
Every values.yaml is backed by a strict JSON Schema. Bad configuration fails at helm install, not at 3am when your pager goes off.
No custom builds, no vendored binaries. You always know exactly what's running — straight from the official source registry.
Resource requests and limits set to real numbers based on actual workload profiles — not zeros, not wild overestimates.
Checksum annotations on pod templates mean any change to a Secret or ConfigMap auto-triggers a rolling update. No manual restarts.
NetworkPolicy, PodDisruptionBudget, affinity presets, sysctl tuning — all there when you need them, completely out of the way when you don't.
Add the repo once, install any chart, override what you need.
helm install postgresql \ kagiso-me/postgresql \ --namespace databases \ --create-namespace \ --set auth.existingSecret=pg-secret \ --set primary.persistence.storageClass=fast \ --set metrics.enabled=true
helm install redis \ kagiso-me/redis \ --namespace databases \ --create-namespace \ --set auth.existingSecret=redis-secret \ --set master.persistence.storageClass=fast \ --set metrics.enabled=true