Written by Albert Friedman
on 

Signing Helm charts in OCI registries with Cosign — hands-on guide

Helm charts are the go-to way to package and deploy Kubernetes apps. In recent years the community has moved from classic chart repositories to storing charts as OCI artifacts (so they live alongside container images), and teams are adopting Sigstore / Cosign to sign and verify those artifacts. This short, practical guide shows a modern workflow: package a chart, push it to an OCI registry, sign it with Cosign, and verify it locally or as part of a GitOps pipeline (Flux). Along the way I’ll call out common gotchas and best practices.

Why this matters

What you’ll need

Quick overview of the steps

  1. Prepare and package the chart.
  2. Login to the OCI registry.
  3. Push the .tgz chart as an OCI artifact.
  4. Sign the pushed chart with Cosign.
  5. Verify the signature locally and (optionally) configure Flux to verify before deploying.

Step-by-step: package, push, sign, verify

1) Package your Helm chart From the chart directory:

helm package ./my-chart
# Produces my-chart-0.1.0.tgz

2) Login to your OCI registry Helm uses the same credential stores as Docker/containers. For a generic registry:

helm registry login ghcr.io -u YOUR_USERNAME
# or for Azure Container Registry
helm registry login myregistry.azurecr.io -u <username>

If the registry requires repository pre-creation, create it first (some registries enforce this). (v3.helm.sh)

3) Push the packaged chart to the registry Push the .tgz and let Helm infer the repository basename and tag from the chart name/version:

helm push my-chart-0.1.0.tgz oci://ghcr.io/my-org/charts
# Output: Pushed: ghcr.io/my-org/charts/my-chart:0.1.0

Note: Helm strictly requires the chart name and semantic version to map to the OCI tag (no using :latest), and Helm will translate any + in a SemVer build identifier into _ when it stores the tag. (v3.helm.sh)

4) Sign the chart with Cosign You can sign with a static key or use Cosign keyless (OIDC) signing. A simple static-key example:

# generate a key pair (keep cosign.key private)
cosign generate-key-pair

# sign the pushed chart by referencing its registry ref
cosign sign --key cosign.key ghcr.io/my-org/charts/my-chart:0.1.0

This writes a signature to the registry as an OCI artifact attached to the chart. Many public projects already publish signed charts using keyless Sigstore signing; keyless uses OIDC to mint ephemeral certs. (docs.kubewarden.io)

5) Verify the signature locally Using the public key:

# verify signature using a public key you trust
cosign verify --key cosign.pub ghcr.io/my-org/charts/my-chart:0.1.0

For keyless-signed artifacts you can verify with cosign without a local key, or by matching OIDC identity patterns (issuer + subject) when automated verification is needed. (v2-0.docs.fluxcd.io)

Integrating verification into Flux (cluster-side) Flux supports verifying OCI artifacts and Helm charts signed with Cosign. You can configure an OCIRepository or a HelmRelease to require verification; if verification fails Flux won’t fetch or reconcile the artifact. Basic idea:

Example snippet (HelmRelease chart-spec verify stanza):

apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
spec:
  chart:
    spec:
      chart: my-chart
      version: 0.1.0
      sourceRef:
        kind: HelmRepository
        name: my-oci-charts
      verify:
        provider: cosign
        secretRef:
          name: cosign-pub

If verification fails Flux sets SourceVerified/Ready to False and prevents the install/upgrade. This closes the loop so only verified artifacts reach your cluster. (v2-0.docs.fluxcd.io)

Practical tips and gotchas

When local verification isn’t enough Local cosign verification is useful for an operator or release engineer. For scalable, enforceable security, configure your GitOps controller (Flux) or your CI/CD pipeline to verify signatures automatically. Flux’s verification feature will stop unsigned or tampered charts from being reconciled into your clusters. (v2-0.docs.fluxcd.io)

Wrap-up and next steps Storing Helm charts as OCI artifacts and signing them with Cosign gives you a modern, unified artifact workflow and stronger supply-chain guarantees. The core commands are straightforward (helm package → helm registry login → helm push → cosign sign → cosign verify), but the real value appears when verification is automated in CI/CD and enforced in cluster reconciliation (e.g., Flux). Start by trying the flow in a dev registry, then iterate:

References and further reading

If you’d like, I can: