helm-vendor: Vendoring Helm charts with Nix

Fri, 06 Nov 2026 01:29:34 +0200

Helm’s default workflow fetches charts at deploy time. You helm repo add, you helm upgrade --install, and the version you get is whatever the repository index served that morning. This has implications on both security and stability.

Vendoring the chart addresses both security and stability: unpack the chart into your repository and commit it. The chart stops being a URL you trust and becomes a directory you can read, diff and scan.

Helm on Simon Shine

helm-vendor: Vendoring Helm charts with Nix