{"resources":{"helm":{"id":"helm","name":"helm","fields":{"chart":{"name":"chart","type":"\u001bhelm.chart","title":"Helm chart","desc":"Parsed Helm chart covering its Chart.yaml metadata, declared dependencies and maintainers, Go template files, default and effective values, the Kubernetes resources it renders, lifecycle hooks, bundled files, lint results, and supply-chain provenance. Auditing a chart here catches insecure workloads, unpinned dependencies, and policy violations before the chart is ever installed to a cluster.","provider":"go.mondoo.com/mql/v13/providers/helm","is_implicit_resource":true},"charts":{"name":"charts","type":"\u0019\u001bhelm.chart","title":"List of all parsed Helm charts","provider":"go.mondoo.com/mql/v13/providers/helm"},"dependency":{"name":"dependency","type":"\u001bhelm.dependency","title":"Helm chart dependency","desc":"Entry from a chart's `dependencies:` list in Chart.yaml, describing a subchart the parent chart depends on. Records the version constraint, source repository, conditional-enable expression, and tag groupings that decide whether Helm renders the subchart, along with the resolved version from Chart.lock and the vendored chart on disk. The `sourceType` field classifies where the dependency comes from (OCI registry, chart repository, or local path) for supply-chain auditing.","provider":"go.mondoo.com/mql/v13/providers/helm","is_implicit_resource":true},"directive":{"name":"directive","type":"\u001bhelm.directive","title":"Go-template directive in a Helm template","desc":"Single Go-template control directive (if, range, include, tpl, define, with, or block) found inside a chart template, with its type, full expression, and source line. Useful for flagging dynamic constructs that policy can't reason about statically, such as a `tpl` call over unbounded user input.","provider":"go.mondoo.com/mql/v13/providers/helm","is_implicit_resource":true},"file":{"name":"file","type":"\u001bhelm.file","title":"File within a Helm chart","desc":"Single file shipped with the chart, selected by its `path` relative to the chart root, for example `helm.file(path: \"NOTES.txt\")`. Useful for inspecting NOTES.txt, README, LICENSE, or auxiliary scripts bundled alongside the templates. The `content` field returns the raw file bytes as a string.","provider":"go.mondoo.com/mql/v13/providers/helm","is_implicit_resource":true},"maintainer":{"name":"maintainer","type":"\u001bhelm.maintainer","title":"Helm chart maintainer","desc":"A single `maintainers:` entry from a chart's Chart.yaml, recording the name, email, and optional URL of a person responsible for the chart. Use it for supply-chain ownership and contact audits, verifying that charts declare an accountable maintainer and reaching the right party for security disclosures.","provider":"go.mondoo.com/mql/v13/providers/helm","is_implicit_resource":true},"ociRef":{"name":"ociRef","type":"\u001bhelm.ociRef","title":"OCI registry reference for a Helm chart dependency","desc":"Parsed parts of an `oci://` dependency reference (Helm 3.8+): the full reference, the registry host, the repository path, and the pinned tag or digest. Useful for auditing where chart dependencies are sourced from and whether they are pinned by tag or by digest. Parsing is offline: the reference string and the dependency's version constraint are classified and decomposed without ever pulling from the registry.","provider":"go.mondoo.com/mql/v13/providers/helm","is_implicit_resource":true},"resource":{"name":"resource","type":"\u001bhelm.resource","title":"Kubernetes resource rendered from a Helm template","desc":"Kubernetes object a chart produces once its templates are rendered with a set of values, the same manifest that would be applied to a cluster on install or upgrade. Auditing rendered resources lets policy evaluate the concrete objects a release creates (workloads, RBAC, network policy) rather than the unrendered template text. The `isHook` and `isCRD` predicates separate lifecycle hooks and pre-installed CRDs from normally applied resources.","provider":"go.mondoo.com/mql/v13/providers/helm","is_implicit_resource":true},"template":{"name":"template","type":"\u001bhelm.template","title":"Helm template file","desc":"Single file under the chart's templates/ directory, identified by its `name` (for example templates/deployment.yaml). Exposes both the raw Go-template source and the rendered YAML produced by applying the chart's values, letting policy compare what a template declares against what it actually deploys. The Kubernetes resources rendering produces and the Go-template directives found in the source are queryable for flagging dynamic constructs that static analysis can't fully evaluate.","provider":"go.mondoo.com/mql/v13/providers/helm","is_implicit_resource":true}},"title":"Helm chart catalog","desc":"Top-level entry point for analyzing Helm charts. Exposes every parsed chart along with its metadata, templates, rendered Kubernetes resources, dependencies, and bundled files, used to enforce policy on Kubernetes manifests before they ever reach a cluster.","min_provider_version":"13.0.0","provider":"go.mondoo.com/mql/v13/providers/helm"},"helm.chart":{"id":"helm.chart","name":"helm.chart","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Chart-level annotations","desc":"From `annotations:` in Chart.yaml. Used by Helm itself (for example `artifacthub.io/changes`, `artifacthub.io/license`, `helm.sh/chart-deprecation`) and by chart consumers for arbitrary metadata.","min_provider_version":"13.0.9","provider":"go.mondoo.com/mql/v13/providers/helm"},"apiVersion":{"name":"apiVersion","type":"\u0007","is_mandatory":true,"title":"API version (v1 or v2)","provider":"go.mondoo.com/mql/v13/providers/helm"},"appVersion":{"name":"appVersion","type":"\u0007","is_mandatory":true,"title":"Application version","provider":"go.mondoo.com/mql/v13/providers/helm"},"crds":{"name":"crds","type":"\u0019\u001bhelm.resource","title":"Custom Resource Definitions shipped in crds/","desc":"Each CustomResourceDefinition under the chart's crds/ directory, parsed as a helm.resource with isCRD true. Helm installs these before templates render and never templates them, so they are not part of resources(); query them here to audit the CRDs a chart introduces.","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/helm"},"dependencies":{"name":"dependencies","type":"\u0019\u001bhelm.dependency","title":"Chart dependencies","provider":"go.mondoo.com/mql/v13/providers/helm"},"dependencyLock":{"name":"dependencyLock","type":"\u001bhelm.chart.dependencyLock","title":"Helm chart dependency lock","desc":"Resolved dependency lock recorded in Chart.lock: the generation timestamp, the digest over the resolved dependency set, and the concrete dependency versions Helm pinned. Selected from a chart via `helm.chart.lock`.","is_private":true,"provider":"go.mondoo.com/mql/v13/providers/helm","is_implicit_resource":true},"deprecated":{"name":"deprecated","type":"\u0004","is_mandatory":true,"title":"Whether the chart is deprecated","provider":"go.mondoo.com/mql/v13/providers/helm"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Chart description","provider":"go.mondoo.com/mql/v13/providers/helm"},"files":{"name":"files","type":"\u0019\u001bhelm.file","title":"Files in the chart","provider":"go.mondoo.com/mql/v13/providers/helm"},"home":{"name":"home","type":"\u0007","is_mandatory":true,"title":"Home URL","provider":"go.mondoo.com/mql/v13/providers/helm"},"hooks":{"name":"hooks","type":"\u0019\u001bhelm.resource","title":"Lifecycle hook resources","desc":"Rendered resources carrying a helm.sh/hook annotation (pre-install, post-upgrade, test, and so on). These run outside the normal resource lifecycle; surfacing them separately lets policy audit hook workloads (often privileged jobs) without scanning every rendered resource.","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/helm"},"icon":{"name":"icon","type":"\u0007","is_mandatory":true,"title":"Icon URL","provider":"go.mondoo.com/mql/v13/providers/helm"},"isSubchart":{"name":"isSubchart","type":"\u0004","is_mandatory":true,"title":"Whether this chart was reached as a vendored subchart of another chart","desc":"True for charts materialized through subcharts(); false for top-level charts loaded directly from the connection path.","min_provider_version":"13.0.10","provider":"go.mondoo.com/mql/v13/providers/helm"},"keywords":{"name":"keywords","type":"\u0019\u0007","is_mandatory":true,"title":"Keywords","provider":"go.mondoo.com/mql/v13/providers/helm"},"kubeVersion":{"name":"kubeVersion","type":"\u0007","is_mandatory":true,"title":"SemVer constraint on the supported Kubernetes versions","desc":"From `kubeVersion:` in Chart.yaml. Empty when unconstrained. Audits commonly require every chart to pin a kubeVersion so it can be gated against a cluster's actual version (e.g. `\u003e=1.27.0-0`).","min_provider_version":"13.0.9","provider":"go.mondoo.com/mql/v13/providers/helm"},"lint":{"name":"lint","type":"\u001bhelm.chart.lintResult","title":"Lint report","desc":"Result of running Helm's built-in lint rules against the chart, including every message with its severity and the chart-relative path it concerns. Lets CI gate on chart linting without shelling out to `helm lint`.","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/helm"},"lintMessage":{"name":"lintMessage","type":"\u001bhelm.chart.lintMessage","title":"Helm chart lint message","desc":"Single message from a chart lint run: its severity, the chart-relative path it concerns, and the human-readable text.","is_private":true,"provider":"go.mondoo.com/mql/v13/providers/helm","is_implicit_resource":true},"lintResult":{"name":"lintResult","type":"\u001bhelm.chart.lintResult","title":"Helm chart lint result","desc":"Outcome of linting a chart with Helm's built-in rules: whether it passed (no error-severity messages) and the full list of messages. Selected from a chart via `helm.chart.lint`.","is_private":true,"provider":"go.mondoo.com/mql/v13/providers/helm","is_implicit_resource":true},"lock":{"name":"lock","type":"\u001bhelm.chart.dependencyLock","title":"Resolved dependency lock","desc":"The chart's Chart.lock recording the concrete dependency versions Helm resolved, or null when the chart has no lock file. Use it to verify a chart pins reproducible dependency versions.","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/helm"},"maintainers":{"name":"maintainers","type":"\u0019\u001bhelm.maintainer","title":"Maintainers","provider":"go.mondoo.com/mql/v13/providers/helm"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Chart name from Chart.yaml","provider":"go.mondoo.com/mql/v13/providers/helm"},"notes":{"name":"notes","type":"\u0007","title":"Rendered NOTES.txt","desc":"The chart's templates/NOTES.txt rendered with the effective values, or empty when the chart ships no NOTES.txt. This is the post-install message Helm prints to operators; auditing it catches secrets or instructions accidentally emitted on install.","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/helm"},"parent":{"name":"parent","type":"\u001bhelm.chart","title":"Parent chart that vendors this chart as a subchart","desc":"Null for top-level charts. For a vendored subchart, links back to the chart whose charts/ directory it was loaded from, enabling traversal back up the dependency tree.","min_provider_version":"13.0.10","provider":"go.mondoo.com/mql/v13/providers/helm"},"provenance":{"name":"provenance","type":"\u001bhelm.chart.provenanceRecord","title":"Supply-chain provenance","desc":"The PGP provenance Helm attaches to a signed, packaged chart (the .prov file produced by `helm package --sign`), recording the chart archive's sha256 digest and the signing key. Available only for a chart fetched from an OCI registry or an HTTP repository that ships a provenance file; null for charts loaded from a local path, for subcharts, and for fetched charts that carry no provenance. See helm.chart.provenanceRecord.","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/v13/providers/helm"},"provenanceRecord":{"name":"provenanceRecord","type":"\u001bhelm.chart.provenanceRecord","title":"Helm chart provenance","desc":"PGP provenance attached to a fetched chart (the .prov file Helm writes with `helm package --sign`). Reports whether the chart is signed, the sha256 digest the signature attests for the chart archive, whether the archive actually fetched matches that digest, and the key ID that produced the signature. Verification is offline: the digest is recomputed locally and the issuer is read from the signature packet, so no keyring and no registry round-trip are involved. Selected from a chart via `helm.chart.provenance`.","is_private":true,"provider":"go.mondoo.com/mql/v13/providers/helm","is_implicit_resource":true},"renderedValues":{"name":"renderedValues","type":"\n","title":"Effective values used to render this chart","desc":"The chart's bundled values.yaml coalesced with any --values files and --set overrides supplied on the connection (exactly the values Helm used to produce resources and the templates' rendered output). With no overrides this is the chart's default values. Contrast with values, which is always the bundled values.yaml verbatim.","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/helm"},"resources":{"name":"resources","type":"\u0019\u001bhelm.resource","title":"All Kubernetes resources across all templates (rendered with values)","provider":"go.mondoo.com/mql/v13/providers/helm"},"sources":{"name":"sources","type":"\u0019\u0007","is_mandatory":true,"title":"Source URLs","provider":"go.mondoo.com/mql/v13/providers/helm"},"subcharts":{"name":"subcharts","type":"\u0019\u001bhelm.chart","title":"Vendored subcharts loaded from charts/","desc":"Each entry is a fully recursive helm.chart for a dependency whose chart body is vendored under the chart's charts/ directory, so every chart field (templates, values, dependencies, maintainers, files, and subcharts again) works per-subchart. Helm's render engine already merges subchart templates into the parent chart's rendered output, so this is for introspecting the source tree (per-subchart values, metadata, and declared dependencies), not for obtaining additional rendered manifests beyond what the parent already renders.","min_provider_version":"13.0.10","provider":"go.mondoo.com/mql/v13/providers/helm"},"templates":{"name":"templates","type":"\u0019\u001bhelm.template","title":"Parsed templates","provider":"go.mondoo.com/mql/v13/providers/helm"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Chart type (application or library)","provider":"go.mondoo.com/mql/v13/providers/helm"},"values":{"name":"values","type":"\n","title":"Default values from values.yaml","provider":"go.mondoo.com/mql/v13/providers/helm"},"valuesSchema":{"name":"valuesSchema","type":"\n","title":"Parsed values.schema.json","desc":"The chart's JSON Schema for values (Helm 3), or null when the chart ships none. Helm validates supplied values against this schema at install time; expose it so policy can require a schema or inspect its constraints.","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/helm"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Chart version","provider":"go.mondoo.com/mql/v13/providers/helm"}},"title":"Helm chart","desc":"Parsed Helm chart covering its Chart.yaml metadata, declared dependencies and maintainers, Go template files, default and effective values, the Kubernetes resources it renders, lifecycle hooks, bundled files, lint results, and supply-chain provenance. Auditing a chart here catches insecure workloads, unpinned dependencies, and policy violations before the chart is ever installed to a cluster.","min_provider_version":"13.0.0","defaults":"name version","provider":"go.mondoo.com/mql/v13/providers/helm"},"helm.chart.dependencyLock":{"id":"helm.chart.dependencyLock","name":"helm.chart.dependencyLock","fields":{"dependencies":{"name":"dependencies","type":"\u0019\u001bhelm.dependency","title":"Locked dependencies with their resolved versions","provider":"go.mondoo.com/mql/v13/providers/helm"},"digest":{"name":"digest","type":"\u0007","is_mandatory":true,"title":"Digest over the resolved dependency set","provider":"go.mondoo.com/mql/v13/providers/helm"},"generated":{"name":"generated","type":"\t","is_mandatory":true,"title":"Time the lock file was generated","provider":"go.mondoo.com/mql/v13/providers/helm"}},"title":"Helm chart dependency lock","desc":"Resolved dependency lock recorded in Chart.lock: the generation timestamp, the digest over the resolved dependency set, and the concrete dependency versions Helm pinned. Selected from a chart via `helm.chart.lock`.","private":true,"min_provider_version":"13.1.1","defaults":"digest generated","provider":"go.mondoo.com/mql/v13/providers/helm"},"helm.chart.lintMessage":{"id":"helm.chart.lintMessage","name":"helm.chart.lintMessage","fields":{"message":{"name":"message","type":"\u0007","is_mandatory":true,"title":"Message text","provider":"go.mondoo.com/mql/v13/providers/helm"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Chart-relative path the message concerns","provider":"go.mondoo.com/mql/v13/providers/helm"},"severity":{"name":"severity","type":"\u0007","is_mandatory":true,"title":"Severity","desc":"One of \"info\", \"warning\", or \"error\".","provider":"go.mondoo.com/mql/v13/providers/helm"}},"title":"Helm chart lint message","desc":"Single message from a chart lint run: its severity, the chart-relative path it concerns, and the human-readable text.","private":true,"min_provider_version":"13.1.1","defaults":"severity message","provider":"go.mondoo.com/mql/v13/providers/helm"},"helm.chart.lintResult":{"id":"helm.chart.lintResult","name":"helm.chart.lintResult","fields":{"messages":{"name":"messages","type":"\u0019\u001bhelm.chart.lintMessage","title":"Lint messages","provider":"go.mondoo.com/mql/v13/providers/helm"},"passed":{"name":"passed","type":"\u0004","is_mandatory":true,"title":"Whether the chart passed linting (no error-severity messages)","provider":"go.mondoo.com/mql/v13/providers/helm"}},"title":"Helm chart lint result","desc":"Outcome of linting a chart with Helm's built-in rules: whether it passed (no error-severity messages) and the full list of messages. Selected from a chart via `helm.chart.lint`.","private":true,"min_provider_version":"13.1.1","defaults":"passed","provider":"go.mondoo.com/mql/v13/providers/helm"},"helm.chart.provenanceRecord":{"id":"helm.chart.provenanceRecord","name":"helm.chart.provenanceRecord","fields":{"digest":{"name":"digest","type":"\u0007","is_mandatory":true,"title":"Digest the provenance attests for the chart archive","desc":"The `sha256:...` value recorded in the signed `files:` block for the chart's .tgz. Empty when the provenance records no digest for the archive.","provider":"go.mondoo.com/mql/v13/providers/helm"},"digestMatches":{"name":"digestMatches","type":"\u0004","is_mandatory":true,"title":"Whether the fetched archive matches the attested digest","desc":"True when the sha256 of the archive actually fetched equals digest. The hash is recomputed locally (no registry round-trip and no keyring), so a false value flags a tampered or stale provenance file. False when digest is empty or the archive couldn't be hashed.","provider":"go.mondoo.com/mql/v13/providers/helm"},"keyId":{"name":"keyId","type":"\u0007","is_mandatory":true,"title":"Key ID that produced the signature","desc":"The 16-hexadecimal-character issuer key ID read from the signature packet (for example \"1234567890ABCDEF\"), identifying the signer without their public key. Empty when unsigned or the issuer can't be read. Full cryptographic verification against a keyring is out of scope.","provider":"go.mondoo.com/mql/v13/providers/helm"},"signed":{"name":"signed","type":"\u0004","is_mandatory":true,"title":"Whether the provenance carries a PGP signature block","provider":"go.mondoo.com/mql/v13/providers/helm"}},"title":"Helm chart provenance","desc":"PGP provenance attached to a fetched chart (the .prov file Helm writes with `helm package --sign`). Reports whether the chart is signed, the sha256 digest the signature attests for the chart archive, whether the archive actually fetched matches that digest, and the key ID that produced the signature. Verification is offline: the digest is recomputed locally and the issuer is read from the signature packet, so no keyring and no registry round-trip are involved. Selected from a chart via `helm.chart.provenance`.","private":true,"min_provider_version":"13.2.1","defaults":"signed digestMatches keyId","provider":"go.mondoo.com/mql/v13/providers/helm"},"helm.dependency":{"id":"helm.dependency","name":"helm.dependency","fields":{"alias":{"name":"alias","type":"\u0007","is_mandatory":true,"title":"Alias for the dependency","provider":"go.mondoo.com/mql/v13/providers/helm"},"chart":{"name":"chart","type":"\u001bhelm.chart","title":"Vendored subchart satisfying this dependency","desc":"The helm.chart loaded from the parent's charts/ directory that satisfies this dependency, matched by name or alias. Null when the dependency isn't vendored on disk. Lets you traverse from a declared dependency straight into the resolved chart's templates and values.","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/helm"},"condition":{"name":"condition","type":"\u0007","is_mandatory":true,"title":"Condition for enabling","provider":"go.mondoo.com/mql/v13/providers/helm"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether dependency is enabled","provider":"go.mondoo.com/mql/v13/providers/helm"},"importValues":{"name":"importValues","type":"\u0019\n","is_mandatory":true,"title":"Values imported from this dependency","desc":"The dependency's `import-values` entries from Chart.yaml, which map a subchart's values onto the parent. Each entry is either a `{child, parent}` dict or a plain string naming a values block. Empty when the dependency imports nothing.","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/helm"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Dependency name","provider":"go.mondoo.com/mql/v13/providers/helm"},"registryRef":{"name":"registryRef","type":"\u001bhelm.ociRef","title":"OCI registry reference parsed from the repository","desc":"Non-null only when sourceType is \"oci\"; null otherwise. Breaks the `oci://` reference into registry, repository, tag, and digest for offline supply-chain auditing without contacting the registry.","min_provider_version":"13.0.10","provider":"go.mondoo.com/mql/v13/providers/helm"},"repository":{"name":"repository","type":"\u0007","is_mandatory":true,"title":"Repository URL","provider":"go.mondoo.com/mql/v13/providers/helm"},"resolvedVersion":{"name":"resolvedVersion","type":"\u0007","title":"Resolved version from Chart.lock","desc":"The concrete version Helm locked for this dependency, read from the parent chart's Chart.lock. Empty when the chart has no lock file or the dependency isn't locked. Unlike version (the declared constraint such as `^1.2.0`), this is the exact version that would be pulled.","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/helm"},"sourceType":{"name":"sourceType","type":"\u0007","is_mandatory":true,"title":"Classification of the dependency's source","desc":"Derived from the `repository:` value (and `alias`/local path when the repository is empty). One of: \"oci\" for an OCI registry reference (`oci://...`, Helm 3.8+), \"http\" or \"https\" for a classic chart repository URL, \"file\" for a `file://` or local relative path, \"alias\" when the dependency references a sibling chart by alias with no repository, or \"unknown\" when the source can't be classified.","min_provider_version":"13.0.10","provider":"go.mondoo.com/mql/v13/providers/helm"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags for grouping","provider":"go.mondoo.com/mql/v13/providers/helm"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Version constraint","provider":"go.mondoo.com/mql/v13/providers/helm"}},"title":"Helm chart dependency","desc":"Entry from a chart's `dependencies:` list in Chart.yaml, describing a subchart the parent chart depends on. Records the version constraint, source repository, conditional-enable expression, and tag groupings that decide whether Helm renders the subchart, along with the resolved version from Chart.lock and the vendored chart on disk. The `sourceType` field classifies where the dependency comes from (OCI registry, chart repository, or local path) for supply-chain auditing.","min_provider_version":"13.0.0","defaults":"name version","provider":"go.mondoo.com/mql/v13/providers/helm"},"helm.directive":{"id":"helm.directive","name":"helm.directive","fields":{"expression":{"name":"expression","type":"\u0007","is_mandatory":true,"title":"Full expression (e.g., \".Values.replicaCount\", \"include \\\"mychart.labels\\\" .\")","provider":"go.mondoo.com/mql/v13/providers/helm"},"line":{"name":"line","type":"\u0005","is_mandatory":true,"title":"Line number in the template","provider":"go.mondoo.com/mql/v13/providers/helm"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Directive type (if, range, include, tpl, define, with, block)","provider":"go.mondoo.com/mql/v13/providers/helm"}},"title":"Go-template directive in a Helm template","desc":"Single Go-template control directive (if, range, include, tpl, define, with, or block) found inside a chart template, with its type, full expression, and source line. Useful for flagging dynamic constructs that policy can't reason about statically, such as a `tpl` call over unbounded user input.","min_provider_version":"13.0.0","defaults":"type expression","provider":"go.mondoo.com/mql/v13/providers/helm"},"helm.file":{"id":"helm.file","name":"helm.file","fields":{"content":{"name":"content","type":"\u0007","title":"File content","provider":"go.mondoo.com/mql/v13/providers/helm"},"isBinary":{"name":"isBinary","type":"\u0004","is_mandatory":true,"title":"Whether the file is binary","desc":"True when the content isn't valid UTF-8 text (for example a bundled icon image). Binary files still expose content as a best-effort string.","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/helm"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"File path relative to chart root","provider":"go.mondoo.com/mql/v13/providers/helm"},"size":{"name":"size","type":"\u0005","is_mandatory":true,"title":"File size in bytes","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/helm"}},"title":"File within a Helm chart","desc":"Single file shipped with the chart, selected by its `path` relative to the chart root, for example `helm.file(path: \"NOTES.txt\")`. Useful for inspecting NOTES.txt, README, LICENSE, or auxiliary scripts bundled alongside the templates. The `content` field returns the raw file bytes as a string.","min_provider_version":"13.0.0","defaults":"path","provider":"go.mondoo.com/mql/v13/providers/helm"},"helm.maintainer":{"id":"helm.maintainer","name":"helm.maintainer","fields":{"email":{"name":"email","type":"\u0007","is_mandatory":true,"title":"Maintainer email","provider":"go.mondoo.com/mql/v13/providers/helm"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Maintainer name","provider":"go.mondoo.com/mql/v13/providers/helm"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"Maintainer URL","provider":"go.mondoo.com/mql/v13/providers/helm"}},"title":"Helm chart maintainer","desc":"A single `maintainers:` entry from a chart's Chart.yaml, recording the name, email, and optional URL of a person responsible for the chart. Use it for supply-chain ownership and contact audits, verifying that charts declare an accountable maintainer and reaching the right party for security disclosures.","min_provider_version":"13.0.0","defaults":"name email","provider":"go.mondoo.com/mql/v13/providers/helm"},"helm.ociRef":{"id":"helm.ociRef","name":"helm.ociRef","fields":{"digest":{"name":"digest","type":"\u0007","is_mandatory":true,"title":"Digest the reference is pinned to","desc":"A `sha256:...` digest when the reference or version pins one (via an `@sha256:` suffix); empty otherwise.","provider":"go.mondoo.com/mql/v13/providers/helm"},"reference":{"name":"reference","type":"\u0007","is_mandatory":true,"title":"Full OCI reference (e.g., oci://ghcr.io/acme/charts/redis)","provider":"go.mondoo.com/mql/v13/providers/helm"},"registry":{"name":"registry","type":"\u0007","is_mandatory":true,"title":"Registry host (e.g., ghcr.io)","provider":"go.mondoo.com/mql/v13/providers/helm"},"repository":{"name":"repository","type":"\u0007","is_mandatory":true,"title":"Repository path within the registry (e.g., acme/charts/redis)","provider":"go.mondoo.com/mql/v13/providers/helm"},"tag":{"name":"tag","type":"\u0007","is_mandatory":true,"title":"Tag the reference resolves to","desc":"Taken from the dependency's version constraint when it's a concrete version, or from a `:tag` suffix on the reference. Empty when the reference is pinned by digest or the version is a range constraint.","provider":"go.mondoo.com/mql/v13/providers/helm"}},"title":"OCI registry reference for a Helm chart dependency","desc":"Parsed parts of an `oci://` dependency reference (Helm 3.8+): the full reference, the registry host, the repository path, and the pinned tag or digest. Useful for auditing where chart dependencies are sourced from and whether they are pinned by tag or by digest. Parsing is offline: the reference string and the dependency's version constraint are classified and decomposed without ever pulling from the registry.","min_provider_version":"13.0.10","defaults":"reference","provider":"go.mondoo.com/mql/v13/providers/helm"},"helm.resource":{"id":"helm.resource","name":"helm.resource","fields":{"annotations":{"name":"annotations","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Annotations","provider":"go.mondoo.com/mql/v13/providers/helm"},"apiVersion":{"name":"apiVersion","type":"\u0007","is_mandatory":true,"title":"Kubernetes API version","provider":"go.mondoo.com/mql/v13/providers/helm"},"hookDeletePolicies":{"name":"hookDeletePolicies","type":"\u0019\u0007","is_mandatory":true,"title":"Hook deletion policies","desc":"The `helm.sh/hook-delete-policy` values controlling when Helm deletes the hook resource (for example before-hook-creation, hook-succeeded, hook-failed). Empty when unset.","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/helm"},"hookTypes":{"name":"hookTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Hook lifecycle phases","desc":"The phases this resource hooks into (for example pre-install, post-upgrade, test), parsed from the `helm.sh/hook` annotation. Empty for non-hook resources.","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/helm"},"hookWeight":{"name":"hookWeight","type":"\u0005","is_mandatory":true,"title":"Hook execution weight","desc":"The `helm.sh/hook-weight` value controlling hook ordering (lower runs first). 0 when unset or the resource isn't a hook.","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/helm"},"isCRD":{"name":"isCRD","type":"\u0004","is_mandatory":true,"title":"Whether this resource is a CustomResourceDefinition from crds/","desc":"True for resources produced by helm.chart.crds, the CRDs Helm installs ahead of templating. False for normally rendered resources.","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/helm"},"isHook":{"name":"isHook","type":"\u0004","is_mandatory":true,"title":"Whether this resource is a Helm lifecycle hook","desc":"True when the resource carries a `helm.sh/hook` annotation. Hook resources run outside the normal apply order and are also surfaced via helm.chart.hooks.","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/helm"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Resource kind (Deployment, Service, etc.)","provider":"go.mondoo.com/mql/v13/providers/helm"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Labels","provider":"go.mondoo.com/mql/v13/providers/helm"},"manifest":{"name":"manifest","type":"\n","is_mandatory":true,"title":"Complete rendered manifest","desc":"Whole Kubernetes object as a nested dict, keyed by the manifest's own top-level fields (apiVersion, kind, metadata, spec, and whatever else the kind defines such as data, rules, or subjects). Use it to inspect fields not surfaced as dedicated attributes on this resource.","provider":"go.mondoo.com/mql/v13/providers/helm"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resource name (after rendering)","provider":"go.mondoo.com/mql/v13/providers/helm"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Resource namespace","provider":"go.mondoo.com/mql/v13/providers/helm"},"template":{"name":"template","type":"\u001bhelm.template","title":"The template that produced this resource","provider":"go.mondoo.com/mql/v13/providers/helm"}},"title":"Kubernetes resource rendered from a Helm template","desc":"Kubernetes object a chart produces once its templates are rendered with a set of values, the same manifest that would be applied to a cluster on install or upgrade. Auditing rendered resources lets policy evaluate the concrete objects a release creates (workloads, RBAC, network policy) rather than the unrendered template text. The `isHook` and `isCRD` predicates separate lifecycle hooks and pre-installed CRDs from normally applied resources.","min_provider_version":"13.0.0","defaults":"kind name","provider":"go.mondoo.com/mql/v13/providers/helm"},"helm.template":{"id":"helm.template","name":"helm.template","fields":{"directives":{"name":"directives","type":"\u0019\u001bhelm.directive","title":"Template directives found in raw content (include, tpl, range, if, etc.)","provider":"go.mondoo.com/mql/v13/providers/helm"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Template file name (e.g., templates/deployment.yaml)","provider":"go.mondoo.com/mql/v13/providers/helm"},"raw":{"name":"raw","type":"\u0007","is_mandatory":true,"title":"Raw Go template content before rendering","provider":"go.mondoo.com/mql/v13/providers/helm"},"rendered":{"name":"rendered","type":"\u0007","title":"Rendered YAML content (using chart values)","provider":"go.mondoo.com/mql/v13/providers/helm"},"requiresCluster":{"name":"requiresCluster","type":"\u0004","is_mandatory":true,"title":"Whether rendering this template requires a live cluster","desc":"True when the template calls the `lookup` function, which queries a running cluster at render time. Such templates can't be fully rendered by static analysis; this flag explains why a rendered resource may be missing or incomplete.","min_provider_version":"13.1.1","provider":"go.mondoo.com/mql/v13/providers/helm"},"resources":{"name":"resources","type":"\u0019\u001bhelm.resource","title":"Kubernetes resources produced by rendering this template","provider":"go.mondoo.com/mql/v13/providers/helm"}},"title":"Helm template file","desc":"Single file under the chart's templates/ directory, identified by its `name` (for example templates/deployment.yaml). Exposes both the raw Go-template source and the rendered YAML produced by applying the chart's values, letting policy compare what a template declares against what it actually deploys. The Kubernetes resources rendering produces and the Go-template directives found in the source are queryable for flagging dynamic constructs that static analysis can't fully evaluate.","min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/v13/providers/helm"}}}