Chart metadata exposed due to permissive RBAC on Helm release ConfigMaps and Secrets

Ensure that the ConfigMaps and Secrets Helm uses to store chart metadata and release history are not readable by unauthorized users or workloads in the cluster.

When a release is installed with helm install --create-namespace, the newly created namespace inherits the cluster’s default service account and any existing network policies; administrators must confirm that these defaults do not grant broad get, list, watch permissions on resources labeled owner=helm. It remains unclear whether the inherited policies are sufficiently restrictive or need explicit tightening.

What RBAC rules should be applied to the release namespace to limit read access to Helm‑owned ConfigMaps and Secrets? How can administrators verify that the namespace does not inherit overly permissive defaults from the cluster? Should network policies be enforced at namespace creation to block inbound traffic from untrusted sources?