helm-validator_skill

Overview

This skill is a comprehensive Helm chart validator and analysis toolkit that inspects chart structure, renders templates, validates YAML and schemas, detects CRDs and looks up CRD docs, and enforces security best practices. It is read-only: it identifies issues, proposes concrete fixes, and lists automation opportunities without modifying files. Use it to catch template, schema, and security problems before packaging or deploying charts.

How this skill works

The skill runs a staged workflow: tool presence checks, chart structure validation, helm linting, template rendering, yamllint checks, CRD detection and documentation lookup, schema validation with kubeconform, optional cluster dry-run, and a mandatory security scan. It aggregates findings into a final validation report that categorizes errors, warnings, and informational recommendations, and proposes precise file-level fixes and automation steps for the user to apply.

When to use it

• Before packaging or releasing a Helm chart
• When debugging template rendering or lint errors
• When testing charts with alternative values or upgrades
• When the chart includes CRDs or needs CRD spec lookup
• To enforce Kubernetes and security best practices before deployment
• When automating chart refactors or helper templates

Best practices

• Run tool check first and install missing tooling before validation
• Keep values.schema.json to validate user inputs and catch type errors early
• Render templates with representative values, including edge cases and upgrade scenarios
• Treat kubeconform schema errors as high priority; use CRD docs for custom resources
• Ensure every Pod/Container has securityContext, resource requests/limits, and probes
• Always produce a final summary with categorized issues and proposed fixes (read-only)

Example use cases

• Validate a CI pipeline step that lints and renders charts before packaging
• Investigate a template rendering failure caused by undefined values or incorrect template functions
• Audit a chart that ships CRDs by extracting required CRD fields from upstream documentation
• Perform a pre-deploy security audit checking for missing securityContext, resource limits, or :latest images
• Refactor templates into _helpers.tpl and verify no behavioral regressions with helm template