Helm Chart Linter

What this skill does

Lints a Helm chart for common best-practice violations and produces a punch-list of fixes. Combines helm lint, helm template-then-kubeval validation, and a custom rule set focused on production readiness.

Inputs

• chart_dir: path to the chart directory (must contain Chart.yaml).
• Optional values_file: path to a values file used for templating (default <chart_dir>/values.yaml).
• Optional target_k8s_version: drives the API version checks (default 1.29).

Steps

1. Run helm lint <chart_dir> and capture any errors/warnings.
2. Render manifests: helm template <chart_dir> -f <values_file> > /tmp/rendered.yaml.
3. Validate against the Kubernetes schema: kubeconform -strict -kubernetes-version <target_k8s_version> /tmp/rendered.yaml.
4. Apply custom rules over the rendered YAML:
   • Containers must not use image: foo:latest or untagged images.
   • PodSpec must set securityContext.runAsNonRoot: true and readOnlyRootFilesystem: true.
   • Each container must declare livenessProbe AND readinessProbe.
   • Resource requests must be set for CPU and memory.
   • Workloads must have a PodDisruptionBudget if replicas > 1.
   • Service ports must use named ports referenced by container ports.
   • Secrets must not appear in plain data: (only stringData: from values is fine; flag literal base64 in templates).
5. Apply template-hygiene rules: no trailing whitespace in templates, indent consistency, range blocks must have a with for safe access.
6. For each violation, emit file:line referencing the template file (not the rendered output).
7. Group findings by severity: blocker (kubeconform error, latest tag), warning (missing probes), suggestion (missing PDB).
8. Emit a markdown report.

Output

helm-lint.md with sections per severity, each row showing template file:line, the rule, and a one-line fix. Exit 1 if any blockers exist.

Verification

After fixes are applied, rerun helm lint, kubeconform, and the custom rules; expect zero blockers. Manually helm install --dry-run --debug the chart against a kind cluster to confirm rendered manifests are accepted by the API server. Sample three "missing probe" findings by reading the template and confirm there isn't a probe defined further down that the regex missed.

Edge cases

• Chart uses sub-charts: lint each sub-chart independently and aggregate.
• Templates with conditional containers ({{- if .Values.foo }}): render with both foo: true and foo: false and merge findings; missing probes in one branch is still a finding.
• Charts targeting older Kubernetes (< 1.16): some rules don't apply (e.g., no securityContext fields); pin target_k8s_version accordingly.
• Values referencing computed images via printf: skip the latest-tag check for those; flag for human review.