helm-chart-auditor

by charlie-morrison

Install this Skill

curl -fsSL -o helm-chart-auditor.zip https://skill.seembox.com/api/v1/skills/helm-chart-auditor/download && unzip helm-chart-auditor.zip

Download helm-chart-auditor.zip

SKILL.md About

---
name: helm-chart-auditor
description: Audit Helm charts for security, best practices, template correctness, and production readiness — check values, templates, hooks, dependencies, and RBAC.
metadata:
  tags: ["helm", "kubernetes", "security", "devops", "deployment"]
---

# Helm Chart Auditor

Audit Helm charts for security vulnerabilities, best practices, template correctness, and production readiness. Reviews Chart.yaml, values.yaml, templates, hooks, RBAC, and dependency management.

## Usage

```
"Audit my Helm chart for issues"
"Check Helm templates for security"
"Review values.yaml for best practices"
"Validate Helm chart before publishing"
```

## How It Works

### 1. Chart Discovery

```bash
cat Chart.yaml 2>/dev/null
cat values.yaml 2>/dev/null | head -50
ls templates/ 2>/dev/null
helm lint . 2>&1
```

### 2. Security Audit

- Containers running as root (no securityContext)
- Missing resource limits (CPU/memory)
- Privileged containers
- Host network/PID access
- Missing NetworkPolicies
- Service accounts with excessive permissions
- Secrets stored as plain text in values.yaml

### 3. Template Quality

- Required values without defaults
- Missing helper templates (_helpers.tpl)
- Hardcoded values that should be in values.yaml
- Missing labels (app.kubernetes.io standard)
- Template rendering errors
- Proper use of `include` vs `template`
- `.Release.Namespace` for namespace scoping

### 4. Production Readiness

- Health probes (liveness, readiness, startup)
- PodDisruptionBudgets defined
- Horizontal Pod Autoscaler configured
- Anti-affinity rules for HA
- Rolling update strategy configured
- Proper image tag (no `latest`)
- Image pull policy appropriate

### 5. Values Schema

- JSON Schema defined (values.schema.json)?
- Default values sensible for development
- Production overlay documented
- Sensitive values clearly marked
- Environment-specific examples provided

## Output

```
## Helm Chart Audit

**Chart:** my-app v1.2.0 | **Templates:** 8

### 🔴 Critical (2)
1. **Running as root** — templates/deployment.yaml
   No securityContext set → runs as root by default
   → Add: runAsNonRoot: true, runAsUser: 1000

2. **No resource limits** — templates/deployment.yaml
   Missing resources.limits → can consume all node resources
   → Add CPU/memory limits appropriate for workload

### 🟡 Improvements (4)
3. Image tag `latest` in values.yaml default
4. Missing PodDisruptionBudget template
5. No values.schema.json for validation
6. Missing anti-affinity for multi-replica deployments

### ✅ Good Practices
- Health probes configured (liveness + readiness)
- Standard labels applied via _helpers.tpl
- HPA template included with sensible defaults
- Chart.yaml has proper appVersion and description
```

_meta.json Metadata

{
  "ownerId": "kn7d5eszdfwftk153ymhdm4qhs83qsqy",
  "publishedAt": 1777617600219,
  "slug": "helm-chart-auditor",
  "version": "1.0.0"
}