AgentSkillsCN

helm-charts-audit

审计Helm图表，查找反模式、安全问题和最佳实践违规。当您被要求审计、审查或检查Helm图表质量时使用。生成一份综合报告，位于reports/YYYY-MM-DD/helm-charts-audit.md。（项目）

SKILL.md
--- frontmatter
name: helm-charts-audit
description: Audits Helm charts for anti-patterns, security issues, and best practice violations. Use when asked to audit, review, or check Helm chart quality. Generates a comprehensive report under reports/YYYY-MM-DD/helm-charts-audit.md. (project)

Purpose

Enforce Helm chart quality and security standards across the helm-charts/ directory through automated checks.

What it checks (13 checks):

  1. •Image Tags (no latest, mutable tags) - HIGH
  2. •Security Context (runAsNonRoot, no privileged) - HIGH
  3. •Resource Limits (requests, limits, memory) - HIGH
  4. •RBAC Wildcards (no * permissions) - HIGH
  5. •Health Probes (liveness, readiness) - HIGH
  6. •Helm Lint (official helm validation) - HIGH
  7. •Chart Metadata (apiVersion, version, maintainers) - MEDIUM
  8. •Chart Structure (README, NOTES.txt, _helpers.tpl) - MEDIUM
  9. •Dependencies (pinned versions, Chart.lock) - MEDIUM
  10. •Deprecated APIs (no v1beta1, use stable APIs) - MEDIUM
  11. •Argo Rollouts (strategy, analysis, steps) - MEDIUM
  12. •Ingress TLS (certificates, annotations) - MEDIUM
  13. •GPU Resources (nvidia.com/gpu, tolerations) - LOW

Running Checks

Full audit (all checks):

bash
node .claude/skills/helm-charts-audit/scripts/run_all_checks.mjs

Generate report (all checks + markdown report):

bash
node .claude/skills/helm-charts-audit/scripts/generate_report.mjs

Report saved to: reports/YYYY-MM-DD/helm-charts-audit.md

Individual checks:

bash
node .claude/skills/helm-charts-audit/scripts/check_image_tags.mjs
node .claude/skills/helm-charts-audit/scripts/check_security_context.mjs
node .claude/skills/helm-charts-audit/scripts/check_resource_limits.mjs
node .claude/skills/helm-charts-audit/scripts/check_rbac_wildcards.mjs
node .claude/skills/helm-charts-audit/scripts/check_health_probes.mjs
node .claude/skills/helm-charts-audit/scripts/check_helm_lint.mjs
node .claude/skills/helm-charts-audit/scripts/check_chart_metadata.mjs
node .claude/skills/helm-charts-audit/scripts/check_chart_structure.mjs
node .claude/skills/helm-charts-audit/scripts/check_dependencies.mjs
node .claude/skills/helm-charts-audit/scripts/check_deprecated_apis.mjs
node .claude/skills/helm-charts-audit/scripts/check_argo_rollouts.mjs
node .claude/skills/helm-charts-audit/scripts/check_ingress_tls.mjs
node .claude/skills/helm-charts-audit/scripts/check_gpu_resources.mjs

Quality Rules

1. Image Tags (HIGH)

RULE: Never use mutable tags. latest tag = unpredictable deployments + rollback failures.

Violations:

  • •image: nginx:latest - mutable, changes without notice
  • •image: nginx - defaults to :latest
  • •tag: "" - empty tag in values.yaml
  • •tag: head, tag: canary, tag: dev - mutable branch tags

Fix: Use immutable tags like v1.2.3, SHA digests sha256:abc123, or SemVer 1.21.0.

2. Security Context (HIGH)

RULE: Containers must run with minimal privileges. Privileged containers = cluster takeover risk.

Violations:

  • •privileged: true - full host access, container escape trivial
  • •runAsNonRoot: false - runs as root user UID 0
  • •runAsUser: 0 - explicitly root
  • •allowPrivilegeEscalation: true - can gain more privileges
  • •hostNetwork: true - shares host network namespace
  • •hostPID: true - can see/kill host processes
  • •hostIPC: true - can access host shared memory
  • •readOnlyRootFilesystem: false - malware can write anywhere
  • •capabilities.add: [SYS_ADMIN] - near-root level access
  • •capabilities.add: [ALL] - equivalent to privileged

Fix: Add proper securityContext with runAsNonRoot: true, allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, capabilities.drop: [ALL].

3. Resource Limits (HIGH)

RULE: All containers must have resource requests and limits. No limits = node OOM + noisy neighbor issues.

Violations:

  • •resources: {} - empty resources block
  • •Missing requests.cpu - scheduler can't make decisions
  • •Missing requests.memory - OOM killer may terminate unexpectedly
  • •Missing limits.memory - container can consume all node memory
  • •requests > limits - invalid configuration

Fix: Define resources.requests.cpu, resources.requests.memory, resources.limits.memory. Note: CPU limits often intentionally omitted for better performance.

4. RBAC Wildcards (HIGH)

RULE: Follow least-privilege principle. Wildcard permissions = privilege escalation path.

Violations:

  • •verbs: ["*"] - grants all actions
  • •resources: ["*"] - access to all resource types
  • •apiGroups: ["*"] - access across all API groups
  • •roleRef.name: cluster-admin - full cluster access
  • •verbs: [impersonate] - can act as other users
  • •verbs: [escalate, bind] - can grant additional privileges
  • •Access to secrets resource - can read all secrets

Fix: Use explicit verbs like [get, list, watch], explicit resources like [pods, services], avoid cluster-admin bindings.

5. Health Probes (HIGH)

RULE: All workloads must have health probes. No probes = stuck containers not restarted + traffic to unready pods.

Violations:

  • •Deployment without livenessProbe - stuck containers won't restart
  • •Deployment without readinessProbe - traffic sent to unready pods
  • •initialDelaySeconds: 0 - probes start immediately, false failures
  • •timeoutSeconds: 1 - too short, may cause false failures
  • •successThreshold > 1 on livenessProbe - should always be 1
  • •failureThreshold > 10 - delays detecting actual failures

Fix: Add livenessProbe and readinessProbe with reasonable initialDelaySeconds (10-30s), periodSeconds (10s), timeoutSeconds (5s).

6. Helm Lint (HIGH)

RULE: Charts must pass official helm lint validation. Lint failures = deployment failures.

Violations:

  • •Template syntax errors
  • •Missing required fields in Chart.yaml
  • •Invalid YAML structure
  • •Broken template references

Fix: Run helm lint <chart-path> and fix reported issues.

7. Chart Metadata (MEDIUM)

RULE: Chart.yaml must have complete metadata. Missing metadata = maintenance nightmare.

Violations:

  • •apiVersion: v1 - Helm 2 format, upgrade to v2
  • •Missing or invalid version - must be SemVer
  • •Missing appVersion - hard to track what's deployed
  • •Missing description - unclear what chart does
  • •Missing maintainers - no ownership
  • •name doesn't match directory name - confusing

Fix: Use apiVersion: v2, SemVer version, add description and maintainers with email.

8. Chart Structure (MEDIUM)

RULE: Follow standard Helm chart structure. Non-standard = user confusion + missing features.

Violations:

  • •Missing README.md - no documentation
  • •Missing templates/NOTES.txt - no post-install instructions
  • •Missing templates/_helpers.tpl - no template helpers
  • •Missing .helmignore - unnecessary files in package
  • •Missing values.schema.json - no values validation
  • •Empty templates/ directory

Fix: Create missing files following Helm chart best practices.

9. Dependencies (MEDIUM)

RULE: Pin dependency versions. Floating versions = non-reproducible builds.

Violations:

  • •No version on dependency - unpinned
  • •version: "*" or version: "^1.0" - floating version
  • •Missing Chart.lock - dependency versions not locked
  • •repository: file:// - local reference, breaks when published
  • •repository: http:// - insecure, use HTTPS
  • •Deprecated repository URLs (charts.helm.sh/stable)

Fix: Pin exact versions, run helm dependency update to generate Chart.lock.

10. Deprecated APIs (MEDIUM)

RULE: Use stable Kubernetes APIs. Deprecated APIs = upgrade failures.

Violations:

  • •extensions/v1beta1 - removed in K8s 1.22
  • •apps/v1beta1, apps/v1beta2 - removed in K8s 1.16
  • •networking.k8s.io/v1beta1 Ingress - removed in K8s 1.22
  • •batch/v1beta1 CronJob - removed in K8s 1.25
  • •policy/v1beta1 PodSecurityPolicy - removed in K8s 1.25

Fix: Update to stable APIs: apps/v1, networking.k8s.io/v1, batch/v1. Run kubectl convert if needed.

11. Argo Rollouts (MEDIUM)

RULE: Rollouts must have valid strategy configuration. Invalid config = failed deployments.

Violations:

  • •Rollout without strategy - no deployment strategy
  • •Canary without steps - no gradual rollout
  • •Canary without analysis - no automated validation
  • •BlueGreen without activeService - no active service defined
  • •BlueGreen without previewService - can't preview before promotion
  • •Missing revisionHistoryLimit - old ReplicaSets accumulate
  • •Missing progressDeadlineSeconds - stuck rollouts don't timeout

Fix: Configure proper canary steps with analysis, or blueGreen with activeService/previewService.

12. Ingress TLS (MEDIUM)

RULE: Ingress must have TLS configuration. No TLS = unencrypted traffic.

Violations:

  • •Ingress with hosts but no TLS - traffic unencrypted
  • •TLS without secretName - certificate source unclear
  • •No ingressClassName - may use wrong controller
  • •Missing cert-manager annotations - no automated certificates
  • •Deprecated kubernetes.io/ingress.class annotation
  • •No SSL redirect annotation - HTTP doesn't redirect to HTTPS

Fix: Add TLS section with secretName, use cert-manager.io/cluster-issuer annotation for automated certs.

13. GPU Resources (LOW)

RULE: GPU workloads need proper configuration. Missing config = scheduling failures.

Violations:

  • •GPU limits without matching requests - should be equal
  • •No GPU toleration - won't schedule on GPU nodes
  • •No GPU nodeSelector/affinity - relies only on resource availability
  • •No runtimeClassName - may need nvidia runtime

Fix: Set nvidia.com/gpu in both requests and limits (equal values), add GPU tolerations and nodeSelector.

Detection Philosophy

This skill uses VALUE-BASED detection:

  • •Detects issues by actual values and patterns, not by variable/field names
  • •Future-proof: new charts with issues are automatically detected
  • •No need to update scripts when new charts are added

Parsing Strategy

  • •Chart.yaml, values.yaml: YAML content parsed via regex patterns
  • •templates/*.yaml: Regex-based parsing (Go template syntax breaks YAML parsers)
  • •Multi-document YAML: Handles --- separators

Safety

  • •Read-only operation (except report generation)
  • •No Helm releases modified
  • •No cluster changes