[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6KPHQJCSH34ZQGJ901RC44J":3,"skill-same:01M6KPHQJCSH34ZQGJ901RC44J":113},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":37,"publishedAt":58,"linkOnly":59,"markdownContent":60,"markdownBody":61,"frontMatter":62,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":14,"repositoryHtmlUrl":71,"repositoryHomepageUrl":6,"ownerHtmlUrl":72,"ownerBlogUrl":6,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6KPHQJCSH34ZQGJ901RC44J","helm-chart-builder",null,"Helm chart development agent skill and plugin for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw — chart scaffolding, values design, template patterns, dependency management, security hardening, and chart testing. Use when: user wants to create or improve Helm charts, design values.yaml files, implement template helpers, audit chart security (RBAC, network policies, pod security), manage subcharts, or run helm lint\u002Ftest.","Boboegg\u002Fai-resources","Boboegg","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F171472260?v=4","01M6KMJYEA4SVHDTXRTH3HZANA","曾柏儒","01M6KMJYJ4231XB9W048VZ8RBB",1,"MIT","https:\u002F\u002Fgithub.com\u002FBoboegg\u002Fai-resources\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fengineering\u002Fhelm-chart-builder\u002FSKILL.md",[18,23,26,29,34],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000013","分析与可视化",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",{"categoryNo":35,"categoryName":36,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000033","数据分析师",[38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57],"chart","chart builder","helm","builder","helm chart builder","template","helm charts","chart testing","scaffolding","files","helm chart development","dependency","testing","improve","Charts","audit","code","create","cli","design","2026-11-10 10:12:30",false,"---\nname: \"helm-chart-builder\"\ndescription: \"Helm chart development agent skill and plugin for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw — chart scaffolding, values design, template patterns, dependency management, security hardening, and chart testing. Use when: user wants to create or improve Helm charts, design values.yaml files, implement template helpers, audit chart security (RBAC, network policies, pod security), manage subcharts, or run helm lint\u002Ftest.\"\nlicense: MIT\nmetadata:\n  version: 1.0.0\n  author: Alireza Rezvani\n  category: engineering\n  updated: 2026-03-15\n---\n\n# Helm Chart Builder\n\n> Production-grade Helm charts. Sensible defaults. Secure by design. No cargo-culting.\n\nOpinionated Helm workflow that turns ad-hoc Kubernetes manifests into maintainable, testable, reusable charts. Covers chart structure, values design, template patterns, dependency management, and security hardening.\n\nNot a Helm tutorial — a set of concrete decisions about how to build charts that operators trust and developers don't fight.\n\n---\n\n## Slash Commands\n\n| Command | What it does |\n|---------|-------------|\n| `\u002Fhelm:create` | Scaffold a production-ready Helm chart with best-practice structure |\n| `\u002Fhelm:review` | Analyze an existing chart for issues — missing labels, hardcoded values, template anti-patterns |\n| `\u002Fhelm:security` | Audit chart for security issues — RBAC, network policies, pod security, secrets handling |\n\n---\n\n## When This Skill Activates\n\nRecognize these patterns from the user:\n\n- \"Create a Helm chart for this service\"\n- \"Review my Helm chart\"\n- \"Is this chart secure?\"\n- \"Design a values.yaml\"\n- \"Add a subchart dependency\"\n- \"Set up helm tests\"\n- \"Helm best practices for [workload type]\"\n- Any request involving: Helm chart, values.yaml, Chart.yaml, templates, helpers, _helpers.tpl, subcharts, helm lint, helm test\n\nIf the user has a Helm chart or wants to package Kubernetes resources → this skill applies.\n\n---\n\n## Workflow\n\n### `\u002Fhelm:create` — Chart Scaffolding\n\n1. **Identify workload type**\n   - Web service (Deployment + Service + Ingress)\n   - Worker (Deployment, no Service)\n   - CronJob (CronJob + ServiceAccount)\n   - Stateful service (StatefulSet + PVC + Headless Service)\n   - Library chart (no templates, only helpers)\n\n2. **Scaffold chart structure**\n\n   ```\n   mychart\u002F\n   ├── Chart.yaml              # Chart metadata and dependencies\n   ├── values.yaml             # Default configuration\n   ├── values.schema.json      # Optional: JSON Schema for values validation\n   ├── .helmignore             # Files to exclude from packaging\n   ├── templates\u002F\n   │   ├── _helpers.tpl        # Named templates and helper functions\n   │   ├── deployment.yaml     # Workload resource\n   │   ├── service.yaml        # Service exposure\n   │   ├── ingress.yaml        # Ingress (if applicable)\n   │   ├── serviceaccount.yaml # ServiceAccount\n   │   ├── hpa.yaml            # HorizontalPodAutoscaler\n   │   ├── pdb.yaml            # PodDisruptionBudget\n   │   ├── networkpolicy.yaml  # NetworkPolicy\n   │   ├── configmap.yaml      # ConfigMap (if needed)\n   │   ├── secret.yaml         # Secret (if needed)\n   │   ├── NOTES.txt           # Post-install usage instructions\n   │   └── tests\u002F\n   │       └── test-connection.yaml\n   └── charts\u002F                 # Subcharts (dependencies)\n   ```\n\n3. **Apply Chart.yaml best practices**\n\n   ```\n   METADATA\n   ├── apiVersion: v2 (Helm 3 only — never v1)\n   ├── name: matches directory name exactly\n   ├── version: semver (chart version, not app version)\n   ├── appVersion: application version string\n   ├── description: one-line summary of what the chart deploys\n   └── type: application (or library for shared helpers)\n\n   DEPENDENCIES\n   ├── Pin dependency versions with ~X.Y.Z (patch-level float)\n   ├── Use condition field to make subcharts optional\n   ├── Use alias for multiple instances of same subchart\n   └── Run helm dependency update after changes\n   ```\n\n4. **Generate values.yaml with documentation**\n   - Every value has an inline comment explaining purpose and type\n   - Sensible defaults that work for development\n   - Override-friendly structure (flat where possible, nested only when logical)\n   - No hardcoded cluster-specific values (image registry, domain, storage class)\n\n5. **Validate**\n   ```bash\n   python3 scripts\u002Fchart_analyzer.py mychart\u002F\n   helm lint mychart\u002F\n   helm template mychart\u002F --debug\n   ```\n\n### `\u002Fhelm:review` — Chart Analysis\n\n1. **Check chart structure**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | Missing _helpers.tpl | High | Create helpers for common labels and selectors |\n   | No NOTES.txt | Medium | Add post-install instructions |\n   | No .helmignore | Low | Create one to exclude .git, CI files, tests |\n   | Missing Chart.yaml fields | Medium | Add description, appVersion, maintainers |\n   | Hardcoded values in templates | High | Extract to values.yaml with defaults |\n\n2. **Check template quality**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | Missing standard labels | High | Use `app.kubernetes.io\u002F*` labels via _helpers.tpl |\n   | No resource requests\u002Flimits | Critical | Add resources section with defaults in values.yaml |\n   | Hardcoded image tag | High | Use `{{ .Values.image.repository }}:{{ .Values.image.tag }}` |\n   | No imagePullPolicy | Medium | Default to `IfNotPresent`, overridable |\n   | Missing liveness\u002Freadiness probes | High | Add probes with configurable paths and ports |\n   | No pod anti-affinity | Medium | Add preferred anti-affinity for HA |\n   | Duplicate template code | Medium | Extract into named templates in _helpers.tpl |\n\n3. **Check values.yaml quality**\n   ```bash\n   python3 scripts\u002Fvalues_validator.py mychart\u002Fvalues.yaml\n   ```\n\n4. **Generate review report**\n   ```\n   HELM CHART REVIEW — [chart name]\n   Date: [timestamp]\n\n   CRITICAL: [count]\n   HIGH:     [count]\n   MEDIUM:   [count]\n   LOW:      [count]\n\n   [Detailed findings with fix recommendations]\n   ```\n\n### `\u002Fhelm:security` — Security Audit\n\n1. **Pod security audit**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | No securityContext | Critical | Add runAsNonRoot, readOnlyRootFilesystem |\n   | Running as root | Critical | Set `runAsNonRoot: true`, `runAsUser: 1000` |\n   | Writable root filesystem | High | Set `readOnlyRootFilesystem: true` + emptyDir for tmp |\n   | All capabilities retained | High | Drop ALL, add only specific needed caps |\n   | Privileged container | Critical | Set `privileged: false`, use specific capabilities |\n   | No seccomp profile | Medium | Set `seccompProfile.type: RuntimeDefault` |\n   | allowPrivilegeEscalation true | High | Set `allowPrivilegeEscalation: false` |\n\n2. **RBAC audit**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | No ServiceAccount | Medium | Create dedicated SA, don't use default |\n   | automountServiceAccountToken true | Medium | Set to false unless pod needs K8s API access |\n   | ClusterRole instead of Role | Medium | Use namespace-scoped Role unless cluster-wide needed |\n   | Wildcard permissions | Critical | Use specific resource names and verbs |\n   | No RBAC at all | Low | Acceptable if pod doesn't need K8s API access |\n\n3. **Network and secrets audit**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | No NetworkPolicy | Medium | Add default-deny ingress + explicit allow rules |\n   | Secrets in values.yaml | Critical | Use external secrets operator or sealed-secrets |\n   | No PodDisruptionBudget | Medium | Add PDB with minAvailable for HA workloads |\n   | hostNetwork: true | High | Remove unless absolutely required (e.g., CNI plugin) |\n   | hostPID or hostIPC | Critical | Never use in application charts |\n\n4. **Generate security report**\n   ```\n   SECURITY AUDIT — [chart name]\n   Date: [timestamp]\n\n   CRITICAL: [count]\n   HIGH:     [count]\n   MEDIUM:   [count]\n   LOW:      [count]\n\n   [Detailed findings with remediation steps]\n   ```\n\n---\n\n## Tooling\n\n### `scripts\u002Fchart_analyzer.py`\n\nCLI utility for static analysis of Helm chart directories.\n\n**Features:**\n- Chart structure validation (required files, directory layout)\n- Template anti-pattern detection (hardcoded values, missing labels, no resource limits)\n- Chart.yaml metadata checks\n- Standard labels verification (app.kubernetes.io\u002F*)\n- Security baseline checks\n- JSON and text output\n\n**Usage:**\n```bash\n# Analyze a chart directory\npython3 scripts\u002Fchart_analyzer.py mychart\u002F\n\n# JSON output\npython3 scripts\u002Fchart_analyzer.py mychart\u002F --output json\n\n# Security-focused analysis\npython3 scripts\u002Fchart_analyzer.py mychart\u002F --security\n```\n\n### `scripts\u002Fvalues_validator.py`\n\nCLI utility for validating values.yaml against best practices.\n\n**Features:**\n- Documentation coverage (inline comments)\n- Type consistency checks\n- Hardcoded secrets detection\n- Default value quality analysis\n- Structure depth analysis\n- Naming convention validation\n- JSON and text output\n\n**Usage:**\n```bash\n# Validate values.yaml\npython3 scripts\u002Fvalues_validator.py values.yaml\n\n# JSON output\npython3 scripts\u002Fvalues_validator.py values.yaml --output json\n\n# Strict mode (fail on warnings)\npython3 scripts\u002Fvalues_validator.py values.yaml --strict\n```\n\n---\n\n## Template Patterns\n\n### Pattern 1: Standard Labels (_helpers.tpl)\n\n```yaml\n{{\u002F*\nCommon labels for all resources.\n*\u002F}}\n{{- define \"mychart.labels\" -}}\nhelm.sh\u002Fchart: {{ include \"mychart.chart\" . }}\napp.kubernetes.io\u002Fname: {{ include \"mychart.name\" . }}\napp.kubernetes.io\u002Finstance: {{ .Release.Name }}\napp.kubernetes.io\u002Fversion: {{ .Chart.AppVersion | quote }}\napp.kubernetes.io\u002Fmanaged-by: {{ .Release.Service }}\n{{- end }}\n\n{{\u002F*\nSelector labels (subset of common labels — must be immutable).\n*\u002F}}\n{{- define \"mychart.selectorLabels\" -}}\napp.kubernetes.io\u002Fname: {{ include \"mychart.name\" . }}\napp.kubernetes.io\u002Finstance: {{ .Release.Name }}\n{{- end }}\n```\n\n### Pattern 2: Conditional Resources\n\n```yaml\n{{- if .Values.ingress.enabled -}}\napiVersion: networking.k8s.io\u002Fv1\nkind: Ingress\nmetadata:\n  name: {{ include \"mychart.fullname\" . }}\n  labels:\n    {{- include \"mychart.labels\" . | nindent 4 }}\n  {{- with .Values.ingress.annotations }}\n  annotations:\n    {{- toYaml . | nindent 4 }}\n  {{- end }}\nspec:\n  {{- if .Values.ingress.tls }}\n  tls:\n    {{- range .Values.ingress.tls }}\n    - hosts:\n        {{- range .hosts }}\n        - {{ . | quote }}\n        {{- end }}\n      secretName: {{ .secretName }}\n    {{- end }}\n  {{- end }}\n  rules:\n    {{- range .Values.ingress.hosts }}\n    - host: {{ .host | quote }}\n      http:\n        paths:\n          {{- range .paths }}\n          - path: {{ .path }}\n            pathType: {{ .pathType }}\n            backend:\n              service:\n                name: {{ include \"mychart.fullname\" $ }}\n                port:\n                  number: {{ $.Values.service.port }}\n          {{- end }}\n    {{- end }}\n{{- end }}\n```\n\n### Pattern 3: Security-Hardened Pod Spec\n\n```yaml\nspec:\n  serviceAccountName: {{ include \"mychart.serviceAccountName\" . }}\n  automountServiceAccountToken: false\n  securityContext:\n    runAsNonRoot: true\n    runAsUser: 1000\n    fsGroup: 1000\n    seccompProfile:\n      type: RuntimeDefault\n  containers:\n    - name: {{ .Chart.Name }}\n      securityContext:\n        allowPrivilegeEscalation: false\n        readOnlyRootFilesystem: true\n        capabilities:\n          drop:\n            - ALL\n      image: \"{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}\"\n      imagePullPolicy: {{ .Values.image.pullPolicy }}\n      resources:\n        {{- toYaml .Values.resources | nindent 8 }}\n      volumeMounts:\n        - name: tmp\n          mountPath: \u002Ftmp\n  volumes:\n    - name: tmp\n      emptyDir: {}\n```\n\n---\n\n## Values Design Principles\n\n```\nSTRUCTURE\n├── Flat over nested (image.tag > container.spec.image.tag)\n├── Group by resource (service.*, ingress.*, resources.*)\n├── Use enabled: true\u002Ffalse for optional resources\n├── Document every key with inline YAML comments\n└── Provide sensible development defaults\n\nNAMING\n├── camelCase for keys (replicaCount, not replica_count)\n├── Boolean keys: use adjectives (enabled, required) not verbs\n├── Nested keys: max 3 levels deep\n└── Match upstream conventions (image.repository, image.tag, image.pullPolicy)\n\nANTI-PATTERNS\n├── Hardcoded cluster URLs or domains\n├── Secrets as default values\n├── Empty strings where null is correct\n├── Deeply nested structures (>3 levels)\n├── Undocumented values\n└── values.yaml that doesn't work without overrides\n```\n\n---\n\n## Dependency Management\n\n```\nSUBCHARTS\n├── Use Chart.yaml dependencies (not requirements.yaml — Helm 3)\n├── Pin versions: version: ~15.x.x (patch float)\n├── Use condition: to make optional: condition: postgresql.enabled\n├── Use alias: for multiple instances of same chart\n├── Override subchart values under subchart name key in values.yaml\n└── Run helm dependency update before packaging\n\nLIBRARY CHARTS\n├── type: library in Chart.yaml — no templates directory\n├── Export named templates only — no rendered resources\n├── Use for shared labels, annotations, security contexts\n└── Version independently from application charts\n```\n\n---\n\n## Proactive Triggers\n\nFlag these without being asked:\n\n- **No _helpers.tpl** → Create one. Every chart needs standard labels and fullname helpers.\n- **Hardcoded image tag in template** → Extract to values.yaml. Tags must be overridable.\n- **No resource requests\u002Flimits** → Add them. Pods without limits can starve the node.\n- **Running as root** → Add securityContext. No exceptions for production charts.\n- **No NOTES.txt** → Create one. Users need post-install instructions.\n- **Secrets in values.yaml defaults** → Remove them. Use placeholders with comments explaining how to provide secrets.\n- **No liveness\u002Freadiness probes** → Add them. Kubernetes needs to know if the pod is healthy.\n- **Missing app.kubernetes.io labels** → Add via _helpers.tpl. Required for proper resource tracking.\n\n---\n\n## Installation\n\n### One-liner (any tool)\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002Falirezarezvani\u002Fclaude-skills.git\ncp -r claude-skills\u002Fengineering\u002Fhelm-chart-builder ~\u002F.claude\u002Fskills\u002F\n```\n\n### Multi-tool install\n```bash\n.\u002Fscripts\u002Fconvert.sh --skill helm-chart-builder --tool codex|gemini|cursor|windsurf|openclaw\n```\n\n### OpenClaw\n```bash\nclawhub install cs-helm-chart-builder\n```\n\n---\n\n## Related Skills\n\n- **senior-devops** — Broader DevOps scope (CI\u002FCD, IaC, monitoring). Complementary — use helm-chart-builder for chart-specific work, senior-devops for pipeline and infrastructure.\n- **docker-development** — Container building. Complementary — docker-development builds the images, helm-chart-builder deploys them to Kubernetes.\n- **ci-cd-pipeline-builder** — Pipeline construction. Complementary — helm-chart-builder defines the deployment artifact, ci-cd-pipeline-builder automates its delivery.\n- **senior-security** — Application security. Complementary — helm-chart-builder covers Kubernetes-level security (RBAC, pod security), senior-security covers application-level threats.\n","# Helm Chart Builder\n\n> Production-grade Helm charts. Sensible defaults. Secure by design. No cargo-culting.\n\nOpinionated Helm workflow that turns ad-hoc Kubernetes manifests into maintainable, testable, reusable charts. Covers chart structure, values design, template patterns, dependency management, and security hardening.\n\nNot a Helm tutorial — a set of concrete decisions about how to build charts that operators trust and developers don't fight.\n\n---\n\n## Slash Commands\n\n| Command | What it does |\n|---------|-------------|\n| `\u002Fhelm:create` | Scaffold a production-ready Helm chart with best-practice structure |\n| `\u002Fhelm:review` | Analyze an existing chart for issues — missing labels, hardcoded values, template anti-patterns |\n| `\u002Fhelm:security` | Audit chart for security issues — RBAC, network policies, pod security, secrets handling |\n\n---\n\n## When This Skill Activates\n\nRecognize these patterns from the user:\n\n- \"Create a Helm chart for this service\"\n- \"Review my Helm chart\"\n- \"Is this chart secure?\"\n- \"Design a values.yaml\"\n- \"Add a subchart dependency\"\n- \"Set up helm tests\"\n- \"Helm best practices for [workload type]\"\n- Any request involving: Helm chart, values.yaml, Chart.yaml, templates, helpers, _helpers.tpl, subcharts, helm lint, helm test\n\nIf the user has a Helm chart or wants to package Kubernetes resources → this skill applies.\n\n---\n\n## Workflow\n\n### `\u002Fhelm:create` — Chart Scaffolding\n\n1. **Identify workload type**\n   - Web service (Deployment + Service + Ingress)\n   - Worker (Deployment, no Service)\n   - CronJob (CronJob + ServiceAccount)\n   - Stateful service (StatefulSet + PVC + Headless Service)\n   - Library chart (no templates, only helpers)\n\n2. **Scaffold chart structure**\n\n   ```\n   mychart\u002F\n   ├── Chart.yaml              # Chart metadata and dependencies\n   ├── values.yaml             # Default configuration\n   ├── values.schema.json      # Optional: JSON Schema for values validation\n   ├── .helmignore             # Files to exclude from packaging\n   ├── templates\u002F\n   │   ├── _helpers.tpl        # Named templates and helper functions\n   │   ├── deployment.yaml     # Workload resource\n   │   ├── service.yaml        # Service exposure\n   │   ├── ingress.yaml        # Ingress (if applicable)\n   │   ├── serviceaccount.yaml # ServiceAccount\n   │   ├── hpa.yaml            # HorizontalPodAutoscaler\n   │   ├── pdb.yaml            # PodDisruptionBudget\n   │   ├── networkpolicy.yaml  # NetworkPolicy\n   │   ├── configmap.yaml      # ConfigMap (if needed)\n   │   ├── secret.yaml         # Secret (if needed)\n   │   ├── NOTES.txt           # Post-install usage instructions\n   │   └── tests\u002F\n   │       └── test-connection.yaml\n   └── charts\u002F                 # Subcharts (dependencies)\n   ```\n\n3. **Apply Chart.yaml best practices**\n\n   ```\n   METADATA\n   ├── apiVersion: v2 (Helm 3 only — never v1)\n   ├── name: matches directory name exactly\n   ├── version: semver (chart version, not app version)\n   ├── appVersion: application version string\n   ├── description: one-line summary of what the chart deploys\n   └── type: application (or library for shared helpers)\n\n   DEPENDENCIES\n   ├── Pin dependency versions with ~X.Y.Z (patch-level float)\n   ├── Use condition field to make subcharts optional\n   ├── Use alias for multiple instances of same subchart\n   └── Run helm dependency update after changes\n   ```\n\n4. **Generate values.yaml with documentation**\n   - Every value has an inline comment explaining purpose and type\n   - Sensible defaults that work for development\n   - Override-friendly structure (flat where possible, nested only when logical)\n   - No hardcoded cluster-specific values (image registry, domain, storage class)\n\n5. **Validate**\n   ```bash\n   python3 scripts\u002Fchart_analyzer.py mychart\u002F\n   helm lint mychart\u002F\n   helm template mychart\u002F --debug\n   ```\n\n### `\u002Fhelm:review` — Chart Analysis\n\n1. **Check chart structure**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | Missing _helpers.tpl | High | Create helpers for common labels and selectors |\n   | No NOTES.txt | Medium | Add post-install instructions |\n   | No .helmignore | Low | Create one to exclude .git, CI files, tests |\n   | Missing Chart.yaml fields | Medium | Add description, appVersion, maintainers |\n   | Hardcoded values in templates | High | Extract to values.yaml with defaults |\n\n2. **Check template quality**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | Missing standard labels | High | Use `app.kubernetes.io\u002F*` labels via _helpers.tpl |\n   | No resource requests\u002Flimits | Critical | Add resources section with defaults in values.yaml |\n   | Hardcoded image tag | High | Use `{{ .Values.image.repository }}:{{ .Values.image.tag }}` |\n   | No imagePullPolicy | Medium | Default to `IfNotPresent`, overridable |\n   | Missing liveness\u002Freadiness probes | High | Add probes with configurable paths and ports |\n   | No pod anti-affinity | Medium | Add preferred anti-affinity for HA |\n   | Duplicate template code | Medium | Extract into named templates in _helpers.tpl |\n\n3. **Check values.yaml quality**\n   ```bash\n   python3 scripts\u002Fvalues_validator.py mychart\u002Fvalues.yaml\n   ```\n\n4. **Generate review report**\n   ```\n   HELM CHART REVIEW — [chart name]\n   Date: [timestamp]\n\n   CRITICAL: [count]\n   HIGH:     [count]\n   MEDIUM:   [count]\n   LOW:      [count]\n\n   [Detailed findings with fix recommendations]\n   ```\n\n### `\u002Fhelm:security` — Security Audit\n\n1. **Pod security audit**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | No securityContext | Critical | Add runAsNonRoot, readOnlyRootFilesystem |\n   | Running as root | Critical | Set `runAsNonRoot: true`, `runAsUser: 1000` |\n   | Writable root filesystem | High | Set `readOnlyRootFilesystem: true` + emptyDir for tmp |\n   | All capabilities retained | High | Drop ALL, add only specific needed caps |\n   | Privileged container | Critical | Set `privileged: false`, use specific capabilities |\n   | No seccomp profile | Medium | Set `seccompProfile.type: RuntimeDefault` |\n   | allowPrivilegeEscalation true | High | Set `allowPrivilegeEscalation: false` |\n\n2. **RBAC audit**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | No ServiceAccount | Medium | Create dedicated SA, don't use default |\n   | automountServiceAccountToken true | Medium | Set to false unless pod needs K8s API access |\n   | ClusterRole instead of Role | Medium | Use namespace-scoped Role unless cluster-wide needed |\n   | Wildcard permissions | Critical | Use specific resource names and verbs |\n   | No RBAC at all | Low | Acceptable if pod doesn't need K8s API access |\n\n3. **Network and secrets audit**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | No NetworkPolicy | Medium | Add default-deny ingress + explicit allow rules |\n   | Secrets in values.yaml | Critical | Use external secrets operator or sealed-secrets |\n   | No PodDisruptionBudget | Medium | Add PDB with minAvailable for HA workloads |\n   | hostNetwork: true | High | Remove unless absolutely required (e.g., CNI plugin) |\n   | hostPID or hostIPC | Critical | Never use in application charts |\n\n4. **Generate security report**\n   ```\n   SECURITY AUDIT — [chart name]\n   Date: [timestamp]\n\n   CRITICAL: [count]\n   HIGH:     [count]\n   MEDIUM:   [count]\n   LOW:      [count]\n\n   [Detailed findings with remediation steps]\n   ```\n\n---\n\n## Tooling\n\n### `scripts\u002Fchart_analyzer.py`\n\nCLI utility for static analysis of Helm chart directories.\n\n**Features:**\n- Chart structure validation (required files, directory layout)\n- Template anti-pattern detection (hardcoded values, missing labels, no resource limits)\n- Chart.yaml metadata checks\n- Standard labels verification (app.kubernetes.io\u002F*)\n- Security baseline checks\n- JSON and text output\n\n**Usage:**\n```bash\n# Analyze a chart directory\npython3 scripts\u002Fchart_analyzer.py mychart\u002F\n\n# JSON output\npython3 scripts\u002Fchart_analyzer.py mychart\u002F --output json\n\n# Security-focused analysis\npython3 scripts\u002Fchart_analyzer.py mychart\u002F --security\n```\n\n### `scripts\u002Fvalues_validator.py`\n\nCLI utility for validating values.yaml against best practices.\n\n**Features:**\n- Documentation coverage (inline comments)\n- Type consistency checks\n- Hardcoded secrets detection\n- Default value quality analysis\n- Structure depth analysis\n- Naming convention validation\n- JSON and text output\n\n**Usage:**\n```bash\n# Validate values.yaml\npython3 scripts\u002Fvalues_validator.py values.yaml\n\n# JSON output\npython3 scripts\u002Fvalues_validator.py values.yaml --output json\n\n# Strict mode (fail on warnings)\npython3 scripts\u002Fvalues_validator.py values.yaml --strict\n```\n\n---\n\n## Template Patterns\n\n### Pattern 1: Standard Labels (_helpers.tpl)\n\n```yaml\n{{\u002F*\nCommon labels for all resources.\n*\u002F}}\n{{- define \"mychart.labels\" -}}\nhelm.sh\u002Fchart: {{ include \"mychart.chart\" . }}\napp.kubernetes.io\u002Fname: {{ include \"mychart.name\" . }}\napp.kubernetes.io\u002Finstance: {{ .Release.Name }}\napp.kubernetes.io\u002Fversion: {{ .Chart.AppVersion | quote }}\napp.kubernetes.io\u002Fmanaged-by: {{ .Release.Service }}\n{{- end }}\n\n{{\u002F*\nSelector labels (subset of common labels — must be immutable).\n*\u002F}}\n{{- define \"mychart.selectorLabels\" -}}\napp.kubernetes.io\u002Fname: {{ include \"mychart.name\" . }}\napp.kubernetes.io\u002Finstance: {{ .Release.Name }}\n{{- end }}\n```\n\n### Pattern 2: Conditional Resources\n\n```yaml\n{{- if .Values.ingress.enabled -}}\napiVersion: networking.k8s.io\u002Fv1\nkind: Ingress\nmetadata:\n  name: {{ include \"mychart.fullname\" . }}\n  labels:\n    {{- include \"mychart.labels\" . | nindent 4 }}\n  {{- with .Values.ingress.annotations }}\n  annotations:\n    {{- toYaml . | nindent 4 }}\n  {{- end }}\nspec:\n  {{- if .Values.ingress.tls }}\n  tls:\n    {{- range .Values.ingress.tls }}\n    - hosts:\n        {{- range .hosts }}\n        - {{ . | quote }}\n        {{- end }}\n      secretName: {{ .secretName }}\n    {{- end }}\n  {{- end }}\n  rules:\n    {{- range .Values.ingress.hosts }}\n    - host: {{ .host | quote }}\n      http:\n        paths:\n          {{- range .paths }}\n          - path: {{ .path }}\n            pathType: {{ .pathType }}\n            backend:\n              service:\n                name: {{ include \"mychart.fullname\" $ }}\n                port:\n                  number: {{ $.Values.service.port }}\n          {{- end }}\n    {{- end }}\n{{- end }}\n```\n\n### Pattern 3: Security-Hardened Pod Spec\n\n```yaml\nspec:\n  serviceAccountName: {{ include \"mychart.serviceAccountName\" . }}\n  automountServiceAccountToken: false\n  securityContext:\n    runAsNonRoot: true\n    runAsUser: 1000\n    fsGroup: 1000\n    seccompProfile:\n      type: RuntimeDefault\n  containers:\n    - name: {{ .Chart.Name }}\n      securityContext:\n        allowPrivilegeEscalation: false\n        readOnlyRootFilesystem: true\n        capabilities:\n          drop:\n            - ALL\n      image: \"{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}\"\n      imagePullPolicy: {{ .Values.image.pullPolicy }}\n      resources:\n        {{- toYaml .Values.resources | nindent 8 }}\n      volumeMounts:\n        - name: tmp\n          mountPath: \u002Ftmp\n  volumes:\n    - name: tmp\n      emptyDir: {}\n```\n\n---\n\n## Values Design Principles\n\n```\nSTRUCTURE\n├── Flat over nested (image.tag > container.spec.image.tag)\n├── Group by resource (service.*, ingress.*, resources.*)\n├── Use enabled: true\u002Ffalse for optional resources\n├── Document every key with inline YAML comments\n└── Provide sensible development defaults\n\nNAMING\n├── camelCase for keys (replicaCount, not replica_count)\n├── Boolean keys: use adjectives (enabled, required) not verbs\n├── Nested keys: max 3 levels deep\n└── Match upstream conventions (image.repository, image.tag, image.pullPolicy)\n\nANTI-PATTERNS\n├── Hardcoded cluster URLs or domains\n├── Secrets as default values\n├── Empty strings where null is correct\n├── Deeply nested structures (>3 levels)\n├── Undocumented values\n└── values.yaml that doesn't work without overrides\n```\n\n---\n\n## Dependency Management\n\n```\nSUBCHARTS\n├── Use Chart.yaml dependencies (not requirements.yaml — Helm 3)\n├── Pin versions: version: ~15.x.x (patch float)\n├── Use condition: to make optional: condition: postgresql.enabled\n├── Use alias: for multiple instances of same chart\n├── Override subchart values under subchart name key in values.yaml\n└── Run helm dependency update before packaging\n\nLIBRARY CHARTS\n├── type: library in Chart.yaml — no templates directory\n├── Export named templates only — no rendered resources\n├── Use for shared labels, annotations, security contexts\n└── Version independently from application charts\n```\n\n---\n\n## Proactive Triggers\n\nFlag these without being asked:\n\n- **No _helpers.tpl** → Create one. Every chart needs standard labels and fullname helpers.\n- **Hardcoded image tag in template** → Extract to values.yaml. Tags must be overridable.\n- **No resource requests\u002Flimits** → Add them. Pods without limits can starve the node.\n- **Running as root** → Add securityContext. No exceptions for production charts.\n- **No NOTES.txt** → Create one. Users need post-install instructions.\n- **Secrets in values.yaml defaults** → Remove them. Use placeholders with comments explaining how to provide secrets.\n- **No liveness\u002Freadiness probes** → Add them. Kubernetes needs to know if the pod is healthy.\n- **Missing app.kubernetes.io labels** → Add via _helpers.tpl. Required for proper resource tracking.\n\n---\n\n## Installation\n\n### One-liner (any tool)\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002Falirezarezvani\u002Fclaude-skills.git\ncp -r claude-skills\u002Fengineering\u002Fhelm-chart-builder ~\u002F.claude\u002Fskills\u002F\n```\n\n### Multi-tool install\n```bash\n.\u002Fscripts\u002Fconvert.sh --skill helm-chart-builder --tool codex|gemini|cursor|windsurf|openclaw\n```\n\n### OpenClaw\n```bash\nclawhub install cs-helm-chart-builder\n```\n\n---\n\n## Related Skills\n\n- **senior-devops** — Broader DevOps scope (CI\u002FCD, IaC, monitoring). Complementary — use helm-chart-builder for chart-specific work, senior-devops for pipeline and infrastructure.\n- **docker-development** — Container building. Complementary — docker-development builds the images, helm-chart-builder deploys them to Kubernetes.\n- **ci-cd-pipeline-builder** — Pipeline construction. Complementary — helm-chart-builder defines the deployment artifact, ci-cd-pipeline-builder automates its delivery.\n- **senior-security** — Application security. Complementary — helm-chart-builder covers Kubernetes-level security (RBAC, pod security), senior-security covers application-level threats.\n",{"name":5,"license":15,"metadata":63,"description":7},{"author":64,"updated":65,"version":66,"category":67},"Alireza Rezvani",1773532800000,"1.0.0","engineering","main","cfe69e68b9b427ce0b098a2306c9898096ef0ac2","claude-skills\u002Fengineering\u002Fhelm-chart-builder","https:\u002F\u002Fgithub.com\u002FBoboegg\u002Fai-resources","https:\u002F\u002Fgithub.com\u002FBoboegg","National Chung Cheng University Student","2026-04-03 12:18:40",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add Boboegg\u002Fai-resources --skill helm-chart-builder",{"tool":81,"command":82},"bunx","bunx skills add Boboegg\u002Fai-resources --skill helm-chart-builder",{"tool":84,"command":85},"pnpm","pnpm dlx skills add Boboegg\u002Fai-resources --skill helm-chart-builder","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FBoboegg\u002Fai-resources\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fengineering\u002Fhelm-chart-builder\u002FSKILL.md",true,[89,95,99,103,109],{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},".claude-plugin\u002Fplugin.json","REFERENCE","参考文档",598,"https:\u002F\u002Fgithub.com\u002FBoboegg\u002Fai-resources\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fengineering\u002Fhelm-chart-builder\u002F.claude-plugin\u002Fplugin.json",{"path":96,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":97,"sourceHtmlUrl":98},"references\u002Fchart-patterns.md",11818,"https:\u002F\u002Fgithub.com\u002FBoboegg\u002Fai-resources\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fengineering\u002Fhelm-chart-builder\u002Freferences\u002Fchart-patterns.md",{"path":100,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fvalues-design.md",9736,"https:\u002F\u002Fgithub.com\u002FBoboegg\u002Fai-resources\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fengineering\u002Fhelm-chart-builder\u002Freferences\u002Fvalues-design.md",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"scripts\u002Fchart_analyzer.py","SCRIPT","脚本",20022,"https:\u002F\u002Fgithub.com\u002FBoboegg\u002Fai-resources\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fengineering\u002Fhelm-chart-builder\u002Fscripts\u002Fchart_analyzer.py",{"path":110,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":111,"sourceHtmlUrl":112},"scripts\u002Fvalues_validator.py",14524,"https:\u002F\u002Fgithub.com\u002FBoboegg\u002Fai-resources\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fengineering\u002Fhelm-chart-builder\u002Fscripts\u002Fvalues_validator.py",[114,142,168,188,211,244],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":123,"publishedAt":58},"01M6KQBV2F4EG8YV2KET152Y5C","ra-qm-skills","12 regulatory & QM agent skills and plugins for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw. ISO 13485 QMS, MDR 2017\u002F745, FDA 510(k)\u002FPMA, ISO 27001 ISMS, GDPR\u002FDSGVO, risk management (ISO 14971), CAPA, document control, auditing. Python tools (stdlib-only).","https:\u002F\u002Fgithub.com\u002FBoboegg\u002Fai-resources\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fra-qm-team\u002FSKILL.md",[120],{"categoryNo":121,"categoryName":122,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000030","开发工程师",[124,125,56,126,127,128,54,129,130,131,132,133,134,135,136,137,138,139,140,141],"ra qm skills","qm","gemini","python","codex","gdpr","risk","quality","cursor","regulatory","only","document","control","iso","iso 14971","ISO 13485","codex-cli","for",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":148,"publishedAt":58},"01M6KQB7AQ2V5E25R7MNWW8QEW","scrum-master","Advanced Scrum Master skill for data-driven agile team analysis and coaching. Use when the user asks about sprint planning, velocity tracking, retrospectives, standup facilitation, backlog grooming, story points, burndown charts, blocker resolution, or agile team health. Runs Python scripts to analyse sprint JSON exports from Jira or similar tools: velocity_analyzer.py for Monte Carlo sprint forecasting, sprint_health_scorer.py for multi-dimension health scoring, and retrospective_analyzer.py for action-item and theme tracking. Produces confidence-interval forecasts, health grade reports, and improvement-velocity trends for high-performing Scrum teams.","https:\u002F\u002Fgithub.com\u002FBoboegg\u002Fai-resources\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fproject-management\u002Fscrum-master\u002FSKILL.md",[],[149,150,151,152,153,154,155,52,156,157,158,159,160,161,162,163,164,165,166,167],"Scrum Master","scrum","master","jira","agile","data","analysis","team","project-management","reports","scoring","velocity","project","data-analysis","scripts","sprint","advanced","action","data-driven",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":176,"publishedAt":58},"01M6KQA3FMM7WRABSEDFVTFV1G","pm-skills","6 project management agent skills and plugins for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw. Senior PM, scrum master, Jira expert (JQL), Confluence expert, Atlassian admin, template creator. MCP integration for live Jira\u002FConfluence automation.","https:\u002F\u002Fgithub.com\u002FBoboegg\u002Fai-resources\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fproject-management\u002FSKILL.md",[174,175],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":121,"categoryName":122,"taxonomyType":32,"taxonomyTypeDesc":33},[177,178,179,180,56,181,182,152,54,153,183,43,157,184,150,151,185,161,186,187],"pm skills","pm","MCP","openclaw","gemini cli","template creator","project management","atlassian","expert","live","jql",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":198,"publishedAt":58},"01M6KQ95X5FVDMW0CS2CDC9Y8S","research-summarizer","Structured research summarization agent skill for non-dev users. Handles academic papers, web articles, reports, and documentation. Extracts key findings, generates comparative analyses, and produces properly formatted citations. Use when: user wants to summarize a research paper, compare multiple sources, extract citations from documents, or create structured research briefs. Plugin for Claude Code, Codex, Gemini CLI, and OpenClaw.","https:\u002F\u002Fgithub.com\u002FBoboegg\u002Fai-resources\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fproduct-team\u002Fresearch-summarizer\u002FSKILL.md",[194,197],{"categoryNo":195,"categoryName":196,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[199,200,201,180,56,126,181,202,203,55,54,204,205,206,158,207,208,209,210,141],"research","research summarizer","summarizer","documentation","documents","dev","product","Citations","agent skill","sources","papers","briefs",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":215,"categories":216,"keywords":227,"publishedAt":58},"01M6KQ7P10V92ZA3WAP0KMG5ZW","code-to-prd","Reverse-engineer any codebase into a complete Product Requirements Document (PRD).\nAnalyzes routes, components, state management, API integrations, and user interactions to produce\nbusiness-readable documentation detailed enough for engineers or AI agents to fully reconstruct\nevery page and endpoint. Works with frontend frameworks (React, Vue, Angular, Svelte, Next.js, Nuxt),\nbackend frameworks (NestJS, Django, Express, FastAPI), and fullstack applications.\n\nTrigger when users mention: generate PRD, reverse-engineer requirements, code to documentation,\nextract product specs from code, document page logic, analyze page fields and interactions,\ncreate a functional inventory, write requirements from an existing codebase, document API endpoints,\nor analyze backend routes.","https:\u002F\u002Fgithub.com\u002FBoboegg\u002Fai-resources\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fproduct-team\u002Fcode-to-prd\u002FSKILL.md",[217,220,223,224],{"categoryNo":218,"categoryName":219,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":221,"categoryName":222,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":121,"categoryName":122,"taxonomyType":32,"taxonomyTypeDesc":33},{"categoryNo":225,"categoryName":226,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000031","产品经理",[228,54,229,230,231,232,233,55,234,235,236,237,238,239,135,240,241,242,141,243],"to prd","prd","code to prd","frontend","components","react","generate","vue","applications","analyze","write","engineer","frameworks","express","functional","Existing",{"skillNo":245,"name":246,"nameZh":6,"description":247,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":248,"categories":249,"keywords":253,"publishedAt":58},"01M6KQ7A5WBZMQAM7Z37F77B4X","product-skills","10 product agent skills and plugins for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw. PM toolkit (RICE), agile PO, product strategist (OKR), UX researcher, UI design system, competitive teardown, landing page generator, SaaS scaffolder, research summarizer. Python tools (stdlib-only).","https:\u002F\u002Fgithub.com\u002FBoboegg\u002Fai-resources\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fproduct-team\u002FSKILL.md",[250,251,252],{"categoryNo":121,"categoryName":122,"taxonomyType":32,"taxonomyTypeDesc":33},{"categoryNo":225,"categoryName":226,"taxonomyType":32,"taxonomyTypeDesc":33},{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},[205,254,57,180,56,181,255,54,153,256,257,258,259,200,260,134,178,261,201,262],"product skills","design system","ux","ui","product strategist","Tools","rice","teardown","competitive"]