tomevault-io Kubernetes Helm Review
Overview
Reviews Helm chart structure and best practices. Covers chart metadata, values defaults, template patterns, dependency management, hooks, and tests. Complements the K8s security/cost/operational skills by focusing on Helm-specific concerns like template hygiene and chart packaging.
Only triggers when Chart.yaml is detected. Does not trigger for raw K8s manifests — use the core K8s skills for those.
When to Use
- When reviewing a Helm chart for structural best practices
- When auditing
values.yamldefaults and documentation - When checking template helpers and naming conventions
- When reviewing Helm hooks, tests, and dependency management
When NOT to Use
- For raw K8s manifest review — use core K8s skills (security-audit, cost-review, operational-review)
- For Kustomize overlays — use
kubernetes-kustomize-review - When no
Chart.yamlis found - For Helm chart deployment/release issues — this is static chart review only
Workflow
- Detect Helm chart: Confirm
Chart.yamlexists at the target path. If not found, do not proceed. - Chart metadata: Review
Chart.yamlfor completeness, version constraints, maintainer info. - Values review: Check
values.yamlfor sensible defaults, documentation, no hardcoded secrets. - Template review: Check templates for helper usage, consistent labeling, resource naming patterns.
- NOTES.txt: Verify post-install instructions exist and are useful.
- Hooks review: Check hook annotations for proper weight ordering and cleanup policy.
- Tests review: Verify test templates exist (e.g.,
test-connection.yaml). - Dependencies: Check
Chart.lockcommitted, version ranges appropriate, subchart value passthrough. - Deprecation flag: If deprecated K8s API versions are found in templates, flag them and recommend
deprecation-check-and-upgrade. - Produce report: Present findings with check pass/fail status.
See check-tables.md for detailed check definitions.
Critical Checks
Chart.yamlmissingappVersionorversion- Hardcoded secrets or passwords in
values.yaml - Templates not using
_helpers.tplfor common labels and names - Missing
NOTES.txt(users get no post-install guidance) - Subchart dependencies without version pinning
- Missing
Chart.lock(dependency versions not reproducible)
Common Mistakes
| Mistake | Why It Happens | Correct Approach |
|---|---|---|
| Flagging missing tests on library charts | Library charts have no installable templates | Tests only apply to application charts (type: application) |
| Requiring NOTES.txt on subcharts | Subcharts don't display NOTES independently | NOTES.txt is for the parent chart only |
Flagging {{ .Release.Namespace }} usage |
Some see this as hardcoding namespace | This is correct — it uses the release namespace dynamically |
Treating all default values as problems |
default template function is normal Helm pattern |
Only flag default when it masks missing required values |
| Requiring version pinning to patch level | Overly strict pinning blocks security patches | Minor version pinning (~1.2.0) is appropriate for most deps |
Supporting Files
check-tables.md— Chart structure and template checks with pass/fail criteria
Source: infraspecdev/tesseract — distributed by TomeVault.