# Kubernetes Helm Review > Use when reviewing Helm chart structure, values, templates, and best practices. Only triggers when Chart.yaml is detected. - Skill: `tomevault-io/kubernetes-helm-review` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/kubernetes-helm-review` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/kubernetes-helm-review/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/kubernetes-helm-review --- # Kubernetes Helm Review ## Overview Reviews Helm chart structure and best practices. Covers chart metadata, values defaults, template patterns, dependency management, hooks, and tests. Complements the K8s security/cost/operational skills by focusing on Helm-specific concerns like template hygiene and chart packaging. Only triggers when `Chart.yaml` is detected. Does not trigger for raw K8s manifests — use the core K8s skills for those. ## When to Use - When reviewing a Helm chart for structural best practices - When auditing `values.yaml` defaults and documentation - When checking template helpers and naming conventions - When reviewing Helm hooks, tests, and dependency management ## When NOT to Use - For raw K8s manifest review — use core K8s skills (security-audit, cost-review, operational-review) - For Kustomize overlays — use `kubernetes-kustomize-review` - When no `Chart.yaml` is found - For Helm chart deployment/release issues — this is static chart review only ## Workflow 1. **Detect Helm chart**: Confirm `Chart.yaml` exists at the target path. If not found, do not proceed. 2. **Chart metadata**: Review `Chart.yaml` for completeness, version constraints, maintainer info. 3. **Values review**: Check `values.yaml` for sensible defaults, documentation, no hardcoded secrets. 4. **Template review**: Check templates for helper usage, consistent labeling, resource naming patterns. 5. **NOTES.txt**: Verify post-install instructions exist and are useful. 6. **Hooks review**: Check hook annotations for proper weight ordering and cleanup policy. 7. **Tests review**: Verify test templates exist (e.g., `test-connection.yaml`). 8. **Dependencies**: Check `Chart.lock` committed, version ranges appropriate, subchart value passthrough. 9. **Deprecation flag**: If deprecated K8s API versions are found in templates, flag them and recommend `deprecation-check-and-upgrade`. 10. **Produce report**: Present findings with check pass/fail status. See `check-tables.md` for detailed check definitions. ## Critical Checks - `Chart.yaml` missing `appVersion` or `version` - Hardcoded secrets or passwords in `values.yaml` - Templates not using `_helpers.tpl` for common labels and names - Missing `NOTES.txt` (users get no post-install guidance) - Subchart dependencies without version pinning - Missing `Chart.lock` (dependency versions not reproducible) ## Common Mistakes | Mistake | Why It Happens | Correct Approach | |---------|---------------|-----------------| | Flagging missing tests on library charts | Library charts have no installable templates | Tests only apply to application charts (`type: application`) | | Requiring NOTES.txt on subcharts | Subcharts don't display NOTES independently | NOTES.txt is for the parent chart only | | Flagging `{{ .Release.Namespace }}` usage | Some see this as hardcoding namespace | This is correct — it uses the release namespace dynamically | | Treating all `default` values as problems | `default` template function is normal Helm pattern | Only flag `default` when it masks missing required values | | Requiring version pinning to patch level | Overly strict pinning blocks security patches | Minor version pinning (`~1.2.0`) is appropriate for most deps | ## Supporting Files - `check-tables.md` — Chart structure and template checks with pass/fail criteria --- > Source: [infraspecdev/tesseract](https://github.com/infraspecdev/tesseract) — distributed by [TomeVault](https://tomevault.io).