iac-gitops-reviewer

name	iac-gitops-reviewer
description	Review Terraform, Kubernetes, Helm, Kustomize, GitOps reconciliation, promotion, and environment safety.
version	1.0.0
since	2026-07-28
last_modified	2026-07-28
authors	["platform-engineering"]
stability	stable
min_platform_version	{"codex":"unknown","amazon-q":"unknown","antigravity":"unknown","auggie":"unknown","bob":"unknown","claude-code":"unknown","cline":"unknown","codebuddy":"unknown","continue":"unknown","costrict":"unknown","crush":"unknown","github-copilot":"unknown","gitlab-duo":"unknown","factory":"unknown","forgecode":"unknown","opencode":"unknown","openhands":"unknown","cursor":"unknown","roo-code":"unknown","kiro":"unknown","junie":"unknown","gemini-cli":"unknown","iflow":"unknown","kilocode":"unknown","kimi":"unknown","lingma":"unknown","pi":"unknown","qoder":"unknown","qwen":"unknown","windsurf":"unknown","ollama":"unknown"}
deprecated_since	null
replaces	null
supersedes	[]
changelog	[{"version":"1.0.0","date":"2026-07-28","change":"Initial generated production-ready SDLC / DevSecOps skill"}]

Iac Gitops Reviewer

Purpose

Review Terraform, Kubernetes, Helm, Kustomize, GitOps, policies, cloud IAM, network exposure, drift, secrets, state, promotion, rollback, and environment safety.

When to use

• Infrastructure, Kubernetes, Helm, Terraform, GitOps, IAM, networking, or policy files change.
• A change affects production environments, cluster policy, secrets, state, or promotion flow.
• Drift, rollback, plan/apply safety, or GitOps reconciliation behavior is unclear.
• Cloud permissions, public exposure, or workload security needs review.
• The central agent routes to IaC/GitOps review.

Operating model

1. Map resources, environments, state backends, namespaces, IAM roles, networks, and reconciliation controllers.
2. Review plan/apply or diff semantics, not only YAML shape.
3. Assess least privilege, network exposure, secret references, and workload security context.
4. Check promotion, drift, rollback, and blast radius across environments.
5. Recommend minimal policy or manifest changes with validation commands.

Spec-Driven Change Context

• Treat repository specs, ADRs, runbooks, change proposals, design notes, and task files as durable context that outlives a chat session.
• For non-trivial changes, prefer a checked-in change artifact or equivalent proposal/design/tasks record before implementation begins.
• Capture requirement deltas explicitly: added, modified, removed, deprecated, or unchanged behavior.
• Keep implementation tasks traceable to acceptance criteria, affected specs, validation commands, and owners.
• During verification, compare the implementation against the proposal, design decisions, task checklist, and spec deltas.
• After completion, sync or archive completed change artifacts so the repository's source of truth reflects the final behavior.
• If the repository has no spec workflow yet, report the missing artifact and provide a minimal proposal/spec/tasks outline instead of relying on chat-only intent.

Skill-Specific Review Scope

• Terraform/OpenTofu, Kubernetes, Helm, Kustomize, Argo CD, Flux, and policy-as-code.
• IAM, RBAC, service accounts, network rules, ingress, egress, storage, and secrets.
• State backend, drift detection, plan/apply safety, promotion, and rollback.
• Workload security context, resource limits, probes, disruption budgets, and scheduling.
• Environment overlays and generated manifests.

Skill-Specific Checklist

• Check Terraform plan or manifest diff for created, changed, replaced, or destroyed resources.