| name | kubernetes-helm-review |
| description | Use when reviewing Helm chart structure, values, templates, and best practices. Only triggers when Chart.yaml is detected. |
Kubernetes Helm Review
Overview
Reviews Helm chart structure and best practices. Covers chart metadata, values defaults, template patterns, dependency management, hooks, and tests. Complements the K8s security/cost/operational skills by focusing on Helm-specific concerns like template hygiene and chart packaging.
Only triggers when Chart.yaml is detected. Does not trigger for raw K8s manifests — use the core K8s skills for those.
When to Use
- When reviewing a Helm chart for structural best practices
- When auditing
values.yaml defaults and documentation
- When checking template helpers and naming conventions
- When reviewing Helm hooks, tests, and dependency management
When NOT to Use
- For raw K8s manifest review — use core K8s skills (security-audit, cost-review, operational-review)
- For Kustomize overlays — use
kubernetes-kustomize-review
- When no
Chart.yaml is found
- For Helm chart deployment/release issues — this is static chart review only
Workflow
- Detect Helm chart: Confirm
Chart.yaml exists at the target path. If not found, do not proceed.
- Chart metadata: Review
Chart.yaml for completeness, version constraints, maintainer info.
- Values review: Check
values.yaml for sensible defaults, documentation, no hardcoded secrets.
- Template review: Check templates for helper usage, consistent labeling, resource naming patterns.
- NOTES.txt: Verify post-install instructions exist and are useful.
- Hooks review: Check hook annotations for proper weight ordering and cleanup policy.
- Tests review: Verify test templates exist (e.g.,
test-connection.yaml).
- Dependencies: Check
Chart.lock committed, version ranges appropriate, subchart value passthrough.
- Deprecation flag: If deprecated K8s API versions are found in templates, flag them and recommend
deprecation-check-and-upgrade.
- Produce report: Present findings with check pass/fail status.
See check-tables.md for detailed check definitions.
Critical Checks
Chart.yaml missing appVersion or version- Hardcoded secrets or passwords in
values.yaml
- Templates not using
_helpers.tpl for common labels and names
- Missing
NOTES.txt (users get no post-install guidance)
- Subchart dependencies without version pinning
- Missing
Chart.lock (dependency versions not reproducible)
Common Mistakes
| Mistake | Why It Happens | Correct Approach |
|---|
| Flagging missing tests on library charts | Library charts have no installable templates | Tests only apply to application charts (type: application) |
| Requiring NOTES.txt on subcharts | Subcharts don't display NOTES independently | NOTES.txt is for the parent chart only |
Flagging {{ .Release.Namespace }} usage | Some see this as hardcoding namespace | This is correct — it uses the release namespace dynamically |
Treating all default values as problems | default template function is normal Helm pattern | Only flag default when it masks missing required values |
| Requiring version pinning to patch level | Overly strict pinning blocks security patches | Minor version pinning (~1.2.0) is appropriate for most deps |
Supporting Files
check-tables.md — Chart structure and template checks with pass/fail criteria
