gitops-manifest-validator

Analyzes Kubernetes manifests for security posture, threat modeling, and attack path identification. Use when reviewing manifests for security risks beyond simple lint checks. This skill identifies compound vulnerabilities where multiple misconfigurations create exploitable attack chains: privilege escalation paths, defense-in-depth violations, lateral movement vectors, secret exposure, and blast radius analysis. Applies NSA/CISA hardening guidance, MITRE ATT&CK for Containers, CIS Kubernetes Benchmark, and Pod Security Standards.

Runs comprehensive Kubernetes manifest linting with kube-linter, kubeconform, and pluto. This skill should be used when the user wants to validate K8s manifests. Validations can include best practices, schema correctness, deprecated APIs, and security issues. Aggregates results from multiple linters into a unified, filterable output format. Use for pre-commit validation, CI/CD integration, or comprehensive manifest audits.

Use when validating Kubernetes manifests against compliance frameworks (CIS Kubernetes Benchmark, Pod Security Standards, PCI-DSS, HIPAA, SOC2, NIST). Use when generating compliance reports, audit evidence, or mapping controls to regulatory requirements. Use when preparing for audits, assessing compliance gaps, or explaining why specific security controls are required by regulation. Use when determining Pod Security Standards levels (Restricted/Baseline/Privileged).

Use when reviewing Kubernetes manifests for resource cost implications, overprovisioning waste, reliability gaps (single replica, no PDB, missing anti-affinity), or cost-vs-reliability tradeoff decisions. Use when someone asks "how much does this cost?" or "is this production-ready?"

Use when reviewing, creating, or modifying Kubernetes manifests that contain multiple resources. Use when Services, Deployments, ConfigMaps, Secrets, RBAC resources, Ingress, Routes, or NetworkPolicies appear together. Use when manifests reference other resources by name, label selector, or service account. Use when debugging why pods aren't receiving traffic, why containers fail to start, or why RBAC permissions aren't working.

Use when reviewing Kubernetes manifests to validate design intent and architectural decisions. Use when manifests contain unexplained port exposure, single-replica production deployments, multi-container Pods, unusual update strategies, or any configuration where the WHY behind a decision is unclear. Use when creating new manifests to ensure the author has thought through architectural tradeoffs. Use when multi-container Pods need pattern classification (sidecar, init, ambassador, adapter). Use when manifests show signs of anti-patterns like stateful Deployments, sidecar sprawl, or distributed monoliths.