kubernetes-namespace-audit

name	kubernetes-namespace-audit
description	Audits all cluster namespaces against tenant naming conventions defined in decisions/tenant-naming-conventions.md. Checks label compliance, missing resource quotas, and naming pattern violations. Use when: naming convention question, pre-release namespace review, SOC Type 2 audit, or periodic drift check.
license	MIT
compatibility	opencode
metadata	{"owner":"kubernetes-admin","type":"read-only","approval":"No"}

kubernetes-namespace-audit

Owner: kubernetes-admin Type: read-only Approval: No

---

What I Do

Connects to the live cluster, lists all namespaces, and validates each one against the naming and labelling conventions defined in decisions/tenant-naming-conventions.md.

Checks per namespace:

• Name matches expected pattern {tenant-id}-{env}
• Required labels present: tenant, env, tier, managed-by
• ResourceQuota defined
• LimitRange defined
• At least one NetworkPolicy defined

---

When to Use Me

• User requests: "audit namespaces", "check naming", "namespace compliance"
• Naming convention drift suspected after cluster changes
• Pre-release or SOC Type 2 review
• New tenant added — verify provisioning was correct

---

Context Requirements

Requires already loaded:
  .crux/workspace/kubernetes-admin/MEMORY.md
    Fields needed:
      namespace-pattern
      environments
      multi-tenant (true | false)

  .crux/decisions/tenant-naming-conventions.md
    Load-when: this skill runs — normative source for naming rules

Estimated token cost: ~450 tokens (skill) + ~500 tokens (decision doc)
Unloaded after: audit report delivered

---

Inputs

Input	Source	Required
target-tenant	user	No — audits all namespaces if omitted
target-env	user	No — filters to one env if provided

---

Steps

1. Load naming rules
   Read: .crux/decisions/tenant-naming-conventions.md
   Extract: namespace naming pattern, required labels, environment names
   IF file missing → stop:
     "decisions/tenant-naming-conventions.md not found.
      Run coordinator installation to generate naming standards."

2. List all namespaces
   kubectl get namespaces -o json
   Exclude system namespaces: kube-system, kube-public, kube-node-lease, default

   IF target-tenant provided → filter to namespaces starting with {tenant-id}-
   IF target-env provided    → filter to namespaces ending with -{env}

3. For each tenant namespace — run checks

   3a. Naming pattern check
       Expected: {tenant-id}-{env}  (from decisions file)
       FAIL: namespace does not match pattern

   3b. Required label check
       kubectl get namespace {ns} -o jsonpath='{.metadata.labels}'
       Required: tenant, env, tier, managed-by
       FAIL: any required label missing
       WARN: label present but value does not match namespace name components

   3c. ResourceQuota check
       kubectl get resourcequota -n {ns} --no-headers 2>/dev/null
       WARN: no ResourceQuota defined

   3d. LimitRange check
       kubectl get limitrange -n {ns} --no-headers 2>/dev/null
       WARN: no LimitRange defined

   3e. NetworkPolicy check
       kubectl get networkpolicy -n {ns} --no-headers 2>/dev/null
       WARN: no NetworkPolicy defined (SOC Type 2 concern)

4. Identify orphan namespaces
   Namespaces that match naming pattern format but whose tenant-id
   is not present in any known tenant list (if available in MEMORY.md)
   WARN: possible orphan — tenant not in known tenant list

5. Compile results
   For each namespace: PASS / WARN / FAIL
   Overall status:
     CLEAN   — 0 failures, 0 warnings
     WARNING — 0 failures, ≥1 warnings
     FAILING — ≥1 failures

6. Report to user (inline — no file written unless requested)
   Summary table + failures list + warnings list

7. IF user requests → write full report to docs/namespace-audit.md

---

Output

Delivered inline by default. If written to file, format:

# Namespace Audit

> Generated by kubernetes-namespace-audit on {DATE}.
> Naming standard: .crux/decisions/tenant-naming-conventions.md
> Cluster: {endpoint}
> Namespaces audited: {n}
> Update: @kubernetes-admin audit namespaces

## Summary

| Namespace | Naming | Labels | Quota | LimitRange | NetPol | Status |
|---|---|---|---|---|---|---|
| {ns} | ✓ | ✓ | ✓ | ✓ | ✓ | CLEAN |
| {ns} | ✓ | ✗ env label missing | ✓ | ✗ | ✗ | FAILING |

## Failures

{list of FAIL items with exact kubectl commands to remediate}

## Warnings

{list of WARN items}

## Orphan Candidates

{namespaces matching pattern but with unknown tenant-id}

---
*Last updated: {DATE} — source: live-analysis*

---

Error Handling

Condition	Action
decisions/tenant-naming-conventions.md missing	Stop. Notify: file required as normative source.
kubectl not found	Stop. Notify: "kubectl is required."
Cluster unreachable	Stop. Notify with endpoint, suggest kubeconfig check.
No tenant namespaces found	Notify with full namespace list and expected pattern.
Command fails for a namespace	Mark as (error — {reason}), continue with others.