Helm Chart Linter
by @charlie-morrison
Lint and validate Helm charts for structure, security, dependencies, and best practices. Use when asked to lint, validate, check, or audit Helm charts, verif...
clawhub install helm-chart-linterπ About This Skill
name: helm-chart-linter description: Lint and validate Helm charts for structure, security, dependencies, and best practices. Use when asked to lint, validate, check, or audit Helm charts, verify Chart.yaml, values.yaml, templates, or ensure Helm chart quality. Triggers on "lint helm", "validate chart", "check helm chart", "helm best practices".
Helm Chart Linter
A pure Python 3 (stdlib only) linter and validator for Helm chart directories. Checks structure, security, dependencies, and best practices across 22 rules.
Commands
python3 scripts/helm_chart_linter.py [options]
| Command | Description |
|----------------|---------------------------------------------------------------|
| lint | Lint chart structure and best practices (all rules) |
| security | Run security-focused checks only |
| dependencies | Validate Chart.yaml/Chart.lock dependencies |
| validate | Full validation: structure + security + dependencies |
Options
| Option | Description |
|---------------------------------|--------------------------------------------------|
| --format text\|json\|markdown | Output format (default: text) |
| --strict | Exit 1 on warnings as well as errors (CI mode) |
Examples
# Basic lint
python3 scripts/helm_chart_linter.py lint ./my-chartFull validation with JSON output
python3 scripts/helm_chart_linter.py validate ./my-chart --format jsonSecurity audit, strict mode for CI
python3 scripts/helm_chart_linter.py security ./my-chart --strictDependency check with Markdown report
python3 scripts/helm_chart_linter.py dependencies ./my-chart --format markdown
Rules
Structure (6 rules)
1.CHART001 β Chart.yaml exists and has required fields (apiVersion, name, version, description)
2. CHART002 β Version is valid semver
3. CHART003 β values.yaml exists
4. CHART004 β templates/ directory exists
5. CHART005 β NOTES.txt exists in templates/ (warning)
6. CHART006 β .helmignore exists (warning)Security (6 rules)
7.SEC001 β No hardcoded secrets in values.yaml (passwords, tokens, keys)
8. SEC002 β No privileged containers (securityContext.privileged: true)
9. SEC003 β No hostNetwork, hostPID, or hostIPC enabled
10. SEC004 β Resource limits defined in templates
11. SEC005 β No runAsRoot without explicit runAsNonRoot
12. SEC006 β Image tags not "latest"Dependencies (4 rules)
13.DEP001 β Chart.lock present and matches Chart.yaml dependencies
14. DEP002 β No wildcard version constraints
15. DEP003 β Repository URLs use HTTPS
16. DEP004 β No duplicate dependency namesBest Practices (6 rules)
17.BP001 β Labels include app.kubernetes.io/name, version, managed-by
18. BP002 β Liveness and readiness probes defined
19. BP003 β Service account name configured
20. BP004 β Namespace not hardcoded in templates
21. BP005 β No deprecated API versions (extensions/v1beta1, apps/v1beta1, etc.)
22. BP006 β Values documented with commentsExit Codes
| Code | Meaning |
|------|----------------------------------------------|
| 0 | No issues (or only warnings in normal mode) |
| 1 | Errors found (or warnings found in --strict) |
| 2 | Script/usage error |
π‘ Examples
# Basic lint
python3 scripts/helm_chart_linter.py lint ./my-chartFull validation with JSON output
python3 scripts/helm_chart_linter.py validate ./my-chart --format jsonSecurity audit, strict mode for CI
python3 scripts/helm_chart_linter.py security ./my-chart --strictDependency check with Markdown report
python3 scripts/helm_chart_linter.py dependencies ./my-chart --format markdown
βοΈ Configuration
| Option | Description |
|---------------------------------|--------------------------------------------------|
| --format text\|json\|markdown | Output format (default: text) |
| --strict | Exit 1 on warnings as well as errors (CI mode) |
π Constraints
Structure (6 rules)
1.CHART001 β Chart.yaml exists and has required fields (apiVersion, name, version, description)
2. CHART002 β Version is valid semver
3. CHART003 β values.yaml exists
4. CHART004 β templates/ directory exists
5. CHART005 β NOTES.txt exists in templates/ (warning)
6. CHART006 β .helmignore exists (warning)Security (6 rules)
7.SEC001 β No hardcoded secrets in values.yaml (passwords, tokens, keys)
8. SEC002 β No privileged containers (securityContext.privileged: true)
9. SEC003 β No hostNetwork, hostPID, or hostIPC enabled
10. SEC004 β Resource limits defined in templates
11. SEC005 β No runAsRoot without explicit runAsNonRoot
12. SEC006 β Image tags not "latest"Dependencies (4 rules)
13.DEP001 β Chart.lock present and matches Chart.yaml dependencies
14. DEP002 β No wildcard version constraints
15. DEP003 β Repository URLs use HTTPS
16. DEP004 β No duplicate dependency namesBest Practices (6 rules)
17.BP001 β Labels include app.kubernetes.io/name, version, managed-by
18. BP002 β Liveness and readiness probes defined
19. BP003 β Service account name configured
20. BP004 β Namespace not hardcoded in templates
21. BP005 β No deprecated API versions (extensions/v1beta1, apps/v1beta1, etc.)
22. BP006 β Values documented with comments