kubernetes-review

ziwon's avatarfrom ziwon

Reviews Kubernetes manifests for best practices, security, and homelab standards compliance. Use when reviewing YAML files, K8s manifests, Helm values, or ArgoCD applications.

⭐0stars🔀0forks📁View on GitHub🕐Updated Jan 3, 2026
[Cloud Infrastructure]

When & Why to Use This Skill

This Claude skill provides an automated review framework for Kubernetes manifests, Helm charts, and ArgoCD applications. It ensures that infrastructure-as-code (IaC) configurations adhere to industry best practices, security standards, and resource optimization guidelines, significantly reducing the risk of deployment failures and security vulnerabilities in containerized environments.

Use Cases

  • Pre-deployment Validation: Automatically scan Kubernetes YAML files for missing CPU/Memory requests and limits to prevent resource contention and OOM kills.
  • Security Hardening: Audit security contexts to ensure containers are configured with 'runAsNonRoot', 'readOnlyRootFilesystem', and no privilege escalation.
  • Reliability Engineering: Verify that liveness and readiness probes are correctly implemented with appropriate delays to ensure high availability during rolling updates.
  • Secret Management Compliance: Detect hardcoded secrets in Helm values and ensure the use of external secret providers or secure management tools like Infisical.
  • GPU Workload Optimization: Validate specialized resource requirements, including NVIDIA GPU resource sets, tolerations, and node selectors for AI/ML deployments.
namekubernetes-review
descriptionReviews Kubernetes manifests for best practices, security, and homelab standards compliance. Use when reviewing YAML files, K8s manifests, Helm values, or ArgoCD applications.
allowed-toolsRead, Grep, Glob

Kubernetes Manifest Review

Review Kubernetes manifests against homelab standards.

Checklist

Resource Management

  • CPU/Memory requests set
  • CPU/Memory limits set
  • Requests < Limits
resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    cpu: 1000m
    memory: 1Gi

Health Checks

  • Liveness probe configured
  • Readiness probe configured
  • Appropriate initialDelaySeconds
livenessProbe:
  httpGet:
    path: /health
    port: 8080
  initialDelaySeconds: 10
  periodSeconds: 10

readinessProbe:
  httpGet:
    path: /ready
    port: 8080
  initialDelaySeconds: 5
  periodSeconds: 5

Security Context

  • runAsNonRoot: true
  • readOnlyRootFilesystem: true
  • allowPrivilegeEscalation: false
securityContext:
  runAsNonRoot: true
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false

Labels

  • app.kubernetes.io/name
  • app.kubernetes.io/instance
  • app.kubernetes.io/version
  • app.kubernetes.io/managed-by: argocd

Secrets

  • No hardcoded secrets in values
  • Uses Infisical or external secrets
  • No .env files committed

GPU Workloads

For GPU workloads, also check:

  • nvidia.com/gpu resource set
  • GPU tolerations present
  • nodeSelector for GPU nodes

Reference

See @.claude/rules/kubernetes.md for complete guidelines.