Helm Chart Builder

The Helm Chart Builder skill provides an opinionated Helm workflow for turning Kubernetes manifests into maintainable, testable, and reusable charts. It focu.

Install

npx promptshop add helm-chart-builder

Details

What This Skill Does

The Helm Chart Builder skill provides an opinionated Helm workflow for turning Kubernetes manifests into maintainable, testable, and reusable charts.
It focuses on chart structure, values design, template patterns, dependency management, and security hardening.
This skill helps developers and operators build charts that are trusted and easy to manage.

When to Use

Create a Helm chart for this service.
Review my Helm chart.
Is this chart secure?Design a values.yaml.
Add a subchart dependency.
Set up Helm tests.

Key Features

Scaffolds production-ready Helm charts with best-practice structure.
Analyzes existing charts for issues like missing labels.
Audits charts for security issues, including RBAC and network policies.
Identifies workload type.
Scaffolds chart structure.
Validates chart for security issues.

Manual Installation

Helm Chart Builder

Production-grade Helm charts.
Sensible defaults.
Secure by design.
No cargo-culting.
Opinionated Helm workflow that turns ad-hoc Kubernetes manifests into maintainable, testable, reusable charts.
Covers chart structure, values design, template patterns, dependency management, and security hardening.

Not a Helm tutorial — a set of concrete decisions about how to build charts that operators trust and developers don't fight.

Slash Commands

Command	What it does
/helm:create	Scaffold a production-ready Helm chart with best-practice structure
/helm:review	Analyze an existing chart for issues — missing labels, hardcoded values, template anti-patterns
/helm:security	Audit chart for security issues — RBAC, network policies, pod security, secrets handling

When This Skill Activates

Recognize these patterns from the user:

"Create a Helm chart for this service" "Review my Helm chart" "Is this chart secure?" "Design a values.yaml" "Add a subchart dependency" "Set up helm tests" "Helm best practices for [workload type]" Any request involving: Helm chart, values.yaml, Chart.yaml, templates, helpers, _helpers.tpl, subcharts, helm lint, helm test

If the user has a Helm chart or wants to package Kubernetes resources → this skill applies.

Workflow

/helm:create — Chart Scaffolding

Identify workload type

Web service (Deployment + Service + Ingress)
Worker (Deployment, no Service)
Cron Job (Cron Job + Service Account)
Stateful service (Stateful Set + PVC + Headless Service)
Library chart (no templates, only helpers)

Scaffold chart structure

mychart/ ├── Chart.yaml # Chart metadata and dependencies ├── values.yaml # Default configuration ├── values.schema.json # Optional: JSON Schema for values validation ├── .helmignore # Files to exclude from packaging ├── templates/ │ ├── _helpers.tpl # Named templates and helper functions │ ├── deployment.yaml # Workload resource │ ├── service.yaml # Service exposure │ ├── ingress.yaml # Ingress (if applicable) │ ├── serviceaccount.yaml # Service Account │ ├── hpa.yaml # Horizontal Pod Autoscaler │ ├── pdb.yaml # Pod Disruption Budget │ ├── networkpolicy.yaml # Network Policy │ ├── configmap.yaml # Config Map (if needed) │ ├── secret.yaml # Secret (if needed) │ ├── NOTES.txt # Post-install usage instructions │ └── tests/ │ └── test-connection.yaml └── charts/ # Subcharts (dependencies)

Apply Chart.yaml best practices

METADATA ├── api Version: v2 (Helm 3 only — never v1) ├── name: matches directory name exactly ├── version: semver (chart version, not app version) ├── app Version: application version string ├── description: one-line summary of what the chart deploys └── type: application (or library for shared helpers)

DEPENDENCIES ├── Pin dependency versions with ~X.Y.Z (patch-level float) ├── Use condition field to make subcharts optional ├── Use alias for multiple instances of same subchart └── Run helm dependency update after changes

Generate values.yaml with documentation

Every value has an inline comment explaining purpose and type
Sensible defaults that work for development
Override-friendly structure (flat where possible, nested only when logical)
No hardcoded cluster-specific values (image registry, domain, storage class)

Validate python3 scripts/chart_analyzer.py mychart/ helm lint mychart/ helm template mychart/ --debug

/helm:review — Chart Analysis

Check chart structure

Check	Severity	Fix
Missing _helpers.tpl	High	Create helpers for common labels and selectors
No NOTES.txt	Medium	Add post-install instructions
No .helmignore	Low	Create one to exclude .git, CI files, tests
Missing Chart.yaml fields	Medium	Add description, app Version, maintainers
Hardcoded values in templates	High	Extract to values.yaml with defaults

Check template quality

Check	Severity	Fix
Missing standard labels	High	Use app.kubernetes.io/* labels via _helpers.tpl
No resource requests/limits	Critical	Add resources section with defaults in values.yaml
Hardcoded image tag	High	Use {{ . Values.image.repository }}:{{ . Values.image.tag }}
No image Pull Policy	Medium	Default to If Not Present, overridable
Missing liveness/readiness probes	High	Add probes with configurable paths and ports
No pod anti-affinity	Medium	Add preferred anti-affinity for HA
Duplicate template code	Medium	Extract into named templates in _helpers.tpl

Check values.yaml quality python3 scripts/values_validator.py mychart/values.yaml

Generate review report HELM CHART REVIEW — [chart name] Date: [timestamp]

CRITICAL: [count] HIGH: [count] MEDIUM: [count] LOW: [count]

[Detailed findings with fix recommendations]

/helm:security — Security Audit

Pod security audit

Check	Severity	Fix
No security Context	Critical	Add run As Non Root, read Only Root Filesystem
Running as root	Critical	Set run As Non Root: true, run As User: 1000
Writable root filesystem	High	Set read Only Root Filesystem: true + empty Dir for tmp
All capabilities retained	High	Drop ALL, add only specific needed caps
Privileged container	Critical	Set privileged: false, use specific capabilities
No seccomp profile	Medium	Set seccomp Profile.type: Runtime Default
allow Privilege Escalation true	High	Set allow Privilege Escalation: false

RBAC audit

Check	Severity	Fix
No Service Account	Medium	Create dedicated SA, don't use default
automount Service Account Token true	Medium	Set to false unless pod needs K8s API access
Cluster Role instead of Role	Medium	Use namespace-scoped Role unless cluster-wide needed
Wildcard permissions	Critical	Use specific resource names and verbs
No RBAC at all	Low	Acceptable if pod doesn't need K8s API access

Network and secrets audit

Check	Severity	Fix
No Network Policy	Medium	Add default-deny ingress + explicit allow rules
Secrets in values.yaml	Critical	Use external secrets operator or sealed-secrets
No Pod Disruption Budget	Medium	Add PDB with min Available for HA workloads
host Network: true	High	Remove unless absolutely required (e.g., CNI plugin)
host PID or host IPC	Critical	Never use in application charts

Generate security report SECURITY AUDIT — [chart name] Date: [timestamp]

CRITICAL: [count] HIGH: [count] MEDIUM: [c