### Install Helm Chart with Debugging

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-development/SKILL.md

Use `helm install` with `--debug` and `--dry-run` flags to simulate an installation and inspect the generated manifests and release details.

```bash
helm install myrelease mychart/ --debug --dry-run
```

--------------------------------

### Complete Chart.yaml Example

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-development/SKILL.md

A comprehensive example of a `Chart.yaml` file, defining chart metadata, dependencies, and maintainer information.

```yaml
apiVersion: v2
name: myapp
description: A Helm chart for MyApp
type: application
version: 1.0.0
appVersion: "2.3.1"

home: https://github.com/org/myapp
icon: https://example.com/icon.png
sources:
  - https://github.com/org/myapp

maintainers:
  - name: Platform Team
    email: platform@company.com
    url: https://platform.company.com

keywords:
  - app
  - web

annotations:
  artifacthub.io/changes: |
    - kind: added
      description: Initial release
  artifacthub.io/license: Apache-2.0

dependencies:
  - name: postgresql
    version: "12.x.x"
    repository: https://charts.bitnami.com/bitnami
    condition: postgresql.enabled
    tags:
      - database
  - name: redis
    version: "17.x.x"
    repository: https://charts.bitnami.com/bitnami
    condition: redis.enabled
    import-values:
      - child: primary
        parent: redis

```

--------------------------------

### Subchart Configuration Example

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-development/SKILL.md

Example of how to enable or disable a subchart and configure its authentication details.

```yaml
postgresql:
  enabled: false
  auth:
    database: myapp
    username: myapp
```

--------------------------------

### Well-Structured values.yaml Example

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-development/SKILL.md

An example of a `values.yaml` file demonstrating common configuration options for a Helm chart, including replicas, image details, service settings, and resource limits.

```yaml
# -- Number of replicas
replicaCount: 1

image:
  # -- Image repository
  repository: myapp
  # -- Image pull policy
  pullPolicy: IfNotPresent
  # -- Image tag (defaults to appVersion)
  tag: ""

# -- Image pull secrets
imagePullSecrets: []
# -- Override chart name
nameOverride: ""
# -- Override full name
fullnameOverride: ""

serviceAccount:
  # -- Create service account
  create: true
  # -- Service account annotations
  annotations: {}
  # -- Service account name (generated if not set)
  name: ""
  # -- Automount service account token
  automount: true

# -- Pod annotations
podAnnotations: {}

# -- Pod labels
podLabels: {}

podSecurityContext:
  fsGroup: 1000
  runAsNonRoot: true

securityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsUser: 1000
  capabilities:
    drop:
      - ALL

service:
  # -- Service type
  type: ClusterIP
  # -- Service port
  port: 80
  # -- Target port
  targetPort: 8080
  # -- Node port (when type is NodePort)
  nodePort: ""

ingress:
  # -- Enable ingress
  enabled: false
  # -- Ingress class name
  className: ""
  # -- Ingress annotations
  annotations: {}
  # -- Ingress hosts
  hosts:
    - host: chart-example.local
      paths:
        - path: "/"
          pathType: Prefix
  # -- Ingress TLS configuration
  tls: []

resources:
  limits:
    cpu: 500m
    memory: 512Mi
  requests:
    cpu: 100m
    memory: 128Mi

autoscaling:
  enabled: false
  minReplicas: 1
  maxReplicas: 10
  targetCPUUtilizationPercentage: 80
  targetMemoryUtilizationPercentage: 80

# -- Node selector
nodeSelector: {}

# -- Tolerations
tolerations: []

# -- Affinity rules
affinity: {}

# -- Extra environment variables
extraEnv: []

# -- Extra volume mounts
extraVolumeMounts: []

# -- Extra volumes
extraVolumes: []

# -- Liveness probe configuration
livenessProbe:
  httpGet:
    path: /healthz
    port: http
  initialDelaySeconds: 10
  periodSeconds: 10

```

--------------------------------

### Install and Template with Encrypted Helm Values

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-maintenance/SKILL.md

Shows how to install a Helm release using encrypted values files and how to template manifests with secrets included. The `helm-secrets` plugin must be installed.

```bash
# Install with encrypted values
helm secrets install myrelease mychart/ -f values.yaml -f values-secrets.yaml

# Template with secrets
helm secrets template myrelease mychart/ -f values-secrets.yaml
```

--------------------------------

### CI/CD Workflow Example

Source: https://github.com/foxj77/claude-code-skills/blob/main/CLAUDE.md

Example of a GitHub Actions workflow file for automated security scanning, including TruffleHog for secrets detection.

```yaml
.github/workflows/security-scan.yml

```

--------------------------------

### Semantic Versioning Example

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-maintenance/SKILL.md

Illustrates the MAJOR.MINOR.PATCH format for semantic versioning in Helm charts.

```text
MAJOR.MINOR.PATCH

MAJOR: Breaking changes (incompatible values schema changes)
MINOR: New features (backward compatible)
PATCH: Bug fixes (backward compatible)
```

--------------------------------

### Breaking Change Indicator Example

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-maintenance/references/changelog-template.md

Example demonstrating how to indicate breaking changes within the 'Changed' section of a changelog. It includes a clear prefix and a migration guide with before/after code examples.

```markdown
### Changed
- **BREAKING**: Renamed `image.name` to `image.repository`

  Migration:
  ```yaml
  # Before
  image:
    name: myapp

  # After
  image:
    repository: myapp
  ```

```

--------------------------------

### Kubernetes Vulnerability Assessment Tool Installation

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-security-redteam/SKILL.md

Install Kubescape and Trivy using Homebrew. Kubescape is for scanning Kubernetes clusters, while Trivy can scan clusters, images, and detect Kubernetes misconfigurations.

```bash
# kubescape
brew install kubescape
```

```bash
# trivy (includes cluster scanning, image scanning, and k8s misconfiguration detection)
brew install trivy
```

--------------------------------

### Helm Review Suggestion: Use Helper Template

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-review/SKILL.md

Example of a suggestion to extract repeated template patterns into a helper file.

```markdown
🔵 **Suggestion: Consider using a helper**
This pattern is repeated in multiple templates. Consider extracting to _helpers.tpl.
```

--------------------------------

### Reference Link Example

Source: https://github.com/foxj77/claude-code-skills/blob/main/_shared/README.md

Example of how to link to a shared reference document within a skill's markdown.

```markdown
## Security Context

For detailed security context configuration, see [Shared: Pod Security Context](../_shared/references/pod-security-context.md).
```

--------------------------------

### Get Helm Release Notes

Source: https://github.com/foxj77/claude-code-skills/blob/main/flux-troubleshooting/references/error-codes.md

Retrieve notes for a Helm release to understand the cause of an installation failure.

```bash
helm get notes <release> -n <namespace>
```

--------------------------------

### Helm Chart with Sensible Defaults

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-review/SKILL.md

Provides examples of setting sensible, secure defaults for resources and security contexts in Helm charts.

```yaml
# ✓ GOOD: Sensible, secure defaults
resources:
  limits:
    cpu: 500m
    memory: 512Mi
  requests:
    cpu: 100m
    memory: 128Mi

securityContext:
  runAsNonRoot: true
  readOnlyRootFilesystem: true
```

--------------------------------

### SKILL.md Frontmatter Example

Source: https://github.com/foxj77/claude-code-skills/blob/main/CLAUDE.md

Demonstrates the required YAML frontmatter for a SKILL.md file, including 'name' and 'description' fields used by Claude Code for skill activation.

```yaml
---
name: skill-name
description: Use when [scenario 1], [scenario 2], or [scenario 3]
---

```

--------------------------------

### Generate NetworkPolicy Rule Example

Source: https://github.com/foxj77/claude-code-skills/blob/main/kyverno-troubleshooting/SKILL.md

An example of a Kyverno generate rule that creates a NetworkPolicy when a new namespace is admitted. It demonstrates how to define the target resource and its desired state.

```yaml
# Generate NetworkPolicy when namespace is created
spec:
  rules:
    - name: default-deny
      match:
        any:
          - resources:
              kinds:
                - Namespace
      generate:
        synchronize: true       # Keep in sync (update if policy changes)
        apiVersion: networking.k8s.io/v1
        kind: NetworkPolicy
        name: default-deny
        namespace: "{{request.object.metadata.name}}"
        data:
          spec:
            podSelector: {}
            policyTypes:
              - Ingress
              - Egress
```

--------------------------------

### Quick Reference Table Example

Source: https://github.com/foxj77/claude-code-skills/blob/main/CLAUDE.md

Shows the markdown format for a 'Quick Reference' table within a skill's documentation, used for presenting common commands and tasks.

```markdown
| Task | Command |
|------|---------|
| Task description | `command` |

```

--------------------------------

### Component Structure Example

Source: https://github.com/foxj77/claude-code-skills/blob/main/flux-gitops-patterns/SKILL.md

Standard directory structure for a Flux CD GitOps component, including namespace, repository source, release, and Kustomization files.

```directory structure
component-name/
├── namespace.yaml       # Namespace isolation
├── repository.yaml      # HelmRepository source
├── release.yaml         # HelmRelease deployment
└── kustomization.yaml   # Resource orchestration
```

--------------------------------

### Helm-docs Command for Generating README

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-maintenance/SKILL.md

Command to install and run helm-docs for automatically generating a README file from Helm chart templates.

```bash
# Install helm-docs
brew install norwoodj/tap/helm-docs

# Generate README from template
helm-docs --chart-search-root=charts/
```

--------------------------------

### Match and Exclude Patterns Example

Source: https://github.com/foxj77/claude-code-skills/blob/main/kyverno-troubleshooting/SKILL.md

This YAML snippet demonstrates how to configure a policy rule to match specific resources while excluding system namespaces.

```yaml
# Common pattern: enforce on all namespaces except system ones
spec:
  rules:
    - name: check-labels
      match:
        any:
          - resources:
              kinds:
                - Pod
      exclude:
        any:
          - resources:
              namespaces:
                - kube-system
                - kyverno
                - cert-manager
```

--------------------------------

### Deployment Order Visualization

Source: https://github.com/foxj77/claude-code-skills/blob/main/flux-gitops-patterns/SKILL.md

Illustrates a typical dependency chain for Flux CD deployments, starting from the Flux System and progressing through infrastructure, configurations, monitoring, and finally applications.

```text
Flux System (bootstrapped)
  └─> Infrastructure (CRDs, operators)
      ├─> Configs (ConfigMaps, Secrets)
      └─> Monitoring (Prometheus, Grafana)
          └─> Apps (depends on all above)
```

--------------------------------

### List Vertical Pod Autoscalers

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-namespace-troubleshooting/SKILL.md

Display all Vertical Pod Autoscaler (VPA) resources configured for the namespace, if VPA is installed.

```bash
kubectl get vpa -n ${NS} 2>/dev/null
```

--------------------------------

### MCP Flux Operator Commands

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-platform-tenancy/SKILL.md

Example commands for interacting with Kubernetes resources via the MCP flux operator.

```bash
# Using kubectl via MCP
mcp__flux-operator-mcp__get_kubernetes_resources
mcp__flux-operator-mcp__apply_kubernetes_manifest
```

--------------------------------

### Get All Resources in a Namespace

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-namespace-troubleshooting/SKILL.md

Lists all Kubernetes resources within a specified namespace. Useful for a quick overview of the namespace's contents.

```bash
kubectl get all -n ${NS}
```

--------------------------------

### Inspect Resource Status

Source: https://github.com/foxj77/claude-code-skills/blob/main/flux-troubleshooting/SKILL.md

Get the status of Kustomizations, HelmReleases, and all source controllers across all namespaces.

```bash
flux get kustomizations -A
flux get helmreleases -A
flux get sources all -A
```

--------------------------------

### Helm Test Error Handling Example

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-testing/SKILL.md

Demonstrates providing clear failure messages and troubleshooting hints in a Helm test command.

```yaml
command:
- sh
- -c
- |
  set -e
  if ! curl -f http://service:8080/health; then
    echo "ERROR: Service health check failed"
    echo "Troubleshooting: kubectl get svc, kubectl logs -l app=myapp"
    exit 1
  fi

```

--------------------------------

### Finding Template Example

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-security-redteam/SKILL.md

A Markdown template for documenting security findings, including severity, description, impact, evidence, affected resources, remediation steps, and references.

```markdown
## [CRITICAL/HIGH/MEDIUM/LOW] Finding Title

**Description**: What the vulnerability is

**Impact**: What an attacker could do

**Evidence**:
- Commands and output

**Affected Resources**:
- Specific resources

**Remediation**:
1. Immediate fix
2. Long-term solution

**References**:
- CIS control
- MITRE technique
```

--------------------------------

### Helm Style Review Comment: Use nindent

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-review/SKILL.md

Example of a minor style suggestion to use `nindent` over `indent` for better reliability.

```markdown
🟡 **Minor: Use nindent instead of indent**
`nindent` handles newlines automatically and is more reliable.
```yaml
# Current
{{ toYaml .Values.labels | indent 4 }}

# Suggested
{{- toYaml .Values.labels | nindent 4 }}
```
```

--------------------------------

### Repository Structure Example

Source: https://github.com/foxj77/claude-code-skills/blob/main/CLAUDE.md

Illustrates the directory layout for the claude-code-skills repository, showing the placement of main README, contribution guidelines, CI/CD workflows, shared references, and individual skill directories.

```markdown
claude-code-skills/
├── README.md                    # Main project overview and skills index
├── CONTRIBUTING.md              # Contribution guidelines
├── .github/workflows/           # CI/CD for security scanning
│   └── security-scan.yml
├── _shared/                     # Shared reference materials
│   └── references/              # Common patterns referenced by multiple skills
└── [skill-name]/                # Individual skill directories
    ├── SKILL.md                 # Main skill documentation with frontmatter
    └── references/              # Supporting materials (optional)

```

--------------------------------

### Standard Kubernetes Labels in Helm

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-review/SKILL.md

Example of applying standard Kubernetes labels within a Helm chart's metadata.

```yaml
# ✓ GOOD: Standard Kubernetes labels
metadata:
  labels:
    app.kubernetes.io/name: {{ include "myapp.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    helm.sh/chart: {{ include "myapp.chart" . }}
```

--------------------------------

### Chart.lock File Example

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-maintenance/SKILL.md

Shows the structure of a Chart.lock file, which records the exact versions and digests of downloaded dependencies. This file should be committed to Git.

```yaml
# Chart.lock (auto-generated, commit to git)
dependencies:
- name: postgresql
  repository: https://charts.bitnami.com/bitnami
  version: 12.1.6
digest: sha256:abc123...
generated: "2024-01-15T10:30:00Z"
```

--------------------------------

### Describe Node Conditions for Namespace Pods

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-namespace-troubleshooting/SKILL.md

Get detailed information about the conditions of nodes that are hosting pods from the specified namespace.

```bash
kubectl get pods -n ${NS} -o jsonpath='{range .items[*]}{.spec.nodeName}{"\n"}{end}' | sort -u | \
  xargs -I{} sh -c 'echo "--- {} ---" && kubectl describe node {} | grep -A5 "Conditions:"'
```

--------------------------------

### Helm Templating: Loops and Ranges

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-development/SKILL.md

Provides examples of iterating over lists and maps in Helm templates. It shows how to use `range` with and without an index, and how to access map keys and values.

```yaml
# Range over list
{{- range .Values.hosts }}
- {{ . | quote }}
{{- end }}

# Range with index
{{- range $index, $host := .Values.hosts }}
- name: host-{{ $index }}
  value: {{ $host }}
{{- end }}

# Range over map
{{- range $key, $value := .Values.env }}
- name: {{ $key }}
  value: {{ $value | quote }}
{{- end }}

```

--------------------------------

### Get Pod CPU Usage

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-namespace-troubleshooting/SKILL.md

Display the CPU usage for pods in the namespace, sorted by CPU consumption. Requires metrics-server to be installed.

```bash
kubectl top pods -n ${NS} --sort-by=cpu
```

--------------------------------

### Tenant Satisfaction Survey Questions

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-continual-improvement/SKILL.md

Lists example questions for a tenant satisfaction survey to gather feedback on platform stability, ease of deployment, and support responsiveness. Include an open-ended question for suggestions.

```yaml
survey:
  - "How satisfied with platform stability? (1-5)"
  - "How easy to deploy applications? (1-5)"
  - "How responsive is support? (1-5)"
  - "What should we improve?"
```

--------------------------------

### Helm Unit Tests with helm-unittest

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-maintenance/SKILL.md

Example test cases for a Helm deployment using the helm-unittest plugin. Covers replica count, image, and security context assertions.

```yaml
# tests/deployment_test.yaml
suite: deployment tests
templates:
  - deployment.yaml
tests:
  - it: should create deployment with correct replicas
    set:
      replicaCount: 3
    asserts:
      - equal:
          path: spec.replicas
          value: 3

  - it: should use correct image
    set:
      image:
        repository: myapp
        tag: v1.0.0
    asserts:
      - equal:
          path: spec.template.spec.containers[0].image
          value: myapp:v1.0.0

  - it: should have security context
    asserts:
      - isNotNull:
          path: spec.template.spec.securityContext
      - equal:
          path: spec.template.spec.containers[0].securityContext.runAsNonRoot
          value: true

  - it: should fail without required value
    set:
      image.repository: null
    asserts:
      - failedTemplate: {}
```

--------------------------------

### ArtifactHub Annotations for Chart.yaml

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-maintenance/references/changelog-template.md

Example of how to use ArtifactHub annotations in `Chart.yaml` to describe changes. This format allows for structured metadata about added, changed, fixed, and security-related updates, including links to migration guides.

```yaml
# Chart.yaml
annotations:
  artifacthub.io/changes: |
    - kind: added
      description: Support for HorizontalPodAutoscaler
    - kind: changed
      description: Renamed image.name to image.repository
      links:
        - name: Migration guide
          url: https://github.com/org/chart/blob/main/MIGRATION.md
    - kind: fixed
      description: Fixed service port configuration
    - kind: security
      description: Updated base image for CVE-2023-XXXXX

```

--------------------------------

### Login to OCI Registry

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-maintenance/SKILL.md

Authenticates with an OCI-compliant container registry. Replace `registry.example.com` with your registry's address.

```bash
# Login to registry
helm registry login registry.example.com
```

--------------------------------

### Kyverno CLI: Test All Policies Against Resource

Source: https://github.com/foxj77/claude-code-skills/blob/main/kyverno-troubleshooting/SKILL.md

Apply all policies from a specified directory against a resource file using the Kyverno CLI. This is helpful for comprehensive testing.

```bash
kyverno apply /path/to/policies/ --resource resource.yaml
```

--------------------------------

### Helm Test Execution Order Example

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-testing/SKILL.md

Demonstrates controlling Helm test execution order using the `helm.sh/hook-weight` annotation, where lower values run first.

```yaml
# Test 1: Run first
metadata:
  annotations:
    helm.sh/hook-weight: "-5"

---
# Test 2: Run second
metadata:
  annotations:
    helm.sh/hook-weight: "0"

```

--------------------------------

### Example Structured Error Log

Source: https://github.com/foxj77/claude-code-skills/blob/main/flux-troubleshooting/SKILL.md

An example of a structured JSON log entry indicating a reconciliation failure in Flux.

```json
{
  "level": "error",
  "ts": "2024-01-15T09:36:41.286Z",
  "controllerGroup": "kustomize.toolkit.fluxcd.io",
  "controllerKind": "Kustomization",
  "name": "resource-name",
  "namespace": "namespace",
  "msg": "Reconciliation failed after 2s, next try in 5m0s",
  "revision": "main@sha1:abc123",
  "error": "specific error message"
}
```

--------------------------------

### Correct Helm Hook for Tests

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-testing/SKILL.md

Ensure your Helm hook is set to 'test-success' to run tests after installation, rather than during the installation process.

```yaml
# Wrong - runs during install
helm.sh/hook: post-install

# Correct - runs with helm test
helm.sh/hook: test-success
```

--------------------------------

### Install Helm Secrets Plugin

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-maintenance/SKILL.md

Installs the `helm-secrets` plugin, which enables managing sensitive values within Helm charts using encryption.

```bash
helm plugin install https://github.com/jkroepke/helm-secrets
```

--------------------------------

### Encrypt and Edit Secrets with Helm Secrets

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-maintenance/SKILL.md

Demonstrates creating a SOPS configuration and then encrypting/decrypting sensitive Helm values files. Ensure `age` is installed and configured.

```bash
# Create SOPS config
cat > .sops.yaml <<EOF
creation_rules:
  - path_regex: .*secrets\.yaml$
    age: age1...
EOF

# Encrypt secrets file
helm secrets encrypt values-secrets.yaml

# Decrypt for editing
helm secrets edit values-secrets.yaml
```

--------------------------------

### List Services

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-namespace-troubleshooting/SKILL.md

Display all Services within a namespace with detailed information.

```bash
kubectl get services -n ${NS} -o wide
```

--------------------------------

### Check Available DNS Tools in a Pod

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-dns-troubleshooting/SKILL.md

Verify which DNS resolution tools are installed within a specific pod. This helps determine the best approach for testing DNS from within the pod.

```bash
kubectl exec -n ${NS} ${POD} -- sh -c 'which nslookup dig getent wget curl 2>/dev/null'
```

--------------------------------

### Bootstrap Flux with GitHub

Source: https://github.com/foxj77/claude-code-skills/blob/main/flux-operations/references/cli-commands.md

Initialize Flux on a cluster using a GitHub repository, specifying owner, repo, branch, and path.

```bash
# GitHub bootstrap
flux bootstrap github \
  --owner=<owner> \
  --repository=<repo> \
  --branch=main \
  --path=./clusters/homelab \
  --personal
```

--------------------------------

### Undocumented Helm Values

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-review/SKILL.md

Example of Helm values without documentation, which is discouraged.

```yaml
# ❌ BAD: Undocumented values
replicaCount: 1
image:
  repository: myapp
  pullPolicy: IfNotPresent
```

--------------------------------

### Check All Kustomizations Status

Source: https://github.com/foxj77/claude-code-skills/blob/main/flux-troubleshooting/references/error-codes.md

View the readiness status of all Kustomizations to identify parent dependencies that might not be ready.

```bash
flux get kustomizations -A
```

--------------------------------

### Non-Standard Labels in Helm

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-review/SKILL.md

Example of non-standard labels, which should be avoided in favor of established conventions.

```yaml
# ❌ BAD: Non-standard labels
metadata:
  labels:
    app: myapp
    version: v1
```

--------------------------------

### Check cert-manager CRDs

Source: https://github.com/foxj77/claude-code-skills/blob/main/cert-manager-troubleshooting/SKILL.md

Verify that all cert-manager Custom Resource Definitions (CRDs) are installed correctly.

```bash
kubectl get crd | grep cert-manager
```

--------------------------------

### List ConfigMaps

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-namespace-troubleshooting/SKILL.md

Display all ConfigMaps available within the namespace.

```bash
kubectl get configmaps -n ${NS}
```

--------------------------------

### List Ingress Resources

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-namespace-troubleshooting/SKILL.md

Display all Ingress resources configured for the namespace.

```bash
kubectl get ingress -n ${NS}
```

--------------------------------

### Get Warning Events

Source: https://github.com/foxj77/claude-code-skills/blob/main/flux-troubleshooting/SKILL.md

Fetch Kubernetes warning events from the flux-system namespace for diagnostic purposes.

```bash
kubectl get events -n flux-system --field-selector type=Warning
```

--------------------------------

### Preview Kustomization Changes

Source: https://github.com/foxj77/claude-code-skills/blob/main/flux-operations/references/cli-commands.md

Compare the current state of a Kustomization with its intended state by providing a local path to the manifests.

```bash
# Preview changes
flux diff kustomization <name> --path <local-path>
```

--------------------------------

### Multi-Repo Directory Structure

Source: https://github.com/foxj77/claude-code-skills/blob/main/flux-gitops-patterns/SKILL.md

Example of a multi-repo layout for enterprise Flux CD GitOps, separating concerns like fleet infrastructure, platform components, and team-specific applications into different repositories.

```directory structure
fleet-infra/          # Flux bootstrap, cluster configs
├── clusters/
│   ├── production/
│   └── staging/

platform-components/  # Shared infrastructure
├── cert-manager/
├── ingress-nginx/
└── monitoring/

team-alpha-apps/      # Team-specific apps
├── app1/
└── app2/
```

--------------------------------

### List tenants using kubectl

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-platform-tenancy/SKILL.md

Use this command to list all namespaces labeled as tenants.

```bash
kubectl get ns -l platform.io/tenant
```

--------------------------------

### Helm Chart Without Defaults

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-review/SKILL.md

Example of Helm chart values lacking defaults, which can lead to issues.

```yaml
# ❌ BAD: No defaults for critical settings
resources: {}
securityContext: {}
```

--------------------------------

### ExternalSecret Spec with Single Key

Source: https://github.com/foxj77/claude-code-skills/blob/main/external-secrets-troubleshooting/SKILL.md

Example of an ExternalSecret specification mapping a single key from a provider secret.

```yaml
spec:
  data:
    - secretKey: password          # Key in the K8s Secret
      remoteRef:
        key: /app/database         # Path at the provider
        property: password         # JSON property (if value is JSON)
```

--------------------------------

### Check Flux Bootstrap Prerequisites

Source: https://github.com/foxj77/claude-code-skills/blob/main/flux-operations/references/cli-commands.md

Verify that all prerequisites for bootstrapping Flux are met.

```bash
# Check prerequisites
flux check --pre
```

--------------------------------

### Check Kyverno CRDs

Source: https://github.com/foxj77/claude-code-skills/blob/main/kyverno-troubleshooting/SKILL.md

Verify that Kyverno Custom Resource Definitions (CRDs) are correctly installed and available in the cluster.

```bash
kubectl get crd | grep kyverno
```

--------------------------------

### Helm Unit Test Command

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-maintenance/SKILL.md

Runs unit tests for a Helm chart. This requires the helm-unittest plugin to be installed.

```bash
helm unittest mychart/
```

--------------------------------

### List Running Pods for Testing

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-dns-troubleshooting/SKILL.md

Command to list all running pods across all namespaces, useful for selecting a test pod for DNS resolution checks.

```bash
kubectl get pods -A --field-selector=status.phase=Running -o wide
```

--------------------------------

### HelmRelease Disable Wait Settings

Source: https://github.com/foxj77/claude-code-skills/blob/main/flux-operations/SKILL.md

Configuration to disable the wait for Helm install and upgrade operations to complete in a HelmRelease.

```yaml
spec:
  install:
    disableWait: true
  upgrade:
    disableWait: true
```

--------------------------------

### Check Local Kustomize Build

Source: https://github.com/foxj77/claude-code-skills/blob/main/flux-troubleshooting/references/error-codes.md

Locally build a Kustomization to debug syntax errors in your kustomization.yaml file.

```bash
kubectl kustomize <path>
```

--------------------------------

### Check Flux Version and Health

Source: https://github.com/foxj77/claude-code-skills/blob/main/flux-operations/SKILL.md

Commands to check the installed Flux version and verify the health of Flux components.

```bash
flux version
flux check
```

--------------------------------

### Create Helm Chart

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-development/SKILL.md

Use the `helm create` command to scaffold a new Helm chart with a standard directory structure.

```bash
helm create mychart
```

--------------------------------

### ExternalSecret Spec with Template

Source: https://github.com/foxj77/claude-code-skills/blob/main/external-secrets-troubleshooting/SKILL.md

Example of an ExternalSecret specification using a template to format data for the target Kubernetes Secret.

```yaml
spec:
  target:
    template:
      data:
        connection: "host={{ .host }} port={{ .port }} user={{ .user }}"
```

--------------------------------

### Version Pin for Helm Release

Source: https://github.com/foxj77/claude-code-skills/blob/main/flux-operations/SKILL.md

Example of pinning a specific version for a Helm chart within a HelmRelease configuration.

```yaml
spec:
  chart:
    spec:
      version: "1.2.3"
```

--------------------------------

### Check Ingress Backend Service References

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-network-troubleshooting/SKILL.md

Extract and display the host, path, backend service name, and port for each rule defined in an Ingress resource.

```bash
kubectl get ingress ${INGRESS_NAME} -n ${NS} -o jsonpath='{range .spec.rules[*]}{.host}{"\t"}{range .http.paths[*]}{.path}	{.backend.service.name}:{.backend.service.port.number}{"\n"}{end}{end}'
```

--------------------------------

### Get CoreDNS Resource Requests and Limits

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-dns-troubleshooting/SKILL.md

Command to retrieve the resource requests and limits configured for CoreDNS containers.

```bash
kubectl get deploy coredns -n kube-system -o jsonpath='{.spec.template.spec.containers[0].resources}' | jq .
```

--------------------------------

### Get Controller-Specific Logs

Source: https://github.com/foxj77/claude-code-skills/blob/main/flux-troubleshooting/SKILL.md

Retrieve logs for individual Flux controllers to pinpoint issues within specific components.

```bash
kubectl logs -n flux-system deploy/source-controller
kubectl logs -n flux-system deploy/kustomize-controller
kubectl logs -n flux-system deploy/helm-controller
kubectl logs -n flux-system deploy/notification-controller
kubectl logs -n flux-system deploy/image-reflector-controller
kubectl logs -n flux-system deploy/image-automation-controller
```

--------------------------------

### Check CoreDNS Resource Consumption

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-dns-troubleshooting/SKILL.md

Command to check the CPU and memory usage of CoreDNS pods, requires metrics-server to be installed.

```bash
kubectl top pods -n kube-system -l k8s-app=kube-dns
```

--------------------------------

### Analyze Pod Resource Requests and Limits

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-namespace-troubleshooting/SKILL.md

Compare requested, limited, and actual CPU/memory for containers within pods to identify over or under-provisioning.

```bash
kubectl get pods -n ${NS} -o json | \
  jq -r '.items[] | .metadata.name as $pod | .spec.containers[] | "\($pod)\t\(.name)\treq_cpu=\(.resources.requests.cpu // \"none\")\tlim_cpu=\(.resources.limits.cpu // \"none\")\treq_mem=\(.resources.requests.memory // \"none\")\tlim_mem=\(.resources.limits.memory // \"none\")"'
```

--------------------------------

### Clone Claude Code Skills Repository

Source: https://github.com/foxj77/claude-code-skills/blob/main/README.md

Clone the repository to your Claude Code skills directory. This is the first installation option.

```bash
git clone https://github.com/foxj77/claude-code-skills.git ~/.claude/skills/
```

--------------------------------

### Helm Conditional Testing Example

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-testing/SKILL.md

Shows how to conditionally include a Helm test based on a global `tests.enabled` value in `values.yaml`.

```yaml
{{- if .Values.tests.enabled }}
apiVersion: v1
kind: Pod
metadata:
  name: "{{ .Release.Name }}-test"
  annotations:
    helm.sh/hook: test-success
spec:
  # ...
{{- end }}

```

--------------------------------

### Helm Template Helper: Image

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-development/SKILL.md

Constructs the full image name including repository and tag for a container. Defaults to Chart.AppVersion if tag is not specified.

```go-template
{{/*
Return the proper image name
*/}}
{{- define "myapp.image" -}}
{{- $tag := .Values.image.tag | default .Chart.AppVersion -}}
{{- printf "%s:%s" .Values.image.repository $tag }}
{{- end }}
```

--------------------------------

### Check Background Controller for Generate

Source: https://github.com/foxj77/claude-code-skills/blob/main/kyverno-troubleshooting/SKILL.md

Inspect the logs of the Kyverno background controller to diagnose issues with resource generation. This is useful for understanding why generated resources might not be appearing.

```bash
# Check background controller (handles generate)
kubectl logs -n kyverno deploy/kyverno-background-controller --tail=200 | grep -iE 'generate|trigger'
```

--------------------------------

### Test External Connectivity to httpbin.org

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-network-troubleshooting/SKILL.md

Uses `wget` from within a pod to fetch data from `httpbin.org/get`, testing general internet access and egress connectivity from the pod.

```bash
# Test general internet access
kubectl exec -n ${NS} ${POD} -- wget -qO- --timeout=5 http://httpbin.org/get 2>&1 | head -5
```

--------------------------------

### ExternalSecret Spec with DataFrom

Source: https://github.com/foxj77/claude-code-skills/blob/main/external-secrets-troubleshooting/SKILL.md

Example of an ExternalSecret specification using 'dataFrom' to extract multiple keys from a single provider secret.

```yaml
spec:
  dataFrom:
    - extract:
        key: /app/database         # All JSON keys become Secret keys
```

--------------------------------

### Run kube-bench for CIS Benchmark Compliance

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-security-hardening/SKILL.md

Deploy kube-bench as a Kubernetes Job to scan the cluster configuration against CIS benchmarks. Check the logs for detailed results and remediation steps.

```bash
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
kubectl logs -l app=kube-bench
```

--------------------------------

### Describe Specific Network Policy

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-network-troubleshooting/SKILL.md

Get detailed information about a specific NetworkPolicy, including its selectors, ingress, and egress rules.

```bash
kubectl describe networkpolicy ${POLICY_NAME} -n ${NS}
```

--------------------------------

### Check resource quota for a tenant

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-platform-tenancy/SKILL.md

Use this command to describe the resource quota applied to a specific tenant namespace.

```bash
kubectl describe resourcequota -n tenant-NAME
```

--------------------------------

### Describe Specific Ingress Resource

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-network-troubleshooting/SKILL.md

Get detailed information about a specific Ingress resource, including its rules, backends, and status.

```bash
kubectl describe ingress ${INGRESS_NAME} -n ${NS}
```

--------------------------------

### View network policies in a tenant namespace

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-platform-tenancy/SKILL.md

Use this command to list all network policies applied to a specific tenant namespace.

```bash
kubectl get networkpolicies -n tenant-NAME
```

--------------------------------

### Pull Helm Chart from OCI Registry

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-maintenance/SKILL.md

Retrieves a Helm chart from an OCI registry. Can be used for direct installation or local use.

```bash
# Pull chart
helm pull oci://registry.example.com/charts/mychart --version 1.0.0

# Install directly from OCI
helm install myrelease oci://registry.example.com/charts/mychart --version 1.0.0
```

--------------------------------

### List Pods and Container Image Details

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-namespace-troubleshooting/SKILL.md

Retrieve the names of all pods in a namespace along with the container images they are configured to use.

```bash
kubectl get pods -n ${NS} -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{range .spec.containers[*]}{.image}{" "}{end}{"\n"}{end}'
```

--------------------------------

### Configure Additional Working Directories for Claude Code

Source: https://github.com/foxj77/claude-code-skills/blob/main/README.md

Add the path to the Claude Code skills to your configuration. This is the second installation option.

```json
{
  "additionalWorkingDirectories": [
    "/path/to/claude-code-skills"
  ]
}
```

--------------------------------

### Recommended Pod Security Context Settings

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-review/SKILL.md

Apply these settings to ensure containers run securely, avoiding root execution and privilege escalation.

```yaml
# REQUIRED security settings
podSecurityContext:
  runAsNonRoot: true       # ✓ Never run as root
  fsGroup: 1000            # ✓ Set filesystem group
  seccompProfile:
    type: RuntimeDefault   # ✓ Use seccomp

securityContext:
  allowPrivilegeEscalation: false  # ✓ Block privilege escalation
  readOnlyRootFilesystem: true     # ✓ Immutable container
  runAsNonRoot: true               # ✓ Non-root user
  runAsUser: 1000                  # ✓ Specific UID
  capabilities:
    drop:
      - ALL                        # ✓ Drop all capabilities
```

--------------------------------

### Helm Test Resource Limits

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-testing/SKILL.md

Example of setting resource requests and limits for a Helm test container to prevent resource exhaustion.

```yaml
spec:
  containers:
  - name: test
    image: curlimages/curl:8.7.1
    resources:
      requests:
        cpu: 100m
        memory: 64Mi
      limits:
        cpu: 200m
        memory: 128Mi

```

--------------------------------

### Helm Non-Breaking Upgrade Strategy

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-maintenance/SKILL.md

Example of a non-breaking upgrade strategy by adding new fields with default values set to false.

```yaml
# Add new fields with defaults
newFeature:
  enabled: false  # Default to off for existing users
```

--------------------------------

### Helm Chart Dependencies Example

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-maintenance/SKILL.md

Defines dependencies for a Helm chart in Chart.yaml, specifying name, version range, repository, and condition.

```yaml
# Chart.yaml
dependencies:
  - name: postgresql
    version: "12.x.x"      # Use range for flexibility
    repository: https://charts.bitnami.com/bitnami
    condition: postgresql.enabled
```

--------------------------------

### Kubectl RBAC Quick Reference Commands

Source: https://github.com/foxj77/claude-code-skills/blob/main/_shared/references/rbac-patterns.md

Common kubectl commands for creating roles, rolebindings, and checking permissions. Ensure the namespace variable ${NS} is set.

```bash
# Create role
kubectl create role pod-reader --verb=get,list,watch --resource=pods -n ${NS}
```

```bash
# Create rolebinding
kubectl create rolebinding pod-reader-binding --role=pod-reader --user=jane -n ${NS}
```

```bash
# Check permissions
kubectl auth can-i get pods -n ${NS} --as=jane
```

```bash
# Who can do X?
kubectl auth who-can get secrets -n ${NS}
```

--------------------------------

### Helm Security Review Comment: Privileged Container

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-review/SKILL.md

Example of a critical security issue related to privileged containers and suggested remediation.

```markdown
🔴 **Critical: Security - Privileged Container**
The container is running as privileged which grants full host access.
```yaml
# Current
securityContext:
  privileged: true

# Suggested
securityContext:
  privileged: false
  allowPrivilegeEscalation: false
```
```

--------------------------------

### List Policies

Source: https://github.com/foxj77/claude-code-skills/blob/main/kyverno-troubleshooting/SKILL.md

Retrieve a list of all Policy resources across all namespaces.

```bash
kubectl get policy -A
```

--------------------------------

### View Pod resolv.conf

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-dns-troubleshooting/SKILL.md

Executes a command inside a pod to display its DNS resolution configuration file.

```bash
# View the resolv.conf inside a running pod
kubectl exec ${POD} -n ${NS} -- cat /etc/resolv.conf
```

--------------------------------

### Cross-Cluster Git Repository Reference

Source: https://github.com/foxj77/claude-code-skills/blob/main/flux-operations/SKILL.md

Example of a GitRepository manifest that can be referenced across different clusters, allowing shared configuration management.

```yaml
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
  name: shared-config
spec:
  url: https://github.com/org/shared-config
  ref:
    branch: main
```

--------------------------------

### Get Node Name for Source and Target Pods

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-network-troubleshooting/SKILL.md

Retrieves the node names for the source and target pods to determine if they are on the same or different nodes.

```bash
kubectl get pod ${SOURCE_POD} -n ${NS} -o jsonpath='{.spec.nodeName}'
```

```bash
kubectl get pod ${TARGET_POD} -n ${NS} -o jsonpath='{.spec.nodeName}'
```

--------------------------------

### Check Pod Resource Usage

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-namespace-troubleshooting/SKILL.md

Get current CPU and memory usage for pods in a namespace. Useful for diagnosing slow applications.

```bash
kubectl top pods -n ${NS}
```

--------------------------------

### Create and Schedule Velero Backups

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-platform-operations/SKILL.md

Manages backups of Kubernetes cluster resources using Velero. Includes creating an immediate backup and setting up a daily scheduled backup for the 'platform-system' namespace.

```bash
velero backup create platform-$(date +%Y%m%d) \
  --include-namespaces platform-system \
  --ttl 720h
```

```bash
velero schedule create daily-platform \
  --schedule="0 2 * * *" \
  --include-namespaces platform-system
```

--------------------------------

### Follow Flux Logs in Real-time

Source: https://github.com/foxj77/claude-code-skills/blob/main/flux-operations/references/cli-commands.md

Stream Flux logs in real-time across all namespaces.

```bash
# Follow mode
flux logs -A --follow
```

--------------------------------

### Get All Events in a Namespace

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-namespace-troubleshooting/SKILL.md

Retrieves all events within a namespace, sorted by their last timestamp. Provides a chronological view of namespace activity.

```bash
kubectl get events -n ${NS} --sort-by='.lastTimestamp'
```

--------------------------------

### Check DNS-01 Challenge Configuration and TXT Record

Source: https://github.com/foxj77/claude-code-skills/blob/main/cert-manager-troubleshooting/SKILL.md

Inspect the Issuer's ACME solver configuration for DNS-01 to identify the provider and verify that the necessary TXT record has been created in DNS.

```bash
# Check which DNS provider is configured
kubectl get issuer ${ISSUER_NAME} -n ${NS} -o json | jq '.spec.acme.solvers[].dns01'

# Check for DNS provider credentials
kubectl get challenge ${CHALLENGE_NAME} -n ${NS} -o json | jq '.spec.solver.dns01'

# Verify TXT record was created
dig TXT _acme-challenge.${DOMAIN} @8.8.8.8
```

--------------------------------

### Check Issuer and ClusterIssuer Status

Source: https://github.com/foxj77/claude-code-skills/blob/main/cert-manager-troubleshooting/SKILL.md

Use kubectl to get and describe Issuer and ClusterIssuer resources to check their status and configuration details.

```bash
# Check Issuer status
kubectl get issuer -n ${NS} -o wide
kubectl describe issuer ${ISSUER_NAME} -n ${NS}

# Check ClusterIssuer status
kubectl get clusterissuer -o wide
kubectl describe clusterissuer ${ISSUER_NAME}

# Check the Certificate's issuer reference
kubectl get certificate ${CERT_NAME} -n ${NS} -o jsonpath='{.spec.issuerRef}'
```

--------------------------------

### Implement Quick Helm Tests

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-testing/SKILL.md

Avoid long-running tests that can slow down your deployment process. Prefer quick checks like timed HTTP requests.

```yaml
# Avoid - waits 60 seconds
for i in $(seq 1 60); do sleep 1; done

# Prefer - quick check
curl -f --max-time 10 http://service/health
```

--------------------------------

### Test Pod-to-Pod Connectivity using /dev/tcp

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-network-troubleshooting/SKILL.md

An alternative method to test pod-to-pod connectivity using bash's /dev/tcp pseudo-device, useful when wget is unavailable.

```bash
kubectl exec -n ${NS} ${SOURCE_POD} -- bash -c "echo > /dev/tcp/${TARGET_IP}/${PORT} && echo OPEN || echo CLOSED" 2>&1
```

--------------------------------

### Helm Test Independence Example

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-testing/SKILL.md

Illustrates a single focused Helm test versus a test that attempts to verify multiple unrelated things.

```yaml
# Good: Single focused test
metadata:
  name: "{{ .Release.Name }}-test-health"

# Avoid: Tests multiple unrelated things
metadata:
  name: "{{ .Release.Name }}-test-everything"

```

--------------------------------

### List All Ingress Resources

Source: https://github.com/foxj77/claude-code-skills/blob/main/k8s-network-troubleshooting/SKILL.md

Display all Ingress resources across all namespaces in the cluster.

```bash
kubectl get ingress -A
```

--------------------------------

### Helm Template Helper: Full Name

Source: https://github.com/foxj77/claude-code-skills/blob/main/helm-chart-development/SKILL.md

Creates a default fully qualified application name for Helm resources. Handles fullnameOverride and combines release name with chart name.

```go-template
{{/*
Create a default fully qualified app name.
*/}}
{{- define "myapp.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
```