# Chartplumb

> Audit a Helm chart before packaging or upgrading it: will it lint, render and upgrade, and is it safe by default - then write its values.schema.json. The free check runs in the browser and uploads nothing: it reads a pasted chart (Chart.yaml, values.yaml, values.schema.json, templates, _helpers.tpl, NOTES.txt) with line numbers, parses Chart.yaml and values.yaml, scans every Go template action with the if/with/range block it sits in, and runs 28 deterministic checks drawn from Helm chart practice. The paid audit describes what the chart deploys, confirms or dismisses every flag and gives the whole corrected file for each finding; the paid schema lane writes values.schema.json (draft-07) and a values reference. The page checks every quote and line against the paste, puts every fix and the schema back into the paste and re-runs its checks, validates the chart's own defaults against the schema, and calls out a reply that repeats a secret from the paste.

App: https://chartplumb.skillsafe.ai/
API tutorial: https://chartplumb.skillsafe.ai/api.html

## Input

- The chart pasted into one box, each file introduced by a `# file: <path>` line (a `---` line before it only separates files); dropped files or a dropped chart folder are joined that way automatically. A paste with no `# file:` line is read as one file, guessed from its content.
- Nothing runs helm or talks to a cluster: every flag is a reading of the text, with the file and line it points at.
- A helper or value in a file that was not pasted is noted as context (HC-29), never reported as missing; subchart files under charts/ are read but not checked.
- The cluster's Kubernetes version, what the application needs and a subchart's values are outside the paste: the paid lanes ask rather than assume.

## Flags the free check raises

- HC-01 (high): Chart.yaml without apiVersion, name or version; a version that is not SemVer 2; a chart type other than application or library. Medium: a name that is not lower-case letters, digits and dashes.
- HC-02 (medium): Chart.yaml apiVersion v1 (the Helm 2 format), or requirements.yaml next to a v2 chart.
- HC-03 (medium): an unquoted numeric appVersion that YAML reads as a number (1.10 becomes 1.1). Low: no appVersion, no description.
- HC-04 (medium): a dependency without a version, with an unbounded range (*, >=x), without a repository, or from plain http.
- HC-05 (high): a Kubernetes API version current clusters removed (extensions/v1beta1, apps/v1beta1-2, networking.k8s.io/v1beta1, policy/v1beta1, batch/v1beta1, autoscaling/v2beta1-2, rbac v1beta1 and others), with the replacement; not raised inside a .Capabilities branch.
- HC-06 (high): a .Values path whose parent is not in values.yaml, unguarded - the render fails with a nil pointer.
- HC-07 (medium; low under an empty map): a .Values key that is not in values.yaml and not guarded by default, required, if or with - it renders empty.
- HC-08 (high): .Values inside a range or with block without $ - the render fails.
- HC-09 (high): include or template of a name no pasted file defines, or an unclosed block.
- HC-10 (high when the default is a non-empty map or list, otherwise medium): toYaml without nindent or indent.
- HC-11 (high when the default renders as a non-string, otherwise medium): an env value from .Values without quote.
- HC-12 (high): selector.matchLabels carrying helm.sh/chart, the chart version or the app version, directly or through a helper - the selector is immutable, so the next upgrade fails.
- HC-13 (high): a literal credential in values.yaml, an overlay or a Secret template, or a token-shaped string anywhere.
- HC-14 (high): Secret data from .Values not piped through b64enc.
- HC-15 (medium): a Secret generated with randAlphaNum or similar and no lookup - it changes on every upgrade.
- HC-16 (medium; high for an empty tag with no default): an image on latest or with no tag.
- HC-17 (medium; high for privileged): no securityContext, a securityContext taken from values that are empty by default, privileged, or allowPrivilegeEscalation.
- HC-18 (low): no resource requests or limits by default.
- HC-19 (low): a Deployment, StatefulSet or DaemonSet with no liveness or readiness probe.
- HC-20 (medium): a hardcoded metadata.namespace.
- HC-21 (high): a values key with a dash read as a dot path.
- HC-22 (high): a tab character in a template.
- HC-23 (high): values.schema.json does not parse, or the chart's own values.yaml fails it.
- HC-24 (low): no values.schema.json.
- HC-25 (low): a define not prefixed with the chart name.
- HC-26 (low): values defined but never read by any template (skipped when .Values is passed on whole).
- HC-27 (low): a hook without helm.sh/hook-delete-policy.
- HC-28 (low): no templates/NOTES.txt.
- HC-29 (info): context - files not pasted, subcharts, a library chart.

## Free extras

- Every value of values.yaml with its type, default, line and the templates that read it; every .Values reference with its status (defined, missing, missing parent, guarded, dash in path, no $ inside range/with); every rendered object with its API version.
- A starter values.schema.json typed from the defaults alone.
- Put any audit fix (or all of them, or the written schema) back into the paste and re-run the check; undo puts the original back.
- Exports: the check as Markdown, the flags as CSV, the fixed chart, values.schema.json, a README values table, the findings or values as CSV, the whole result as JSON.

## Paid lanes (the `task` field)

- `audit`: `{task, verdict: unsafe|needs_work|ready, headline, chart, findings: [{id, flags, file, line, severity, title, evidence, why, fix}], flag_answers: [{flag, status: confirmed|dismissed, reason}], plan, questions, summary}`. `fix` is the whole corrected file.
- `schema`: `{task, verdict: complete|partial, headline, schema: {draft-07 JSON Schema object}, values: [{path, type, default, required, description}], open: [{path, reason}], questions, summary}`. `complete` means nothing is left open.
- Run input: `{task, chart, facts, note?, audit_handoff?, retry_note?}` - all strings; `facts` is the page's analysis as a JSON string. The audit hands its findings to the schema lane with every fix applied to `chart`.
- Model: gpt-terra, 10% publisher markup. A run needs a signed-in account; the reservation shown before a run is a hold, and only what the run uses is charged.

## Sources

- helm-chart-scaffolding by Seth Hobson, wshobson/agents (github.com/wshobson/agents, plugins/kubernetes-operations/skills/helm-chart-scaffolding), MIT - https://skillsafe.ai/skill/@wshobson/helm-chart-scaffolding
- The checks and the reconciliation are original to this app. Chartplumb is an independent tool, not affiliated with or endorsed by the Helm project, the CNCF or The Linux Foundation; Helm is a trademark of The Linux Foundation.