- name
- helm-chart-linter
- description
- Lint and validate Helm charts for structure, security, dependencies, and best practices. Use when asked to lint, validate, check, or audit Helm charts, verify Chart.yaml, values.yaml, templates, or ensure Helm chart quality. Triggers on "lint helm", "validate chart", "check helm chart", "helm best practices".
Helm Chart Linter
A pure Python 3 (stdlib only) linter and validator for Helm chart directories. Checks structure, security, dependencies, and best practices across 22 rules.
Commands
python3 scripts/helm_chart_linter.py <command> <chart-dir> [options]
| Command | Description |
|---|
lint | Lint chart structure and best practices (all rules) |
security | Run security-focused checks only |
dependencies | Validate Chart.yaml/Chart.lock dependencies |
validate | Full validation: structure + security + dependencies |
Options
| Option | Description |
|---|
| `--format text\ | json\ | markdown` | Output format (default: text) |
--strict | Exit 1 on warnings as well as errors (CI mode) |
Examples
# Basic lint
python3 scripts/helm_chart_linter.py lint ./my-chart
# Full validation with JSON output
python3 scripts/helm_chart_linter.py validate ./my-chart --format json
# Security audit, strict mode for CI
python3 scripts/helm_chart_linter.py security ./my-chart --strict
# Dependency check with Markdown report
python3 scripts/helm_chart_linter.py dependencies ./my-chart --format markdown
Rules
Structure (6 rules)
CHART001 — Chart.yaml exists and has required fields (apiVersion, name, version, description)CHART002 — Version is valid semverCHART003 — values.yaml existsCHART004 — templates/ directory existsCHART005 — NOTES.txt exists in templates/ (warning)CHART006 — .helmignore exists (warning)
Security (6 rules)
SEC001 — No hardcoded secrets in values.yaml (passwords, tokens, keys)SEC002 — No privileged containers (securityContext.privileged: true)SEC003 — No hostNetwork, hostPID, or hostIPC enabledSEC004 — Resource limits defined in templatesSEC005 — No runAsRoot without explicit runAsNonRootSEC006 — Image tags not "latest"
Dependencies (4 rules)
DEP001 — Chart.lock present and matches Chart.yaml dependenciesDEP002 — No wildcard version constraintsDEP003 — Repository URLs use HTTPSDEP004 — No duplicate dependency names
Best Practices (6 rules)
BP001 — Labels include app.kubernetes.io/name, version, managed-byBP002 — Liveness and readiness probes definedBP003 — Service account name configuredBP004 — Namespace not hardcoded in templatesBP005 — No deprecated API versions (extensions/v1beta1, apps/v1beta1, etc.)BP006 — Values documented with comments
Exit Codes
| Code | Meaning |
|---|
0 | No issues (or only warnings in normal mode) |
1 | Errors found (or warnings found in --strict) |
2 | Script/usage error |
