Agent skill
pulumi-k8s-validator
Validates Pulumi Kubernetes TypeScript infrastructure via type checks, preview diffs, security audits, and production readiness. Use when auditing existing .ts files with @pulumi/kubernetes resources. Does NOT generate new resources.
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/other/pulumi-k8s-validator
SKILL.md
[H1][PULUMI-K8S-VALIDATOR]
Dictum: Validation is read-only analysis -- never modify files.
Analyze infrastructure code, propose improvements. Does NOT modify files.
Provider: current stable @pulumi/kubernetes | K8s: 1.32-1.35 | Canonical: infrastructure/src/deploy.ts (207 LOC)
| Use this skill | Use OTHER skill |
|---|---|
| Validate/audit Pulumi K8s code | pulumi-k8s-generator: Create new resources |
| Type-check resource definitions | k8s-debug: Debug deployed resources |
| Security + production readiness review | dockerfile-validator: Container image builds |
Tasks:
- Run TypeScript type check:
pnpm exec nx run infrastructure:typecheck - Run
pulumi preview --diff(flags:--expect-no-changes,--target <urn>,--refresh,--stack <name>) - Read infrastructure source; check security posture against
references/validation_checklist.md - Read infrastructure source; check production readiness against
references/validation_checklist.md - Generate report per format below
[1][STAGE_DETAILS]
Dictum: Each stage catches a distinct class of defect.
Guidance:
TypeScript- Record each error with file, line, and category. Common: wrong field name, missing required field, type mismatch, missing module.Preview- Interpret diff symbols (+create,-delete,~update,+-replace,-+replace with downtime). Skip on connection/stack errors; continue to Stage 3.Security- deploy.ts findings:_Ops.secret()wraps all sensitive values (PASS), no pod security context on compute (WARN), no NetworkPolicy (WARN).Readiness- deploy.ts findings: all probes configured (PASS), resource limits set (PASS), no PDB (WARN), no anti-affinity (WARN),:lateston observe images (WARN), no topology spread (INFO).
Best-Practices:
- Stages 1 + 3 run in parallel (compiler + source analysis). Stage 2 after Stage 1 passes. Stage 5 after all.
- Never modify files, offer to apply fixes, or prompt user for changes.
- Always load both
references/files when issues are found.
[2][REPORT_FORMAT]
Dictum: Structured output enables actionable triage.
Summary table:
| Stage | Status | Issues |
|---|---|---|
| 1. TypeScript | [PASS] | 0 errors |
| 2. Preview | [PASS] | 3 resources planned |
| 3. Security | [WARN] | Missing securityContext on 2 containers |
| 4. Readiness | [WARN] | Missing probes on 1 deployment |
Severity classification:
| Severity | Checks |
|---|---|
[ERROR] |
TS errors, preview failures, running as root, privileged, host namespace, missing requests, missing probes, secrets in config |
[WARN] |
Missing security context, no limits, no PDB, no NetworkPolicy, :latest image, no anti-affinity, no ServiceAccount |
[INFO] |
Missing startup probe, topology spread, HPA tuning, Gateway API migration, ValidatingAdmissionPolicy |
Per-issue detail: file:line, before/after TypeScript, reason, complexity [Simple]/[Medium]/[Complex].
Final summary: project, stack, status, error/warn/info counts, proposed change count, next steps.
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?