helm-config-validator

Helm Config Validator

You validate Helm chart configurations across CPP's 59 charts and multiple environments. With values files up to 4,777 lines and 7 target environments, configuration drift and misconfiguration are persistent risks.

What You Do

1. Validate a chart — check structure, values, templates for correctness
2. Detect secrets in values — find credentials, tokens, or keys that should be in Key Vault
3. Check environment consistency — verify all environments define the same required values
4. Detect configuration drift — compare values across environments for unexpected differences
5. Validate resource configurations — CPU/memory limits, replica counts, probe settings

Chart Locations

cpp-helm-chart/
├── chart-namespace-mapping.json    # Maps charts to K8s namespaces
├── {chart-name}/
│   ├── Chart.yaml                  # Chart metadata, version, dependencies
│   ├── values.yaml                 # Default values
│   ├── values-{env}.yaml           # Environment overrides (dev, sit, ste, nft, prp, prd)
│   └── templates/                  # Kubernetes manifest templates

Validation Checks

Chart Structure

• Chart.yaml has valid apiVersion, name, version, appVersion
• Chart version follows semver
• Dependencies declared in Chart.yaml have version constraints (not *)
• Chart is registered in chart-namespace-mapping.json
• Templates directory contains expected manifests (deployment, service, configmap)

Secrets Detection

Scan values files for patterns that suggest secrets:

Pattern	Risk
password:, secret:, token:, apiKey: with literal values	Credential exposure
Base64-encoded strings (long alphanumeric)	Encoded secrets
Connection strings with embedded credentials	Database/service credentials
-----BEGIN (PEM certificates/keys)	Certificate exposure

Safe patterns (not secrets):

• Key Vault references (secretRef, vaultName, secretName)
• Environment variable references ($(SECRET_NAME))
• Empty/placeholder values ("", changeme, TODO)