Build an AI Helm Values Validator with Claude API

# values-production.yaml — passes helm lint, passes JSON Schema validation, 
# still has 3 real problems
replicaCount: 1                    # no HA for "production"
image:
  repository: myapp
  tag: latest                       # never pin "latest" in production
resources:
  requests:
    memory: "512Mi"
    cpu: "500m"
  limits:
    memory: "256Mi"                 # LOWER than request — will OOMKill immediately
    cpu: "1000m"

import subprocess
import yaml
 
def get_resolved_values(chart_path: str, values_file: str) -> dict:
    """Get the fully merged values — defaults + overrides — as Helm actually sees them."""
    result = subprocess.run(
        ["helm", "show", "values", chart_path, "-f", values_file],
        capture_output=True, text=True
    )
    return yaml.safe_load(result.stdout)
 
def get_rendered_manifests(chart_path: str, values_file: str, release_name: str) -> str:
    result = subprocess.run(
        ["helm", "template", release_name, chart_path, "-f", values_file],
        capture_output=True, text=True
    )
    return result.stdout

from anthropic import Anthropic
import json
 
client = Anthropic()
 
def validate_helm_values(values_file_name: str, resolved_values: dict, rendered_manifests: str) -> dict:
    prompt = f"""You are a senior platform engineer reviewing a Helm values file 
named "{values_file_name}" before it's applied.
 
RESOLVED VALUES (after merging defaults + overrides):
{json.dumps(resolved_values, indent=2)}
 
RENDERED MANIFESTS (what Helm will actually apply):
{rendered_manifests[:6000]}
 
Check for these categories of problems:
1. Resource sanity: limits lower than requests, missing limits entirely, 
   suspiciously low/high values for the apparent workload type
2. Production readiness mismatches: if the filename suggests "production" or 
   "prod", flag low replica counts, "latest" image tags, missing PodDisruptionBudget, 
   missing liveness/readiness probes, missing anti-affinity rules
3. Security: privileged containers, missing securityContext, hostNetwork/hostPID 
   enabled without clear justification, secrets passed as plain env vars
4. Common typos/logic errors: a value that looks like it was meant to reference 
   another field but is hardcoded, inconsistent naming patterns suggesting copy-paste 
   errors from another environment's values
 
For each issue found, return:
- severity: critical, warning, or info
- field: the specific YAML path
- issue: what's wrong
- suggestion: the specific fix
 
Return as JSON: {{"issues": [...]}}. If nothing is wrong, return {{"issues": []}}."""
 
    response = client.messages.create(
        model="claude-sonnet-4-6",
        max_tokens=2048,
        messages=[{"role": "user", "content": prompt}]
    )
    
    return json.loads(response.content[0].text)

# .github/workflows/helm-validate.yml
name: Validate Helm Values
on:
  pull_request:
    paths:
      - 'helm/**/values*.yaml'
 
jobs:
  ai-validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run AI values validator
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          python scripts/validate_helm_values.py \
            --chart ./helm/myapp \
            --values ./helm/myapp/values-production.yaml \
            --fail-on critical

# scripts/validate_helm_values.py
import sys
import argparse
 
def main():
    parser = argparse.ArgumentParser()
    parser.add_argument("--chart", required=True)
    parser.add_argument("--values", required=True)
    parser.add_argument("--fail-on", default="critical", choices=["critical", "warning"])
    args = parser.parse_args()
    
    resolved = get_resolved_values(args.chart, args.values)
    manifests = get_rendered_manifests(args.chart, args.values, "ci-validation")
    result = validate_helm_values(args.values, resolved, manifests)
    
    severity_order = {"critical": 0, "warning": 1, "info": 2}
    fail_threshold = severity_order[args.fail_on]
    
    should_fail = False
    for issue in result["issues"]:
        marker = "🔴" if issue["severity"] == "critical" else "🟡" if issue["severity"] == "warning" else "ℹ️"
        print(f"{marker} [{issue['severity'].upper()}] {issue['field']}: {issue['issue']}")
        print(f"   → {issue['suggestion']}")
        
        if severity_order.get(issue["severity"], 2) <= fail_threshold:
            should_fail = True
    
    if should_fail:
        print(f"\nValidation failed — issues at or above '{args.fail_on}' severity found.")
        sys.exit(1)
    
    print("\nNo blocking issues found.")
 
if __name__ == "__main__":
    main()