kubernetes-deployment-validator

Name: kubernetes-deployment-validator
Author: mjunaidca

26stars11forks

How to install kubernetes-deployment-validator?

mjunaidca/mjs-agent-skills/kubernetes-deployment-validator

$npx -y skills add mjunaidca/mjs-agent-skills --skill kubernetes-deployment-validator

Installs into the current project.

Summary

Validate Kubernetes deployments before execution. Run pre-flight checks for password generation, environment variables, database authentication, CORS configuration, and docker-compose parity. Use this skill BEFORE every Helm install/upgrade to prevent deployment failures.

Files · 1

View on GitHub

SKILL.md

1	# Kubernetes Deployment Validator
2
3	Pre-flight validation checks for Kubernetes deployments to prevent common configuration errors and deployment failures.
4
5	## When to Use
6
7	ALWAYS run BEFORE:
8	- `helm install` or `helm upgrade`
9	- Kubernetes deployment scripts
10	- Configuration changes to production/staging
11	- Migration from docker-compose to Kubernetes
12
13	## Validation Checklist
14
15	### 1. Password Generation Strategy
16
17	What to Check:
18	- Password encoding method (hex vs base64)
19	- Special characters that need URL-encoding
20	- PostgreSQL authentication compatibility
21
22	Validation:
23	```bash
24	# Test password generation
25	PASSWORD=$(openssl rand -hex 16)
26	echo "Generated password: $PASSWORD"
27
28	# Check for URL-encoding issues (should have NONE with hex)
29	echo "$PASSWORD" \| grep -E '[+/=]' && echo "❌ FAIL: Special chars found" \|\| echo "✅ PASS: Alphanumeric only"
30
31	# Test with PostgreSQL
32	echo "Testing PostgreSQL authentication with generated password..."
33	PGPASSWORD="$PASSWORD" psql -h localhost -p 5432 -U test_user -d postgres -c "SELECT 1;"
34	```
35
36	Pass Criteria:
37	- ✅ Uses `openssl rand -hex` (alphanumeric only)
38	- ✅ No special characters: `+`, `/`, `=`
39	- ✅ Works with psql, asyncpg, and postgres.js
40
41	Fail Indicators:
42	- ❌ Uses `openssl rand -base64` (contains special chars)
43	- ❌ Password contains URL-encoding characters
44	- ❌ Password works in psql but fails in application
45
46	Fix:
47	```bash
48	# Wrong
49	POSTGRES_PASSWORD=$(openssl rand -base64 16) # ❌ Can generate: xK+3/zA9=mQ2pL1w
50
51	# Right
52	POSTGRES_PASSWORD=$(openssl rand -hex 16) # ✅ Always generates: dadaf807863a952b
53	```
54
55	---
56
57	### 2. Environment Variable Flow
58
59	What to Check:
60	Complete path from .env → Helm → ConfigMap/Secret → Pod → Application
61
62	Validation:
63	```bash
64	# Check .env file
65	echo "📄 Checking .env file..."
66	grep -E "(SMTP_\|EMAIL_\|NODE_ENV\|ALLOWED_ORIGINS)" .env
67
68	# Simulate Helm deployment (dry-run)
69	echo "🎯 Checking Helm values..."
70	helm template taskflow ./helm/taskflow --set sso.smtp.password="test" \| grep -A5 ConfigMap
71
72	# Verify variables would reach pod
73	echo "🔍 Checking environment injection..."
74	helm template taskflow ./helm/taskflow \| grep -E "(SMTP\|NODE_ENV\|ALLOWED_ORIGINS)" \| head -20
75	```
76
77	Pass Criteria:
78	- ✅ .env contains all required variables
79	- ✅ Helm values.yaml references env vars
80	- ✅ ConfigMap includes non-sensitive variables
81	- ✅ Secrets include sensitive variables
82	- ✅ Deployment injects both ConfigMap and Secrets
83
84	Fail Indicators:
85	- ❌ Variables in .env but not in values.yaml
86	- ❌ Sensitive vars in ConfigMap instead of Secret
87	- ❌ Deployment doesn't reference ConfigMap/Secret
88	- ❌ Variable names mismatch between layers
89
90	Fix:
91	```yaml
92	# 1. Add to values.yaml
93	sso:
94	smtp:
95	enabled: true
96	host: smtp.gmail.com
97	password: changeme # Override with --set
98
99	# 2. Add to ConfigMap (non-sensitive)
100	data:
101	SMTP_HOST: {{ .Values.sso.smtp.host }}
102
103	# 3. Add to Secret (sensitive)
104	stringData:
105	SMTP_PASS: {{ .Values.sso.smtp.password }}
106
107	# 4. Inject in Deployment
108	envFrom:
109	- configMapRef:
110	name: sso-config
111	env:
112	- name: SMTP_PASS
113	valueFrom:
114	secretKeyRef:
115	name: sso-secret
116	key: SMTP_PASS
117	```
118
119	---
120
121	### 3. Database Authentication Configuration
122
123	What to Check:
124	- Secret password matches database password
125	- Connection string format correct
126	- Authentication mode compatible with client libraries
127
128	Validation:
129	```bash
130	# Get password from Secret
131	SECRET_PASSWORD=$(kubectl get secret sso-postgres-secret -n taskflow -o jsonpath='{.data.POSTGRES_PASSWORD}' \| base64 -d 2>/dev/null \|\| echo "none")
132
133	# Test connection with Secret password
134	echo "Testing database connection with Secret password..."
135	PGPASSWORD="$SECRET_PASSWORD" psql -h localhost -p 5432 -U sso_user -d sso_db -c "SELECT 1;" 2>&1
136
137	# Check for auth errors
138	kubectl logs -n taskflow -l app.kubernetes.io/component=sso --tail=50 \| grep -i "password authentication failed"
139	```
140
141	Pass Criteria:
142	- ✅ Secret password works with psql
143	- ✅ Secret password works with application client (asyncpg/postgres.js)
144	- ✅ No "password authentication failed" errors in logs
145	- ✅ Connection string format correct for client library
146
147	Fail Indicators:
148	- ❌ psql works but application fails
149	- ❌ "password authentication failed" errors
150	- ❌ Secret password ≠ database password
151	- ❌ Connection string has URL-encoding issues
152
153	Fix:
154	```bash
155	# Reset database password to match Secret
156	PASSWORD=$(kubectl get secret sso-postgres-secret -n taskflow -o jsonpath='{.data.POSTGRES_PASSWORD}' \| base64 -d)
157	kubectl exec -n taskflow sso-postgres-0 -- sh -c "
158	PGPASSWORD='old_password' psql -U sso_user -d postgres -c \"ALTER USER sso_user WITH PASSWORD '$PASSWORD';\"
159	"
160
161	# Restart application pods
162	kube

People who liked this also viewed

6 picks

Type

kubernetes-deployment-validator

26stars11forks

View on GitHub

How to install kubernetes-deployment-validator?

mjunaidca/mjs-agent-skills/kubernetes-deployment-validator

$npx -y skills add mjunaidca/mjs-agent-skills --skill kubernetes-deployment-validator

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Kubernetes Deployment Validator
2
3	Pre-flight validation checks for Kubernetes deployments to prevent common configuration errors and deployment failures.
4
5	## When to Use
6
7	ALWAYS run BEFORE:
8	- `helm install` or `helm upgrade`
9	- Kubernetes deployment scripts
10	- Configuration changes to production/staging
11	- Migration from docker-compose to Kubernetes
12
13	## Validation Checklist
14
15	### 1. Password Generation Strategy
16
17	What to Check:
18	- Password encoding method (hex vs base64)
19	- Special characters that need URL-encoding
20	- PostgreSQL authentication compatibility
21
22	Validation:
23	```bash
24	# Test password generation
25	PASSWORD=$(openssl rand -hex 16)
26	echo "Generated password: $PASSWORD"
27
28	# Check for URL-encoding issues (should have NONE with hex)
29	echo "$PASSWORD" \| grep -E '[+/=]' && echo "❌ FAIL: Special chars found" \|\| echo "✅ PASS: Alphanumeric only"
30
31	# Test with PostgreSQL
32	echo "Testing PostgreSQL authentication with generated password..."
33	PGPASSWORD="$PASSWORD" psql -h localhost -p 5432 -U test_user -d postgres -c "SELECT 1;"
34	```
35
36	Pass Criteria:
37	- ✅ Uses `openssl rand -hex` (alphanumeric only)
38	- ✅ No special characters: `+`, `/`, `=`
39	- ✅ Works with psql, asyncpg, and postgres.js
40
41	Fail Indicators:
42	- ❌ Uses `openssl rand -base64` (contains special chars)
43	- ❌ Password contains URL-encoding characters
44	- ❌ Password works in psql but fails in application
45
46	Fix:
47	```bash
48	# Wrong
49	POSTGRES_PASSWORD=$(openssl rand -base64 16) # ❌ Can generate: xK+3/zA9=mQ2pL1w
50
51	# Right
52	POSTGRES_PASSWORD=$(openssl rand -hex 16) # ✅ Always generates: dadaf807863a952b
53	```
54
55	---
56
57	### 2. Environment Variable Flow
58
59	What to Check:
60	Complete path from .env → Helm → ConfigMap/Secret → Pod → Application
61
62	Validation:
63	```bash
64	# Check .env file
65	echo "📄 Checking .env file..."
66	grep -E "(SMTP_\|EMAIL_\|NODE_ENV\|ALLOWED_ORIGINS)" .env
67
68	# Simulate Helm deployment (dry-run)
69	echo "🎯 Checking Helm values..."
70	helm template taskflow ./helm/taskflow --set sso.smtp.password="test" \| grep -A5 ConfigMap
71
72	# Verify variables would reach pod
73	echo "🔍 Checking environment injection..."
74	helm template taskflow ./helm/taskflow \| grep -E "(SMTP\|NODE_ENV\|ALLOWED_ORIGINS)" \| head -20
75	```
76
77	Pass Criteria:
78	- ✅ .env contains all required variables
79	- ✅ Helm values.yaml references env vars
80	- ✅ ConfigMap includes non-sensitive variables
81	- ✅ Secrets include sensitive variables
82	- ✅ Deployment injects both ConfigMap and Secrets
83
84	Fail Indicators:
85	- ❌ Variables in .env but not in values.yaml
86	- ❌ Sensitive vars in ConfigMap instead of Secret
87	- ❌ Deployment doesn't reference ConfigMap/Secret
88	- ❌ Variable names mismatch between layers
89
90	Fix:
91	```yaml
92	# 1. Add to values.yaml
93	sso:
94	smtp:
95	enabled: true
96	host: smtp.gmail.com
97	password: changeme # Override with --set
98
99	# 2. Add to ConfigMap (non-sensitive)
100	data:
101	SMTP_HOST: {{ .Values.sso.smtp.host }}
102
103	# 3. Add to Secret (sensitive)
104	stringData:
105	SMTP_PASS: {{ .Values.sso.smtp.password }}
106
107	# 4. Inject in Deployment
108	envFrom:
109	- configMapRef:
110	name: sso-config
111	env:
112	- name: SMTP_PASS
113	valueFrom:
114	secretKeyRef:
115	name: sso-secret
116	key: SMTP_PASS
117	```
118
119	---
120
121	### 3. Database Authentication Configuration
122
123	What to Check:
124	- Secret password matches database password
125	- Connection string format correct
126	- Authentication mode compatible with client libraries
127
128	Validation:
129	```bash
130	# Get password from Secret
131	SECRET_PASSWORD=$(kubectl get secret sso-postgres-secret -n taskflow -o jsonpath='{.data.POSTGRES_PASSWORD}' \| base64 -d 2>/dev/null \|\| echo "none")
132
133	# Test connection with Secret password
134	echo "Testing database connection with Secret password..."
135	PGPASSWORD="$SECRET_PASSWORD" psql -h localhost -p 5432 -U sso_user -d sso_db -c "SELECT 1;" 2>&1
136
137	# Check for auth errors
138	kubectl logs -n taskflow -l app.kubernetes.io/component=sso --tail=50 \| grep -i "password authentication failed"
139	```
140
141	Pass Criteria:
142	- ✅ Secret password works with psql
143	- ✅ Secret password works with application client (asyncpg/postgres.js)
144	- ✅ No "password authentication failed" errors in logs
145	- ✅ Connection string format correct for client library
146
147	Fail Indicators:
148	- ❌ psql works but application fails
149	- ❌ "password authentication failed" errors
150	- ❌ Secret password ≠ database password
151	- ❌ Connection string has URL-encoding issues
152
153	Fix:
154	```bash
155	# Reset database password to match Secret
156	PASSWORD=$(kubectl get secret sso-postgres-secret -n taskflow -o jsonpath='{.data.POSTGRES_PASSWORD}' \| base64 -d)
157	kubectl exec -n taskflow sso-postgres-0 -- sh -c "
158	PGPASSWORD='old_password' psql -U sso_user -d postgres -c \"ALTER USER sso_user WITH PASSWORD '$PASSWORD';\"
159	"
160
161	# Restart application pods
162	kube

People who liked this also viewed

6 picks

Type