Summarize Kubernetes manifests: every object by kind and namespace, workloads with replicas, images and ports, Services (type, ports, which workloads they select), Ingress routes, and host-network workloads. path is a YAML file (multi-document is fine, helm template output works) or a directory of them. Start here, then lint_manifests.

Lint Kubernetes manifests with rules K8S1001-K8S1040: missing resource requests/memory limit, :latest or untagged images (and tag-only pins as info), privileged / allowPrivilegeEscalation / root user / readOnlyRootFilesystem / capabilities, hostNetwork/hostPID/hostPath/docker.sock, missing probes, replicas 1, no PodDisruptionBudget or NetworkPolicy, default namespace, secrets as plain env values (name and length only, never the value), service account token, seccomp, imagePullPolicy, LoadBalancer/NodePort exposure, CronJob settings, and removed/deprecated apiVersions with the replacement and the release that dropped them. Each finding has a rule ID, severity, file:line and a concrete fix. Cross-object checks are in check_references, RBAC in rbac_review. Suppress with # kubelint-ignore: K8S1004 above a line. Nothing is applied to any cluster.

Cross-resource checks (K8S2001-K8S2017) among the provided files: Deployment selector that does not match its template labels (invalid), Service selector matching no pod, targetPort that no container declares, Ingress backend Service or port that does not exist, ConfigMap/Secret/PVC/ ServiceAccount referenced but not defined (info when it may live elsewhere), a key missing from a ConfigMap/Secret, HPA or PodDisruptionBudget pointing at nothing, StatefulSet serviceName, volumeMounts without a volume, RoleBinding to an undefined Role, and duplicate objects. Pass a directory to check a whole app. Only the files you pass are considered.

Review RBAC (K8S3001-K8S3011): wildcard verbs or resources, ClusterRoleBinding/RoleBinding to cluster-admin, read access to Secrets, escalate/bind/impersonate verbs, pods/exec, nodes/proxy, and bindings to the default ServiceAccount, system:anonymous, system:unauthenticated or system:authenticated. Also lists every Role/ClusterRole and which subjects each binding grants it to.

Explain one object in plain English: what it does, its effective security posture (user, privilege, filesystem, capabilities, host access, token, seccomp), what it depends on (ConfigMaps, Secrets, PVCs, service account, with whether each is defined in these files), what reaches it (Services, Ingress, HPA, PodDisruptionBudget, NetworkPolicy) and its lint findings. kind is e.g. Deployment, name its metadata.name; pass namespace if the name exists in several. Env values, ConfigMap/Secret data and command arguments are never printed.

Show a unified diff (as text, never written) of the safe mechanical fixes for ONE manifest file: privileged / hostNetwork / hostPID / hostIPC set to false, allowPrivilegeEscalation: false added or flipped, and apiVersion renames where only the version string changes (batch/v1beta1 CronJob -> batch/v1, policy/v1beta1 PodDisruptionBudget -> policy/v1, rbac v1beta1 -> v1, and similar). The patched text is re-parsed and re-linted in memory to confirm. Everything else is listed as needing a human decision.

Review a Helm values.yaml (K8S4001-K8S4007): :latest or untagged image defaults, resources left empty, credentials committed in values (key name and length only, value redacted), empty securityContext, Services exposed as LoadBalancer/NodePort by default, replicaCount 1, and insecure defaults like privileged or runAsUser 0. Reviews the inputs of a chart; use render_helm or helm template output with lint_manifests to review what a chart actually produces.

OPT-IN. Runs the local helm template (argument list, 60 s timeout, no cluster contact) on a chart directory and lints the rendered output in memory (it is not written anywhere). Refuses unless allow_exec=true, so set that only when the user asked to render a chart. Fails with a clear message when helm is not installed. values_file is an optional values YAML inside --dir.