Check and configure Skaffold for FVH standards
Validates and configures Skaffold for FVH Kubernetes development standards.
/plugin marketplace add laurigates/claude-plugins/plugin install configure-plugin@lgates-claude-plugins[--check-only] [--fix]configure/Check and configure Skaffold against FVH (Forum Virium Helsinki) standards.
This command validates Skaffold configuration for local Kubernetes development using OrbStack.
Skills referenced: fvh-skaffold, container-development, skaffold-orbstack
Applicability: Only for projects with Kubernetes deployment (k8s/, helm/ directories)
CRITICAL: Before configuring Skaffold, verify latest versions:
skaffold/v4beta13Use WebSearch or WebFetch to verify current Skaffold version and API version.
k8s/ or helm/ directoriesskaffold.yamlParse skaffold.yaml for:
Required Checks:
| Check | Standard | Severity |
|---|---|---|
| API version | skaffold/v4beta13 | WARN if older |
| local.push | false | FAIL if true |
| portForward.address | 127.0.0.1 | FAIL if missing/0.0.0.0 |
| useBuildkit | true | WARN if false |
| kubeContext | orbstack | INFO (recommended for local dev) |
| dotenvx hooks | Build or deploy hooks | INFO (recommended for secrets) |
Security-Critical:
127.0.0.1)0.0.0.0 or missing addressRecommended:
db-only or services-only profile for local dev workflowstatusCheck: true with reasonable deadline (180s for init containers)tolerateFailuresUntilDeadline: true for graceful pod initializationFVH Skaffold Compliance Report
==============================
Project Type: frontend (detected)
Skaffold: ./skaffold.yaml (found)
Configuration Checks:
API version v4beta13 ✅ PASS
local.push false ✅ PASS
useBuildkit true ✅ PASS
Port security 127.0.0.1 ✅ PASS
statusCheck true ✅ PASS
kubeContext orbstack ✅ PASS
dotenvx hooks build hooks ✅ PASS
JSON log parse enabled ✅ PASS
Profiles Found:
db-only ✅ Present
services-only ✅ Present
minimal ✅ Present
Scripts:
generate-secrets.sh ✅ Present (dotenvx integration)
Overall: Fully compliant
If --fix flag or user confirms:
db-only profile templatescripts/generate-secrets.sh templateorbstack for local developmentUpdate .fvh-standards.yaml:
components:
skaffold: "2025.1"
apiVersion: skaffold/v4beta13
kind: Config
metadata:
name: project-name-local
build:
local:
push: false
useDockerCLI: true
useBuildkit: true
concurrency: 0
# Generate secrets before building
hooks:
before:
- command: ['sh', '-c', 'dotenvx run -- sh scripts/generate-secrets.sh']
os: [darwin, linux]
artifacts:
- image: app
context: .
docker:
dockerfile: Dockerfile
# Optional: init container for database migrations
- image: app-db-init
context: .
docker:
dockerfile: Dockerfile.db-init
manifests:
rawYaml:
- k8s/namespace.yaml
- k8s/postgresql-secret.yaml
- k8s/postgresql-configmap.yaml
- k8s/postgresql-service.yaml
- k8s/postgresql-statefulset.yaml
- k8s/app-secrets.yaml
- k8s/app-deployment.yaml
- k8s/app-service.yaml
deploy:
kubeContext: orbstack # OrbStack for local development
kubectl:
defaultNamespace: project-name
# Optional: validation before deploy
hooks:
before:
- host:
command: ["sh", "-c", "echo 'Validating configuration...'"]
os: [darwin, linux]
statusCheck: true
# Extended timeout for init containers (db migrations, seeding)
statusCheckDeadlineSeconds: 180
# Don't fail immediately on pod restarts during initialization
tolerateFailuresUntilDeadline: true
# Parse JSON logs from applications for cleaner output
logs:
jsonParse:
fields: ["message", "level", "timestamp"]
portForward:
- resourceType: service
resourceName: postgresql
namespace: project-name
port: 5432
localPort: 5435
address: 127.0.0.1 # REQUIRED: localhost only
- resourceType: service
resourceName: app
namespace: project-name
port: 3000
localPort: 8080
address: 127.0.0.1 # REQUIRED: localhost only
profiles:
# Database only - for running app dev server locally
- name: db-only
build:
artifacts: []
manifests:
rawYaml:
- k8s/namespace.yaml
- k8s/postgresql-secret.yaml
- k8s/postgresql-configmap.yaml
- k8s/postgresql-service.yaml
- k8s/postgresql-statefulset.yaml
portForward:
- resourceType: service
resourceName: postgresql
namespace: project-name
port: 5432
localPort: 5435
address: 127.0.0.1
# Minimal - without optional features
- name: minimal
patches:
- op: replace
path: /manifests/rawYaml/4
value: k8s/postgresql-statefulset-minimal.yaml
FVH projects use dotenvx for encrypted secrets management in local development.
.env files contain encrypted valuesDOTENV_PRIVATE_KEY decrypts values at runtimedotenvx run -- script to inject secretsCreate scripts/generate-secrets.sh:
#!/bin/bash
# Generate Kubernetes secrets from .env using dotenvx
# Run with: dotenvx run -- sh scripts/generate-secrets.sh
set -euo pipefail
# Validate required env vars are set (decrypted by dotenvx)
: "${DATABASE_URL:?DATABASE_URL must be set}"
: "${SECRET_KEY:?SECRET_KEY must be set}"
# Generate app secrets manifest
cat > k8s/app-secrets.yaml << EOF
apiVersion: v1
kind: Secret
metadata:
name: app-secrets
namespace: project-name
type: Opaque
stringData:
DATABASE_URL: "${DATABASE_URL}"
SECRET_KEY: "${SECRET_KEY}"
EOF
echo "Generated k8s/app-secrets.yaml"
# Install dotenvx
curl -sfS https://dotenvx.sh | sh
# Create encrypted .env (first time)
dotenvx set DATABASE_URL "postgresql://..."
dotenvx set SECRET_KEY "..."
# Encrypt existing .env
dotenvx encrypt
# Store private key securely (NOT in git)
echo "DOTENV_PRIVATE_KEY=..." >> ~/.zshrc
Build hook (runs before building images):
build:
hooks:
before:
- command: ['sh', '-c', 'dotenvx run -- sh scripts/generate-secrets.sh']
os: [darwin, linux]
Deploy hook (runs before applying manifests):
deploy:
kubectl:
hooks:
before:
- host:
command: ["sh", "-c", "dotenvx run -- sh scripts/generate-secrets.sh"]
| Flag | Description |
|---|---|
--check-only | Report status without offering fixes |
--fix | Apply fixes automatically |
Port forwarding without address: 127.0.0.1 exposes services to the network.
This is a FAIL condition that should always be fixed.
/configure:dockerfile - Container configuration/configure:all - Run all FVH compliance checksfvh-skaffold skill - Skaffold patterns