DevOps & Tooling · Claude Code (via permissions.deny)
Kubernetes & Helm Charts .claudeignore
A .claudeignore for Kubernetes & Helm Charts: the paths Claude Code should stay out of, with matching permissions.deny rules.
- Path
- .claudeignore
- Loads
- Pattern list
- Format
- gitignore syntax
- Used by
- Claude Code (via permissions.deny)
What this file tells the agent
Claude Code reads files while it works. This .claudeignore keeps the list of Kubernetes & Helm Charts paths it should stay out of (build output, large binaries, logs and secrets). Copy the sensitive ones into permissions.deny in .claude/settings.json, which Claude Code enforces.
- Always specify explicit resources.requests and resources.limits (both CPU and memory) on every container.
- Enforce strict security contexts: readOnlyRootFilesystem: true, runAsNonRoot: true, and allowPrivilegeEscalation: false.
- Mandate both livenessProbe and readinessProbe with appropriate initialDelaySeconds on deployment workloads.
- Validate Helm template indentation using nindent filters (e.g. toYaml . | nindent 8) to eliminate YAML formatting corruption.
- Configure PodDisruptionBudgets (PDB) and topology spread constraints for multi-node high availability.
Code to avoid, and what to write instead
The rule steers the agent away from the left and toward the right.
# Dangerous: No resource constraints, root container, missing probes
apiVersion: apps/v1
kind: Deployment
metadata:
name: bad-service
spec:
template:
spec:
containers:
- name: app
image: myapp:latest # Mutable tag and unconstrained limits!apiVersion: apps/v1
kind: Deployment
metadata:
name: api-service
labels:
app.kubernetes.io/name: api-service
spec:
replicas: 3
template:
spec:
securityContext:
runAsNonRoot: true
runAsUser: 10001
containers:
- name: api
image: registry.example.com/api:v1.4.0
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 500m
memory: 512Mi
readinessProbe:
httpGet:
path: /healthz
port: 8080
initialDelaySeconds: 5Install it in one command
- 01
Go to your project root
The file goes at .claudeignore, relative to the root.
- 02
Download the file
Run the command on the right. It downloads this preset and writes the file.
- 03
Make sure it gets used
Claude Code does not enforce .claudeignore by itself. Copy the sensitive paths into permissions.deny in .claude/settings.json, which it does enforce.
$ curl -fsSL "https://www.devscratchpad.tech/api/raw/claudeignore/kubernetes-helm" -o ".claudeignore"
writes .claudeignore
.claudeignore
To write the file from your own code instead, use Read your code or Convert Legacy Rules in the editor above.
More for Kubernetes & Helm Charts
Questions
- Does Claude Code honor .claudeignore?
- Not by itself. Claude Code enforces permission rules, so copy the sensitive paths into permissions.deny in .claude/settings.json, for example Read(./.env). Keep .claudeignore in the repository root as the reviewable list.
- What should I put in .claudeignore?
- Exclude large build caches, minified bundles, lockfiles, and environment files containing sensitive credentials.