AI Skill StudioAI Skill Studio
Skill Library
Presets:

Target Standard & File Format

AI Agent Rules & Skills
Context Shields & Privacy (Ignore Files)
Integrations & Machine Documentation
AI Governance & Multi-Agent Planning Suite

.claudeignore Shield

Define boundary exclusions for Claude Code CLI to guard credentials and reduce prompt bloat:

Full Protection
Tokens Saved / Turn
~190k tokens
Secret Leak Guards
2 Active Guards
Shield Categories
8 of 8 Enabled

Indexing Boundary Categories

Toggle specific categories to mask secrets and exclude heavy artifacts:

Custom Rules & Negate Exceptions

Append repo-specific file globs or re-include allowed files with negation patterns (!path):

DevOps & Tooling · Claude Code (via permissions.deny)

Kubernetes & Helm Charts .claudeignore

A .claudeignore for Kubernetes & Helm Charts: the paths Claude Code should stay out of, with matching permissions.deny rules.

Path
.claudeignore
Loads
Pattern list
Format
gitignore syntax
Used by
Claude Code (via permissions.deny)
All .claudeignore presets and how .claudeignore works

What this file tells the agent

Claude Code reads files while it works. This .claudeignore keeps the list of Kubernetes & Helm Charts paths it should stay out of (build output, large binaries, logs and secrets). Copy the sensitive ones into permissions.deny in .claude/settings.json, which Claude Code enforces.

  • Always specify explicit resources.requests and resources.limits (both CPU and memory) on every container.
  • Enforce strict security contexts: readOnlyRootFilesystem: true, runAsNonRoot: true, and allowPrivilegeEscalation: false.
  • Mandate both livenessProbe and readinessProbe with appropriate initialDelaySeconds on deployment workloads.
  • Validate Helm template indentation using nindent filters (e.g. toYaml . | nindent 8) to eliminate YAML formatting corruption.
  • Configure PodDisruptionBudgets (PDB) and topology spread constraints for multi-node high availability.

Code to avoid, and what to write instead

The rule steers the agent away from the left and toward the right.

avoid
# Dangerous: No resource constraints, root container, missing probes
apiVersion: apps/v1
kind: Deployment
metadata:
  name: bad-service
spec:
  template:
    spec:
      containers:
        - name: app
          image: myapp:latest # Mutable tag and unconstrained limits!
write instead
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-service
  labels:
    app.kubernetes.io/name: api-service
spec:
  replicas: 3
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
      containers:
        - name: api
          image: registry.example.com/api:v1.4.0
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          readinessProbe:
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 5

Install it in one command

  1. 01

    Go to your project root

    The file goes at .claudeignore, relative to the root.

  2. 02

    Download the file

    Run the command on the right. It downloads this preset and writes the file.

  3. 03

    Make sure it gets used

    Claude Code does not enforce .claudeignore by itself. Copy the sensitive paths into permissions.deny in .claude/settings.json, which it does enforce.

$ curl -fsSL "https://www.devscratchpad.tech/api/raw/claudeignore/kubernetes-helm" -o ".claudeignore"

writes .claudeignore

path

.claudeignore

To write the file from your own code instead, use Read your code or Convert Legacy Rules in the editor above.

Questions

Does Claude Code honor .claudeignore?
Not by itself. Claude Code enforces permission rules, so copy the sensitive paths into permissions.deny in .claude/settings.json, for example Read(./.env). Keep .claudeignore in the repository root as the reviewable list.
What should I put in .claudeignore?
Exclude large build caches, minified bundles, lockfiles, and environment files containing sensitive credentials.