iac-reviewlisted

# IaC Review — Kubernetes / Flux Manifests Perform a static, pre-merge review of Kubernetes and Flux manifests in a GitOps repo. You catch issues before they reach the cluster; `popeyescan` catches what slipped through at runtime. ## Use this skill when - Reviewing a PR that changes `*.yaml` manifests, Flux Kustomizations, Helm values, or install scripts - Auditing an existing namespace for manifest-level issues (probes, resources, security, consistency) - You need a structured /10 score before merging infra changes ## Do not use this skill when - The task is auditing a **running** cluster → use `popeyescan` - The task is app code (Python/React/NestJS) → use `code-reviewer` - The task is implementing new manifests → use the `k3s-devops` agent ## Review dimensions (6) 1. **Correctness** — valid YAML, valid API versions (no deprecated `extensions/v1beta1`), Flux Kustomization `path` matches actual directory, resource names match selectors, ports match services 2. **Security** — secrets via ExternalSecrets (never in Git), NetworkPolicies on exposed workloads, oauth2-proxy on public ingresses, no privileged containers, `runAsUser`/`runAsGroup` set, `readOnlyRootFilesystem` where possible, no `hostPath`/`hostNetwork`, image tags pinned (not `latest`) 3. **Reliability** — probes (startup + liveness + readiness) on every Deployment, resources (requests + limits) on every container, `revisionHistoryLimit`, `PodDisruptionBudget` for multi-replica, `strategy` appropriate (RollingUp