What problem does it solve? Kubernetes workloads running on public Docker Hub images carry large CVE counts and often fail restricted security policies. This Skill guides AI agents through migrating raw manifests, Helm charts, and Kustomize overlays onto hardened Minimus distroless images from reg.mini.dev, handling the port, securityContext, probe, and shell-compatibility changes that a naive image swap breaks. ## Core Features & Use Cases - Full image inventory and resolution: Enumerates every container, initContainer, and subchart image, then resolves each to its Minimus equivalent via the public images.minimus.io gallery with correct version-line and tag selection. - Pod spec adaptation: Aligns securityContext with the image's User, rewrites ports (e.g. nginx 80 to 8080), replaces shell-based probes and command wrappers with direct exec or httpGet, and configures the minimus-registry pull secret. - Asset-type-aware migration and verification: Applies minimal diffs for raw manifests, values-only overrides for third-party Helm charts (including Bitnami's allowInsecureImages gate), the images transformer for Kustomize, then verifies with helm template, kustomize build, throwaway kind/minikube dry-runs, and docker manifest inspect. - Use Case: Ask the agent to migrate a Helm release off bitnami/nginx — it overrides image registry/repository/tag in values, updates the Service targetPort to 8080, swaps the exec probe for httpGet, adds the pull secret, and renders the chart to prove every image reference points at reg.mini.dev. ## Quick Start Migrate my Kubernetes deployment manifests to use Minimus hardened images and verify the result.
