# K8S > Kubernetes and container orchestration skill. Helm charts, deployment strategies (rolling, canary, blue-green), pod health, resource limits, scaling. Triggers on: /godmode:k8s, "deploy to kubernetes", "helm chart", "pod crashing", "OOMKilled". - Skill: `arbazkhan971/k8s` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add arbazkhan971/k8s` - Raw SKILL.md: https://api.skillmd.com/api/skills/arbazkhan971/k8s/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: arbazkhan971 (https://skillmd.com/u/arbazkhan971) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/arbazkhan971/k8s --- # K8s — Kubernetes & Container Orchestration ## Activate When - User invokes `/godmode:k8s` - User says "deploy to kubernetes", "create helm chart" - User says "pod crashing", "OOMKilled", "CrashLoopBackOff" - Application is containerized and needs manifests ## Workflow ### Step 1: Discover Kubernetes Context ```bash # Gather cluster info kubectl cluster-info kubectl get deployments,services,ingresses \ -n helm list -n # Check resource usage kubectl top pods -n kubectl top nodes ``` ``` KUBERNETES CONTEXT: Cluster: , Context: Namespace: , Registry: Workloads: Deployments, StatefulSets Services: , Ingresses: Helm releases: IF no cluster: generate manifests for local (minikube) IF no namespace: create with resource quotas IF no Helm: use raw manifests for simple apps ``` ### Step 2: Generate or Validate Manifests ```bash # Dry-run validation kubectl apply --dry-run=server -f manifests/ # Lint with kubeval kubeval manifests/*.yaml --strict # Security scan kubesec scan manifests/deployment.yaml ``` ### Step 3: Helm Chart (if needed) ``` CHART STRUCTURE: / Chart.yaml, values.yaml, values-{env}.yaml templates/ deployment.yaml, service.yaml, ingress.yaml, hpa.yaml, pdb.yaml, configmap.yaml, secret.yaml ``` ```bash helm lint helm template -f values-prod.yaml ``` ### Step 4: Deployment Strategy ``` | Strategy | When to Use | Rollback | |-------------|------------------------|-----------| | Rolling | Standard, backward-compat| Automatic| | Canary | High-risk changes | Auto at % | | Blue-Green | Need instant rollback | Instant | ROLLING UPDATE CONFIG: maxSurge: 25% maxUnavailable: 0 (zero downtime) CANARY RAMP: 5% → 20% → 50% → 80% → 100% Gate: error rate < baseline + 0.5% Gate: p95 latency < baseline + 10% THRESHOLDS: IF error rate > 5% at any stage: auto-rollback IF p95 latency > 2x baseline: auto-rollback IF high-risk change: always use canary ``` ### Step 5: Pod Health & Resources ``` RESOURCE SIZING: | Metric | Recommended | |-----------|--------------------------| | CPU req | P95 usage + 20% buffer | | CPU limit | 2x request (allow burst) | | Mem req | P95 usage + 20% buffer | | Mem limit | Peak + GC overhead | | Pod count | min 2 for HA | RULES: Never set CPU limit == request (causes throttling) Memory limit must accommodate GC overhead Requests = P95 + 20%, Limits = 2x requests PROBE CONFIG: Liveness: detect deadlocked processes path: /healthz, period: 10s, threshold: 3 Readiness: gate traffic to healthy pods path: /ready, period: 5s, threshold: 1 Startup: slow-starting containers period: 5s, failureThreshold: 30 (= 150s max) HPA: Min replicas: 2 (HA), Max: based on budget CPU target: 70%, scale up if exceeded Scale-down stabilization: 300s (prevent flapping) ``` ### Step 6: Troubleshooting ```bash # Quick diagnostics kubectl describe pod -n kubectl logs -n --previous kubectl top pods -n kubectl get events -n --sort-by='.lastTimestamp' ``` ``` | Symptom | First Check | |-------------------|--------------------------| | CrashLoopBackOff | logs --previous, probes | | OOMKilled | increase memory limit | | ImagePullBackOff | image name, credentials | | Pending | resources, affinity | | Evicted | disk pressure, quotas | | 502/503 | readiness probe, backend | ``` ### Step 7: Deploy & Verify ```bash helm upgrade --install \ -f values-.yaml -n \ --wait --timeout 5m # Verify kubectl rollout status deployment/ -n kubectl get pods -n ``` ``` DEPLOYMENT RESULT: in : 3/3 Ready Health: liveness OK, readiness OK No error logs in last 60 seconds ``` Commit: `"k8s: — ( replicas)"` ## Key Behaviors Never ask to continue. Loop autonomously until done. 1. **Resource requests+limits mandatory.** 2. **Health probes mandatory.** 3. **PDB required for production.** 4. **Never `latest` tag.** Pin SHA or semver. 5. **Namespace isolation** with quotas. 6. **Secrets not ConfigMaps** for sensitive data. 7. **Dry-run before apply.** 8. **Canary for high-risk changes.** ## HARD RULES 1. Never deploy without resource requests AND limits. 2. Never skip health probes. 3. Never use `latest` tag — pin SHA or semver. 4. Never put secrets in ConfigMaps. 5. Never set CPU limits == requests. 6. Never run as root — runAsNonRoot: true. 7. Always validate in dev/staging first. 8. Always create PDB for production. 9. Always validate: --dry-run=server, kubeval. 10. Always use namespaces with resource quotas. ## Auto-Detection ``` 1. kubectl context, cluster-info 2. Manifests: k8s/, manifests/, deploy/ 3. Helm: charts/, Chart.yaml, values*.yaml 4. App: Dockerfile, docker-compose.yml ``` ## Output Format Print: `K8s: {resources} resources. Health: {status}. Scaling: {min}-{max}. Verdict: {verdict}.` ## TSV Logging ``` iteration namespace resources health security status ``` ## Keep/Discard Discipline ``` KEEP if: validation passes AND pods Ready AND no error logs in 60s DISCARD if: validation fails OR pods crash OR readiness probe fails Rollback: helm rollback or kubectl rollout undo ``` ## Stop Conditions ``` STOP when ANY of: - All pods Ready, passing probes - Deployment strategy configured and tested - User requests stop - Rollback triggered (investigate first) ``` ## Error Recovery - CrashLoopBackOff: check logs --previous, probes. - Pending: kubectl describe for scheduling failures. - ImagePullBackOff: verify image, imagePullSecrets. - 503: check endpoints, readiness, selector match. - HPA not scaling: verify metrics-server installed.