Explain a Kubernetes Resource
Use this skill when the user points at a manifest or resource name and wants to
understand what it does and how it fits together.
Workflow
1. Get the resource
Prefer the live object with -o yaml so output reflects reality, and cross-check
against the source manifest when both exist:
kubectl get <kind> <name> -n <ns> -o yaml
Kinds to cover: deploy, sts, ds, svc, ingress, configmap, secret,
pvc, networkpolicy, serviceaccount, role/rolebinding (namespaced) and
their cluster-scoped counterparts (clusterrole, clusterrolebinding, ns).
2. Explain the spec section by section
For a workload:
spec.replicas + spec.strategy (Recreate vs RollingUpdate).
spec.selector and template.metadata.labels — the label wiring that
connects workloads to Services.
spec.template.spec — containers, images, ports, resources (requests/limits),
probes (livenessProbe, readinessProbe, startupProbe), env and
envFrom (ConfigMap/Secret references), volumes and mounts, securityContext.
For a Service/Ingress:
type (ClusterIP/NodePort/LoadBalancer) and ports — how traffic maps to
targetPort.
spec.selector — which pods the Service routes to.
- Ingress host/path → service/port routing.
3. Trace the wiring
Answer concretely:
- Which pods does this Service select? (
kubectl get endpoints <svc> -n <ns>)
- Which ConfigMap/Secret does the workload consume?
- Does the Deployment's image tag match what is running?
- Are there
readinessProbe failures keeping pods out of the Service?
4. Report
Give a compact explanation: what the object is for, its key spec fields, and how
it connects to its neighbors. Call out anything that looks wrong (mismatched
selectors, missing probes, missing resources, latest tags) as observations,
not fixes.
Guardrails
- Read-only (
get/describe). No kubectl apply, edit, or delete unless
the user explicitly asks to change the cluster.
- Do not dump full Secret values into responses.
1---2name: explain-kubernetes-resource3description: Explain what a Kubernetes resource does, how its spec maps to runtime objects, and how workloads relate (Deployments, Services, Ingress, ConfigMaps, Secrets, PVCs). Use when the user asks what a YAML manifest means, what a resource does, or how objects connect.4---56# Explain a Kubernetes Resource78Use this skill when the user points at a manifest or resource name and wants to9understand what it does and how it fits together.1011## Workflow1213### 1. Get the resource1415Prefer the live object with `-o yaml` so output reflects reality, and cross-check16against the source manifest when both exist:1718```bash19kubectl get <kind> <name> -n <ns> -o yaml20```2122Kinds to cover: `deploy`, `sts`, `ds`, `svc`, `ingress`, `configmap`, `secret`,23`pvc`, `networkpolicy`, `serviceaccount`, `role`/`rolebinding` (namespaced) and24their cluster-scoped counterparts (`clusterrole`, `clusterrolebinding`, `ns`).2526### 2. Explain the spec section by section2728For a workload:2930- `spec.replicas` + `spec.strategy` (Recreate vs RollingUpdate).31- `spec.selector` and `template.metadata.labels` — the label wiring that32 connects workloads to Services.33- `spec.template.spec` — containers, images, ports, resources (requests/limits),34 probes (`livenessProbe`, `readinessProbe`, `startupProbe`), env and35 `envFrom` (ConfigMap/Secret references), volumes and mounts, `securityContext`.3637For a Service/Ingress:3839- `type` (ClusterIP/NodePort/LoadBalancer) and `ports` — how traffic maps to40 targetPort.41- `spec.selector` — which pods the Service routes to.42- Ingress host/path → service/port routing.4344### 3. Trace the wiring4546Answer concretely:4748- Which pods does this Service select? (`kubectl get endpoints <svc> -n <ns>`)49- Which ConfigMap/Secret does the workload consume?50- Does the Deployment's image tag match what is running?51- Are there `readinessProbe` failures keeping pods out of the Service?5253### 4. Report5455Give a compact explanation: what the object is for, its key spec fields, and how56it connects to its neighbors. Call out anything that looks wrong (mismatched57selectors, missing probes, missing resources, `latest` tags) as observations,58not fixes.5960## Guardrails6162- Read-only (`get`/`describe`). No `kubectl apply`, `edit`, or `delete` unless63 the user explicitly asks to change the cluster.64- Do not dump full Secret values into responses.65