Overview
Produces complete, production-grade Kubernetes manifests (Deployment, Service, Ingress, ConfigMap, Secret, HorizontalPodAutoscaler, PodDisruptionBudget) with proper resource requests/limits, liveness/readiness probes, rolling update strategy, securityContext (non-root), and a basic Helm chart structure or Kustomize overlay for environment-specific configuration.
When to Use This Skill
- Deploying a containerized app to Kubernetes for the first time or improving an existing deployment.
- User mentions "Kubernetes", "k8s", "deploy to cluster", "EKS", "GKE", "AKS", or "Helm".
Prerequisites
- A container image (built and pushed to a registry).
- Access to a Kubernetes cluster (kubectl configured).
- Domain and TLS certificate management (cert-manager recommended).
Steps
Core objects:
- Deployment with replicas, strategy (RollingUpdate), resources, probes, securityContext.
- Service (ClusterIP or LoadBalancer).
- Ingress (with TLS).
Configuration:
- ConfigMap for non-sensitive config.
- Secret for sensitive data (or external-secrets operator).
Autoscaling & resilience:
- HorizontalPodAutoscaler (CPU + memory or custom metrics).
- PodDisruptionBudget.
- Pod anti-affinity for high availability.
Probes:
- livenessProbe (restart if unhealthy).
- readinessProbe (remove from service if not ready).
- startupProbe for slow-starting apps.
Security:
- Run as non-root user.
- Read-only root filesystem where possible.
- Drop all capabilities.
- NetworkPolicy (deny all by default, allow only needed).
Output:
- All YAML manifests in a
k8s/ or manifests/ folder.
- Basic
values.yaml for Helm if appropriate.
kubectl apply order and commands.- Verification steps (
kubectl get, port-forward, logs).
Examples
Full set of manifests for a typical web app (Deployment + Service + Ingress + HPA + ConfigMap + Secret example) with comments and a simple Helm chart skeleton are included.
Edge Cases & Error Handling
- Image pull secrets: For private registries.
- Zero-downtime deploys: Use maxSurge/maxUnavailable and proper probes.
- Stateful apps: Recommend StatefulSet + persistent volumes instead of Deployment.
Verification
kubectl apply -f k8s/ succeeds.kubectl get pods — all Running and Ready.kubectl get hpa — scaling works when load is applied.- App is reachable via Ingress.
- Rolling update completes without downtime.
- Success: App runs reliably, scales, self-heals, and follows security best practices.
References
1---2name: kubernetes-deployment3description: Creates Kubernetes manifests for deploying containerized applications with scaling, health checks, and resource limits. Use when deploying to any Kubernetes cluster (GKE, EKS, AKS, local).4license: Apache-2.05---67## Overview89Produces complete, production-grade Kubernetes manifests (Deployment, Service, Ingress, ConfigMap, Secret, HorizontalPodAutoscaler, PodDisruptionBudget) with proper resource requests/limits, liveness/readiness probes, rolling update strategy, securityContext (non-root), and a basic Helm chart structure or Kustomize overlay for environment-specific configuration.1011## When to Use This Skill1213- Deploying a containerized app to Kubernetes for the first time or improving an existing deployment.14- User mentions "Kubernetes", "k8s", "deploy to cluster", "EKS", "GKE", "AKS", or "Helm".1516## Prerequisites1718- A container image (built and pushed to a registry).19- Access to a Kubernetes cluster (kubectl configured).20- Domain and TLS certificate management (cert-manager recommended).2122## Steps23241. **Core objects**:25 - Deployment with replicas, strategy (RollingUpdate), resources, probes, securityContext.26 - Service (ClusterIP or LoadBalancer).27 - Ingress (with TLS).28292. **Configuration**:30 - ConfigMap for non-sensitive config.31 - Secret for sensitive data (or external-secrets operator).32333. **Autoscaling & resilience**:34 - HorizontalPodAutoscaler (CPU + memory or custom metrics).35 - PodDisruptionBudget.36 - Pod anti-affinity for high availability.37384. **Probes**:39 - livenessProbe (restart if unhealthy).40 - readinessProbe (remove from service if not ready).41 - startupProbe for slow-starting apps.42435. **Security**:44 - Run as non-root user.45 - Read-only root filesystem where possible.46 - Drop all capabilities.47 - NetworkPolicy (deny all by default, allow only needed).48496. **Output**:50 - All YAML manifests in a `k8s/` or `manifests/` folder.51 - Basic `values.yaml` for Helm if appropriate.52 - `kubectl apply` order and commands.53 - Verification steps (`kubectl get`, port-forward, logs).5455## Examples5657Full set of manifests for a typical web app (Deployment + Service + Ingress + HPA + ConfigMap + Secret example) with comments and a simple Helm chart skeleton are included.5859## Edge Cases & Error Handling6061- **Image pull secrets**: For private registries.62- **Zero-downtime deploys**: Use maxSurge/maxUnavailable and proper probes.63- **Stateful apps**: Recommend StatefulSet + persistent volumes instead of Deployment.6465## Verification66671. `kubectl apply -f k8s/` succeeds.682. `kubectl get pods` — all Running and Ready.693. `kubectl get hpa` — scaling works when load is applied.704. App is reachable via Ingress.715. Rolling update completes without downtime.726. Success: App runs reliably, scales, self-heals, and follows security best practices.7374## References7576- [Kubernetes Documentation](https://kubernetes.io/docs/)77- [Kubernetes Best Practices (book)](https://www.oreilly.com/library/view/kubernetes-best-practices/9781492056461/)78- [cert-manager](https://cert-manager.io/)79- [Helm](https://helm.sh/)
Nikoxkx