Kubernetes Skill
Kubernetes debugging, security hardening, and infrastructure tooling. Covers pod triage, RBAC, network policies, and cobaltcore hypervisor components.
Reference Loading Table
| Signal |
Reference |
Size |
| CrashLoopBackOff, OOMKilled, config error, health check, liveness probe, ImagePullBackOff, Pending, FailedScheduling |
references/crash-diagnosis.md |
~140 lines |
| service resolution, DNS, CoreDNS, port-forward, NetworkPolicy ingress/egress |
references/network-debugging.md |
~50 lines |
| CPU throttling, memory limit, OOMKill, ephemeral storage, DiskPressure, debug container |
references/resource-debugging.md |
~100 lines |
| RBAC, Role, RoleBinding, ClusterRole, ServiceAccount, least-privilege |
references/rbac-patterns.md |
~60 lines |
| PodSecurity, SecurityContext, runAsNonRoot, readOnlyRootFilesystem, restricted, baseline |
references/pod-security.md |
~90 lines |
| NetworkPolicy, default-deny, allow-list, namespace isolation |
references/network-policies.md |
~70 lines |
| cosign, Kyverno, OPA, admission controller, Sealed Secrets, External Secrets |
references/supply-chain.md |
~120 lines |
| kvm-exporter, metrics, prometheus, libvirt, hypervisor, collector, scrape, steal time, NUMA, cgroups, cloud hypervisor |
references/cobalt-kvm-exporter.md |
~800 lines |
| cobaltcore concurrency, goroutine, semaphore, TryLock |
references/cobalt-concurrency-patterns.md |
~200 lines |
| cobaltcore testing, mock, moq, Kind cluster |
references/cobalt-testing-patterns.md |
~200 lines |
| kubernetes debugging process, triage flow, diagnosis routing |
references/kubernetes-debugging.md |
~50 lines |
| kubernetes security process, RBAC + pod security + network hardening |
references/kubernetes-security.md |
~50 lines |
| cobaltcore overview, KVM exporter architecture, component identification |
references/cobalt-core.md |
~50 lines |
Loading rule. Read the references whose signals match the task before responding.
Phase 1: TRIAGE
Determine which Kubernetes domain the request targets:
| Domain |
Load references |
Action |
| Pod failure, CrashLoop, OOM |
crash-diagnosis, resource-debugging |
Triage flow |
| Network, DNS, service resolution |
network-debugging, network-policies |
Connectivity diagnosis |
| RBAC, permissions, roles |
rbac-patterns |
Access control |
| Pod hardening, container security |
pod-security |
Security posture |
| Image signing, secrets, admission |
supply-chain |
Supply chain |
| Cobaltcore / KVM exporter |
kvm-exporter + cobalt refs |
Component-specific |
Always specify -n <namespace> explicitly in every kubectl command.
Gate: Domain identified and relevant references loaded.
Phase 2: DIAGNOSE / RESPOND
For debugging: follow the triage flow — describe, logs, events, exec. Use read-only commands to gather evidence before proposing changes.
For security: provide concrete YAML manifests and specific configurations. Answer with reference-backed specifics, not generic advice.
For cobaltcore: use component-specific reference knowledge for architecture, metrics, configuration, and deployment details.
Gate: Specific, reference-backed diagnosis or response provided.
Phase 3: VERIFY
For debugging: confirm the fix resolves the symptom.
For security: validate against the misconfiguration table in supply-chain.md.
For cobaltcore: verify against component test patterns.
1---2name: kubernetes3description: "Kubernetes operations: debugging, security, RBAC, and infrastructure tooling."4user-invocable: false5context: fork6agent: kubernetes-helm-engineer7routing:8 triggers:9 # from kubernetes-debugging10 - "kubernetes debug"11 - "pod failure"12 - "pod crashloop"13 - "kubectl logs"14 - "OOMKilled"15 - "pod pending"16 # from kubernetes-security17 - "kubernetes security"18 - "k8s RBAC"19 - "RBAC setup"20 - "pod security policy"21 - "network policy"22 # from cobalt-core23 - "cobalt core"24 - "cobaltcore"25 - "kvm-exporter"26 - "kvm exporter"27 - "hypervisor metrics"28 - "libvirt exporter"29 - "cloud hypervisor"30 category: kubernetes31 pairs_with:32 - service-health-check33 - go-patterns34 - prometheus-grafana-engineer35---3637# Kubernetes Skill3839Kubernetes debugging, security hardening, and infrastructure tooling. Covers pod triage, RBAC, network policies, and cobaltcore hypervisor components.4041## Reference Loading Table4243| Signal | Reference | Size |44|--------|-----------|------|45| CrashLoopBackOff, OOMKilled, config error, health check, liveness probe, ImagePullBackOff, Pending, FailedScheduling | `references/crash-diagnosis.md` | ~140 lines |46| service resolution, DNS, CoreDNS, port-forward, NetworkPolicy ingress/egress | `references/network-debugging.md` | ~50 lines |47| CPU throttling, memory limit, OOMKill, ephemeral storage, DiskPressure, debug container | `references/resource-debugging.md` | ~100 lines |48| RBAC, Role, RoleBinding, ClusterRole, ServiceAccount, least-privilege | `references/rbac-patterns.md` | ~60 lines |49| PodSecurity, SecurityContext, runAsNonRoot, readOnlyRootFilesystem, restricted, baseline | `references/pod-security.md` | ~90 lines |50| NetworkPolicy, default-deny, allow-list, namespace isolation | `references/network-policies.md` | ~70 lines |51| cosign, Kyverno, OPA, admission controller, Sealed Secrets, External Secrets | `references/supply-chain.md` | ~120 lines |52| kvm-exporter, metrics, prometheus, libvirt, hypervisor, collector, scrape, steal time, NUMA, cgroups, cloud hypervisor | `references/cobalt-kvm-exporter.md` | ~800 lines |53| cobaltcore concurrency, goroutine, semaphore, TryLock | `references/cobalt-concurrency-patterns.md` | ~200 lines |54| cobaltcore testing, mock, moq, Kind cluster | `references/cobalt-testing-patterns.md` | ~200 lines |55| kubernetes debugging process, triage flow, diagnosis routing | `references/kubernetes-debugging.md` | ~50 lines |56| kubernetes security process, RBAC + pod security + network hardening | `references/kubernetes-security.md` | ~50 lines |57| cobaltcore overview, KVM exporter architecture, component identification | `references/cobalt-core.md` | ~50 lines |5859**Loading rule.** Read the references whose signals match the task before responding.6061---6263## Phase 1: TRIAGE6465Determine which Kubernetes domain the request targets:6667| Domain | Load references | Action |68|--------|----------------|--------|69| Pod failure, CrashLoop, OOM | crash-diagnosis, resource-debugging | Triage flow |70| Network, DNS, service resolution | network-debugging, network-policies | Connectivity diagnosis |71| RBAC, permissions, roles | rbac-patterns | Access control |72| Pod hardening, container security | pod-security | Security posture |73| Image signing, secrets, admission | supply-chain | Supply chain |74| Cobaltcore / KVM exporter | kvm-exporter + cobalt refs | Component-specific |7576Always specify `-n <namespace>` explicitly in every kubectl command.7778**Gate**: Domain identified and relevant references loaded.7980---8182## Phase 2: DIAGNOSE / RESPOND8384For debugging: follow the triage flow — describe, logs, events, exec. Use read-only commands to gather evidence before proposing changes.8586For security: provide concrete YAML manifests and specific configurations. Answer with reference-backed specifics, not generic advice.8788For cobaltcore: use component-specific reference knowledge for architecture, metrics, configuration, and deployment details.8990**Gate**: Specific, reference-backed diagnosis or response provided.9192---9394## Phase 3: VERIFY9596For debugging: confirm the fix resolves the symptom.97For security: validate against the misconfiguration table in supply-chain.md.98For cobaltcore: verify against component test patterns.
notque