# Kubernetes

> Use when editing tracked AKS, Kubernetes, Helm, Kustomize, or generated GitOps manifests.

- Skill: `paulasilvatech/kubernetes` (Agent Skill)
- Install (CLI): `npx skillmds@latest add paulasilvatech/kubernetes`
- Raw SKILL.md: https://api.skillmd.com/api/skills/paulasilvatech/kubernetes/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: paulasilvatech (https://skillmd.com/u/paulasilvatech)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/paulasilvatech/kubernetes

---


<!-- Generated from harness/github-copilot/plugins/open-horizons-platform/instructions/kubernetes.instructions.md by harness/claude-code/scripts/convert_from_copilot.py. Edit the source, not this file. -->

# Kubernetes and Helm

## Conventions

- Use explicit versioned image tags; never use `latest`.
- Apply standard `app.kubernetes.io/*` labels consistently to workloads, services, selectors, monitoring, and policy targets.
- Set realistic resource requests and limits plus startup, readiness, and liveness probes that match the service contract.
- Run as non-root, disallow privilege escalation, drop capabilities, use `RuntimeDefault` seccomp, and prefer a read-only root filesystem.
- Use dedicated service accounts, namespace-scoped RBAC, Workload Identity, and least-privilege network policies.
- Reference secrets through External Secrets or approved Key Vault integration; never commit a Kubernetes Secret value.
- Keep namespaces, selectors, ports, service names, and Helm value keys consistent across related manifests.
- Keep generated GitOps examples under `scripts/golden-paths/`; no root `argocd/` path is assumed.
- Preserve rollout safety with disruption budgets, topology constraints, and graceful termination where availability requires them.

## Verification

- YAML, Helm, and Kustomize rendering produce valid resources with no unresolved tokens.
- Policy checks cover tags, resources, non-root execution, privilege, and registry restrictions.
- Rendered workloads have immutable images, probes, resources, identity, and secret references.

## Do / Do Not

| Do | Do not |
| --- | --- |
| Render manifests and enforce identity, resources, probes, and policy controls. | Apply unrendered files or weaken controls to make a deployment pass. |
| Use immutable images and external secret references. | Use floating tags or commit secret values. |

## Checklist Before Opening a PR

- [ ] The change matches this instruction's `applyTo` scope.
- [ ] YAML, Helm, and Kustomize rendering pass without unresolved tokens.
- [ ] Policy checks cover identity, privilege, network, resources, and registry rules.
- [ ] Workloads use immutable images, probes, and external secret references.
- [ ] No unrelated edits or unresolved placeholders remain.