# Devops K8S Orchestration

> Design and configure Kubernetes orchestration — cluster architecture, deployment strategies, service mesh, observability, auto-scaling, security policies — with reproducible infrastructure.

- Skill: `quantumquirkxyz/devops-k8s-orchestration` (Agent Skill)
- Install (CLI): `npx skillmds@latest add quantumquirkxyz/devops-k8s-orchestration`
- Raw SKILL.md: https://api.skillmd.com/api/skills/quantumquirkxyz/devops-k8s-orchestration/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: quantumquirkxyz (https://skillmd.com/u/quantumquirkxyz)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/quantumquirkxyz/devops-k8s-orchestration

---


## Contract

- **Input:** application architecture, traffic patterns, availability target, resource constraints.
- **Output:** Kubernetes manifests + architecture documentation + monitoring rules.
- **Side effects:** may create resources when executed (deployment, service, configmap).
- **Dependencies:** Kubernetes cluster access (if execution required).
- **Stop condition:** manifests saved; architecture documented.
- **Risk:** medium — production deployment can cause outages; design-only by default.
- **Boundary:** produces manifests and design; deployment only when explicitly executed.

# Kubernetes Orchestration Design

Design a **Kubernetes deployment** — architecture, deployment strategy, service mesh, observability — with reproducible manifests.

## Process

### 1. Architecture design
- **Namespaces:** production, staging, development, monitoring.
- **Node pools:** compute-optimised vs memory-optimised; spot instances.
- **Control plane:** managed (GKE/EKS/AKS) vs self-hosted.
- **Networking:** CNI (Calico, Cilium, Flannel); ingress controller (NGINX, Traefik); service mesh (Istio / Linkerd).

**Completion criterion:** architecture diagram saved.

### 2. Deployment strategy
- **Rolling update:** incremental; safe for stateless.
- **Blue/Green:** instant switch; requires double capacity during transition.
- **Canary:** small percentage to new version; automatic rollback on error rate.
- **A/B:** split traffic by feature flags.

State which fits the service (stateless / stateful / critical / experimental).

**Completion criterion:** strategy selected with justification.

### 3. Resource and scaling
- Resource requests/limits (CPU / memory) per container.
- Horizontal Pod Autoscaler (HPA) based on CPU / memory / custom metrics.
- Vertical Pod Autoscaler (VPA) for right-sizing.
- Cluster autoscaler for node scaling.

**Completion criterion:** resource specs defined; scaling rules saved.

### 4. Security policies
- Pod Security Standards (restricted / privileged / baseline).
- Network policies (deny all; allow only required ports / sources).
- RBAC: least-privilege service accounts; no root containers.
- Secret management: Kubernetes secrets / external (Vault / AWS Secrets Manager / GCP Secret Manager).
- Image scanning: vulnerability scanning in CI.

**Completion criterion:** security policies defined.

### 5. Observability
- **Metrics:** Prometheus / Grafana (custom metrics, SLIs).
- **Logs:** structured logs (JSON); centralised (ELK / Loki / CloudWatch).
- **Tracing:** Jaeger / OpenTelemetry for distributed traces.
- **Alerts:** alert on error rate, latency, resource exhaustion, security events.

**Completion criterion:** monitoring rules defined.

### 6. Deliver

Manifests (YAML) + architecture diagram + monitoring rules + deployment runbook (how to roll back).