Abhiram1106 Omnix Kubernetes Operator

When to activate

Writing K8s manifests, debugging pod issues, setting up Helm charts, RBAC configuration.

When NOT to activate

• Pure Docker without K8s (use docker-specialist)
• CI/CD pipeline (use devops-orchestrator)

Minimal production Deployment

PASS: Complete deployment with all safety features

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  namespace: production
  labels: { app: myapp }
spec:
  replicas: 3
  selector:
    matchLabels: { app: myapp }
  template:
    metadata:
      labels: { app: myapp }
    spec:
      containers:
      - name: myapp
        image: myapp:1.2.3          # NEVER use :latest in production
        ports: [{ containerPort: 3000 }]
        resources:
          requests: { cpu: "100m", memory: "128Mi" }
          limits:   { cpu: "500m", memory: "512Mi" }  # prevent OOMKilled
        livenessProbe:
          httpGet: { path: /health, port: 3000 }
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet: { path: /ready, port: 3000 }
          initialDelaySeconds: 5
          periodSeconds: 5
        env:
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef: { name: myapp-secrets, key: database-url }
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        readOnlyRootFilesystem: true

FAIL: Dangerous defaults

image: myapp:latest          # No pinned version
# No resources (can OOM and crash cluster)
# No probes (Kubernetes can't detect unhealthy pods)
# No securityContext (runs as root)

Pod crash debugging

# CrashLoopBackOff
kubectl logs <pod> --previous         # logs before crash
kubectl describe pod <pod>            # events section
kubectl get events --sort-by='.lastTimestamp' | head -20

# ImagePullBackOff
kubectl describe pod <pod>            # look for image pull error
# Fix: check image name/tag, check registry credentials

# OOMKilled
kubectl top pods                      # check memory usage
kubectl describe pod <pod> | grep -A5 "OOM"
# Fix: increase memory limit, fix memory leak

# Pending pod (not scheduled)
kubectl describe pod <pod>            # look for "Insufficient" in events
kubectl get nodes -o wide             # check node capacity

Namespace isolation (RBAC template)

apiVersion: v1
kind: ServiceAccount
metadata: { name: myapp, namespace: production }
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: { name: myapp-role, namespace: production }
rules:
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: { name: myapp-binding, namespace: production }
subjects: [{ kind: ServiceAccount, name: myapp, namespace: production }]
roleRef: { kind: Role, name: myapp-role, apiGroup: rbac.authorization.k8s.io }

Resource sizing guide

Verification

• All pods Running (not Pending/CrashLoop)
• Resource limits set on all containers
• Liveness + readiness probes configured
• No containers running as root
• Secrets mounted from K8s Secrets, not env hardcoded
• Image tags pinned (not :latest)

Source: Abhiram1106/omnix — distributed by TomeVault.