1---2name: kubernetes-123description: Use this skill when working with Kubernetes — writing manifests, managing clusters, debugging workloads, setting up observability, or deploying to EKS. Covers local dev, Helm, kubectl, k9s, Kustomize, OpenTelemetry, Grafana stack, and CI/CD with GitHub Actions.4---56# Kubernetes78## Golden Rules9101. **One process per container** — Only co-locate multiple containers in a pod when they are tightly coupled and must share the same host (e.g., app + sidecar proxy).112. **Always define Readiness and Liveness Probes — but never test external dependencies** — Probes that check a database will cause cascading restarts across your entire system when that database goes down.123. **Always handle `SIGTERM` gracefully** — Kubernetes sends `SIGTERM` before killing a pod. Fix your application to shut down cleanly — do not shorten the grace period as a workaround. See `references/operations.md` for `preStop` hook details.134. **Secrets: mount as volumes, never env vars** — Env vars leak in crash reports and child processes. Mount Secrets as read-only volume files (stored in tmpfs). Remember: Secrets are Base64-encoded, not encrypted — enforce strict RBAC or use external secret management. See `references/security.md`.145. **Least privilege for containers** — Drop all capabilities, run as non-root, apply a seccomp profile. Never grant full privileges unless absolutely required. See `references/security.md` for the full `securityContext` pattern.1516## Reference Routing Table1718### Author1920| Reference | Read when you need to… |21|-----------|------------------------|22| `project-structure.md` | Start a new project or add K8s deployment files — repo strategy, directory layouts, naming conventions |23| `manifests.md` | Author Deployments, Services, ConfigMaps, Secrets, Ingress — YAML structure, field conventions, Kustomize overlays |24| `configuration.md` | Work with ConfigMaps or inject runtime metadata via Downward API — includes the live-update gotcha (env var vs volume-mounted) |2526### Deploy2728| Reference | Read when you need to… |29|-----------|------------------------|30| `helm.md` | Install charts or author a new Helm chart — values, templating, release management, CI/CD pipelines, secrets handling |31| `local-dev.md` | Set up a local cluster (Minikube, kind, Docker Desktop) — fast dev loops, live debugging, ephemeral containers |3233### Cloud3435| Reference | Read when you need to… |36|-----------|------------------------|37| `eks.md` | Provision, secure, or operate EKS clusters on AWS — Pod Identity, Karpenter autoscaling, per-PR preview environments, cluster upgrades |3839### Operate4041| Reference | Read when you need to… |42|-----------|------------------------|43| `kubectl.md` | Run core commands (logs, exec, port-forward, describe, debug) or troubleshoot pods and cluster state |44| `k9s.md` | Navigate or debug a cluster interactively — keyboard shortcuts, filtering, special views (Pulses, XRay) |45| `operations.md` | Handle scaling, rollouts, workload types (DaemonSets, Jobs, CronJobs), pod lifecycle, production readiness, multi-tenancy |46| `observability.md` | Set up logging, metrics, tracing — collection architecture, OTEL Collector patterns, Grafana LGTM stack, signal correlation |4748### Harden4950| Reference | Read when you need to… |51|-----------|------------------------|52| `security.md` | Secure workloads, configure container privileges, handle Secrets — capabilities, ServiceAccount tokens, hostNetwork, Pod Security Standards |53| `networking.md` | Configure Services, Ingress, DNS, or network policies — connectivity, exposure patterns, namespace isolation |54| `storage.md` | Work with PVCs, PersistentVolumes, StorageClasses, emptyDir — retention policies, access modes, hostPath risks |5556---57> Source: [imarios/open-vibes](https://github.com/imarios/open-vibes) — distributed by [TomeVault](https://tomevault.io).58<!-- tomevault:4.0:skill_md:2026-06-15 -->
tomevault-io