# Kubernetes > Kubernetes standards for container orchestration, deployments, services, ingress, ConfigMaps, Secrets, and security policies. Covers production-ready configurations, monitoring, and best practices for cloud-native applications. Use when this capability is needed. - Skill: `tomevault-io/kubernetes-25` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/kubernetes-25` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/kubernetes-25/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/kubernetes-25 --- # Kubernetes Cloud-Native Standards > **Quick Navigation:** > Level 1: [Quick Start](#level-1-quick-start) (5 min) | Level 2: [Implementation](#level-2-implementation) (30 min) | Level 3: [REFERENCE.md](REFERENCE.md) (Extended) --- ## Level 1: Quick Start ### Core Principles 1. **Declarative Configuration**: Define desired state, let Kubernetes manage it 2. **Resource Limits**: Always set requests and limits for CPU and memory 3. **Health Checks**: Implement liveness, readiness, and startup probes 4. **Security First**: RBAC, network policies, pod security standards 5. **Immutable Infrastructure**: Never modify running containers ### Essential Checklist - [ ] Use Deployments (not bare Pods) for applications - [ ] Set CPU/memory requests and limits - [ ] Configure liveness and readiness probes - [ ] Use ConfigMaps for config, Secrets for sensitive data - [ ] Define Services for pod-to-pod communication - [ ] Enable RBAC, use NetworkPolicies, set PodSecurityContext - [ ] Expose metrics endpoint for Prometheus - [ ] Run multiple replicas (min 3 for production) ### Minimal Deployment Example ```yaml apiVersion: apps/v1 kind: Deployment metadata: name: myapp namespace: production spec: replicas: 3 selector: matchLabels: app: myapp template: metadata: labels: app: myapp spec: securityContext: runAsNonRoot: true runAsUser: 1000 containers: - name: myapp image: registry.example.com/myapp:v1.0.0 ports: - containerPort: 8080 resources: requests: memory: "256Mi" cpu: "250m" limits: memory: "512Mi" cpu: "500m" livenessProbe: httpGet: path: /health port: 8080 initialDelaySeconds: 30 periodSeconds: 10 readinessProbe: httpGet: path: /ready port: 8080 initialDelaySeconds: 5 periodSeconds: 5 --- apiVersion: v1 kind: Service metadata: name: myapp namespace: production spec: type: ClusterIP selector: app: myapp ports: - port: 80 targetPort: 8080 ``` --- ## Level 2: Implementation ### Essential kubectl Commands ```bash # Cluster info kubectl cluster-info kubectl get nodes -o wide # Namespace operations kubectl create namespace production kubectl config set-context --current --namespace=production # Deployment management kubectl apply -f deployment.yaml kubectl rollout status deployment/myapp kubectl rollout history deployment/myapp kubectl rollout undo deployment/myapp # Debugging kubectl get pods -o wide kubectl describe pod kubectl logs -f --tail=100 kubectl exec -it -- /bin/sh # Resource inspection kubectl get all -n production kubectl top pods kubectl get events --sort-by='.lastTimestamp' ``` ### Deployment Patterns **Rolling Update Strategy**: ```yaml spec: strategy: type: RollingUpdate rollingUpdate: maxSurge: 2 maxUnavailable: 1 revisionHistoryLimit: 10 ``` **Pod Security Context** (required for production): ```yaml spec: securityContext: runAsNonRoot: true runAsUser: 1000 fsGroup: 1000 seccompProfile: type: RuntimeDefault containers: - name: myapp securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL ``` **Resource Management**: ```yaml resources: requests: memory: "256Mi" cpu: "250m" ephemeral-storage: "1Gi" limits: memory: "512Mi" cpu: "500m" ephemeral-storage: "2Gi" ``` ### Services & Networking **Service Types**: | Type | Use Case | |------|----------| | ClusterIP | Internal communication (default) | | NodePort | Development/testing external access | | LoadBalancer | Production external access | | ExternalName | DNS alias to external service | **Basic Ingress**: ```yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: myapp annotations: cert-manager.io/cluster-issuer: letsencrypt-prod nginx.ingress.kubernetes.io/ssl-redirect: "true" spec: ingressClassName: nginx tls: - hosts: - myapp.example.com secretName: myapp-tls rules: - host: myapp.example.com http: paths: - path: / pathType: Prefix backend: service: name: myapp port: number: 80 ``` **Network Policy (Default Deny + Allow)**: ```yaml # Default deny all ingress apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: default-deny-ingress spec: podSelector: {} policyTypes: - Ingress --- # Allow specific traffic apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-myapp spec: podSelector: matchLabels: app: myapp policyTypes: - Ingress ingress: - from: - namespaceSelector: matchLabels: name: ingress-nginx ports: - protocol: TCP port: 8080 ``` ### Configuration Management **ConfigMap**: ```yaml apiVersion: v1 kind: ConfigMap metadata: name: myapp-config data: database.host: "postgres.production.svc.cluster.local" log.level: "info" app.properties: | server.port=8080 server.shutdown=graceful ``` **Secret** (use stringData for plain text): ```yaml apiVersion: v1 kind: Secret metadata: name: myapp-secrets type: Opaque stringData: database-url: "postgresql://user:password@postgres:5432/myapp" api-key: "your-api-key" ``` **Using in Pods**: ```yaml env: - name: DB_HOST valueFrom: configMapKeyRef: name: myapp-config key: database.host - name: DB_PASSWORD valueFrom: secretKeyRef: name: myapp-secrets key: db-password envFrom: - configMapRef: name: myapp-config - secretRef: name: myapp-secrets ``` ### Health Probes ```yaml # Startup - for slow-starting apps startupProbe: httpGet: path: /health port: 8080 failureThreshold: 30 periodSeconds: 10 # Liveness - restart if unhealthy livenessProbe: httpGet: path: /health port: 8080 initialDelaySeconds: 30 periodSeconds: 10 failureThreshold: 3 # Readiness - remove from LB if not ready readinessProbe: httpGet: path: /ready port: 8080 initialDelaySeconds: 5 periodSeconds: 5 failureThreshold: 3 ``` ### RBAC Essentials ```yaml apiVersion: v1 kind: ServiceAccount metadata: name: myapp --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: myapp-role rules: - apiGroups: [""] resources: ["pods", "configmaps"] verbs: ["get", "list", "watch"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: myapp-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: myapp-role subjects: - kind: ServiceAccount name: myapp ``` ### Autoscaling ```yaml apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: name: myapp-hpa spec: scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: myapp minReplicas: 3 maxReplicas: 20 metrics: - type: Resource resource: name: cpu target: type: Utilization averageUtilization: 70 ``` --- ## Troubleshooting Quick Reference ### Pod Issues | Status | Common Cause | Debug Command | |--------|--------------|---------------| | Pending | Resource constraints, scheduling | `kubectl describe pod ` | | CrashLoopBackOff | App crash, bad config | `kubectl logs --previous` | | ImagePullBackOff | Wrong image, no auth | `kubectl describe pod ` | | OOMKilled | Memory limit exceeded | Increase memory limit | ### Common Debug Commands ```bash # Check events kubectl get events --sort-by='.lastTimestamp' -n production # Check resource usage kubectl top pods -n production # Enter pod for debugging kubectl exec -it -- /bin/sh # Port forward for local testing kubectl port-forward svc/myapp 8080:80 # Check service endpoints kubectl get endpoints myapp ``` --- ## Security Best Practices 1. **Pod Security Standards**: Use `restricted` profile for production 2. **Network Policies**: Default-deny, whitelist required connections 3. **RBAC**: Principle of least privilege for service accounts 4. **Secrets Management**: Use Vault, AWS Secrets Manager, or external-secrets 5. **Image Scanning**: Scan images with Trivy, Snyk, or similar 6. **Admission Controllers**: Use OPA/Gatekeeper for policy enforcement --- ## When to Use This Skill - Deploying containerized applications to Kubernetes - Setting up production-ready configurations with health checks - Implementing security policies (RBAC, NetworkPolicies) - Managing configuration with ConfigMaps and Secrets - Setting up autoscaling (HPA, VPA, Cluster Autoscaler) - Configuring ingress and load balancing --- ## Level 3: Extended Resources See **[REFERENCE.md](REFERENCE.md)** for: - Complete production deployment manifests - Advanced Helm chart examples - StatefulSet configurations - Custom Resource Definitions (CRDs) - Operator patterns - Multi-cluster and disaster recovery - Complete security policy examples - ServiceMonitor configurations - ResourceQuota and LimitRange templates ### Related Skills - [CI/CD](../../devops/ci-cd/SKILL.md) - Deployment pipelines - [Docker](../../containers/docker/SKILL.md) - Container image best practices - [Helm](../helm/SKILL.md) - Kubernetes package manager - [Monitoring](../../observability/monitoring/SKILL.md) - Prometheus and Grafana --- **Last Updated:** 2025-01-01 **Version:** 2.0.0 --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/williamzujkowski) — claim your Tome and manage your conversions.