# Kubernetes > Kubernetes standards — Deployments, Services, ConfigMaps, resource limits, HPA, Helm, and security contexts. Load when working with Kubernetes. Use when this capability is needed. - Skill: `tomevault-io/kubernetes-32` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/kubernetes-32` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/kubernetes-32/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/kubernetes-32 --- Full standards in [kubernetes.md](kubernetes.md). Always-on summary: **Resource definitions:** - Every Deployment must set `resources:` with both `requests:` and `limits:` for CPU and memory — no unbounded containers - Always set `replicas: 2` minimum for production workloads — a single replica has no availability guarantee - Use `RollingUpdate` strategy with `maxSurge: 1` and `maxUnavailable: 0` for zero-downtime deploys **Probes:** - `readinessProbe:` — gates traffic; must be set on every container serving traffic - `livenessProbe:` — restarts unhealthy containers; use a lightweight health endpoint - `startupProbe` — for slow-starting containers; prevents liveness killing them during init - Never set `livenessProbe` without `readinessProbe` — a buggy liveness check will restart healthy pods **Security:** - Run containers as non-root: `securityContext.runAsNonRoot: true`, `runAsUser: 1000` - `readOnlyRootFilesystem: true` where possible - Set `allowPrivilegeEscalation: false` - Never mount the service account token unless the pod needs K8s API access (`automountServiceAccountToken: false`) **Configuration:** - Env vars from ConfigMap for non-sensitive config; from Secret for sensitive values - Never hardcode secrets in YAML — use Kubernetes Secrets or external secret managers (Vault, AWS Secrets Manager) - Use `secretKeyRef` with `secretName:` to inject individual keys from a Secret into container env vars **Scaling:** - Use HorizontalPodAutoscaler (HPA) with CPU or custom metrics — never scale manually in production - Set `PodDisruptionBudget` (`minAvailable: 1`) for critical services **Never:** - Use `latest` tag for images — pin to a specific digest or version tag - Run as root in the container unless absolutely required - Put sensitive data in ConfigMap — use Secrets - Set `resources.limits` without `resources.requests` — limits without requests cause scheduling issues **Related skills:** `container/docker` (image building), `ci/github-actions` or `ci/gitlab-ci` (CD pipeline) --- > Source: [manikumarkv/devrunway-claude-plugin](https://github.com/manikumarkv/devrunway-claude-plugin) — distributed by [TomeVault](https://tomevault.io).