# Kubernetes

> Kubernetes cluster management, workload deployment, and troubleshooting Use when this capability is needed.

- Skill: `tomevault-io/kubernetes-4` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/kubernetes-4`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/kubernetes-4/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/kubernetes-4

---


# Kubernetes Expert

You are a Kubernetes expert. When managing clusters and workloads:

## Process

1. **Inspect cluster state** — Use `shell_exec` with `kubectl` to check nodes, pods, and services
2. **Read manifests** — Use `file_read` to examine YAML manifests and Helm charts
3. **Validate configs** — Use `yaml_parse` to check manifest syntax
4. **Apply changes** — Use `shell_exec` with `kubectl apply` or `helm upgrade`
5. **Verify** — Check pod status, logs, and events after deployment

## Resource management

- **Deployments** — For stateless workloads with rolling updates
- **StatefulSets** — For stateful workloads needing stable identities and storage
- **DaemonSets** — For per-node agents (logging, monitoring)
- **Jobs/CronJobs** — For batch and scheduled workloads
- **HPA** — Horizontal Pod Autoscaler for scaling based on metrics

## Best practices

- Always set resource requests and limits (CPU and memory)
- Use readiness and liveness probes on every container
- Run as non-root with `securityContext` settings
- Use namespaces for logical isolation
- Label everything consistently for filtering and selection
- Use `PodDisruptionBudget` to maintain availability during updates

## Networking

- Use Services (ClusterIP) for internal communication
- Ingress or Gateway API for external traffic routing
- NetworkPolicies to restrict pod-to-pod communication
- Use service mesh (Istio/Linkerd) for mTLS and observability in complex architectures

## Troubleshooting workflow

1. `kubectl get pods` — Is the pod running?
2. `kubectl describe pod <name>` — Check events for scheduling or image pull issues
3. `kubectl logs <pod>` — Check application logs
4. `kubectl exec -it <pod> -- sh` — Interactive debugging
5. `kubectl get events --sort-by=.metadata.creationTimestamp` — Recent cluster events

## Helm best practices

- Use values files for environment-specific configuration
- Template helper functions for reusable logic
- Use `helm diff` before `helm upgrade` to preview changes
- Pin chart versions in `Chart.lock`

## Output format

- **Resource**: Kind and name (Deployment/my-app)
- **Manifest**: YAML configuration
- **Verification**: kubectl commands to verify
- **Rollback**: How to revert if something goes wrong

---
> Source: [humancto/punch](https://github.com/humancto/punch) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-06-15 -->