# Kubernetes > Use when the project uses Kubernetes for container orchestration, deployment, and service management - Skill: `tomevault-io/kubernetes-8` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/kubernetes-8` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/kubernetes-8/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/kubernetes-8 --- # Kubernetes Best Practices ## Deployment Strategies - Use `Deployment` with `RollingUpdate` as default: set `maxSurge` and `maxUnavailable` for controlled rollouts - Implement `readinessProbe` and `livenessProbe` on every container -- HTTP or exec-based - Use `startupProbe` for slow-starting applications to prevent premature kill by the liveness probe - Set resource `requests` and `limits` on every pod: CPU/Memory requests for scheduling, limits for QoS - Apply `PodDisruptionBudget` to maintain availability during voluntary disruptions (node drains, upgrades) ## Service Mesh - Use a service mesh (Istio, Linkerd) for mTLS, traffic shaping, and observability when microservices exceed ~10 - Define `DestinationRule` for circuit breaking and connection pooling - Use `VirtualService` for canary deployments: route percentages between service versions - Apply `PeerAuthentication` for strict mTLS mode across the mesh - Keep mesh configuration in the same repository as the application manifests ## Helm Charts - Structure charts with `templates/`, `values.yaml`, `Chart.yaml`, and `README.md` - Use `values.yaml` for environment-agnostic defaults; override with `-f staging.yaml` per environment - Template with `{{ .Values.* }}` and `{{ .Release.* }}`; use `{{-` to trim whitespace - Use named templates (`_helpers.tpl`) for reusable label blocks and common metadata - Run `helm lint` and `helm template` in CI; use `helm test` for release validation hooks ## RBAC and Security - Apply least-privilege RBAC: create `Role`/`RoleBinding` per namespace, avoid `ClusterRole` unless necessary - Use `NetworkPolicy` to restrict pod-to-pod traffic: default deny, explicitly allow required flows - Run containers as non-root: set `runAsNonRoot: true`, `readOnlyRootFilesystem: true` in security contexts - Use `SealedSecrets` or external secret managers (Vault, AWS Secrets Manager) -- never plaintext secrets - Scan images with Trivy or Grype in CI; enforce admission controllers to block vulnerable images ## Autoscaling and GitOps - Configure `HorizontalPodAutoscaler` with CPU/memory and custom metrics via Prometheus adapter - Use `VerticalPodAutoscaler` for right-sizing requests in steady-state workloads - Implement GitOps with ArgoCD or Flux: declarative repo -> automated cluster reconciliation - Structure repos as `clusters/`, `apps/`, `infra/` for GitOps clarity; use app-of-apps pattern in ArgoCD - Use `Kustomize` overlays for environment-specific patches without duplicating base manifests --- > Source: [calcosmic/Aether](https://github.com/calcosmic/Aether) — distributed by [TomeVault](https://tomevault.io).