# Kubernetes Manifest

> Use when the user wants to write or review a Kubernetes manifest (Deployment, Service, Ingress, etc.).

- Skill: `tomevault-io/kubernetes-manifest` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/kubernetes-manifest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/kubernetes-manifest/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: Apache-2.0
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/kubernetes-manifest

---


# Kubernetes manifests

## Minimal Deployment + Service

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app
  labels: { app: app }
spec:
  replicas: 3
  selector: { matchLabels: { app: app } }
  template:
    metadata:
      labels: { app: app }
    spec:
      containers:
      - name: app
        image: ghcr.io/me/app:v1.2.3      # NEVER `latest`
        ports: [{ containerPort: 8000 }]
        resources:
          requests: { cpu: 100m, memory: 128Mi }
          limits:   { cpu: 500m, memory: 512Mi }
        readinessProbe:
          httpGet: { path: /healthz, port: 8000 }
          periodSeconds: 5
        livenessProbe:
          httpGet: { path: /healthz, port: 8000 }
          periodSeconds: 30
        env:
        - name: DATABASE_URL
          valueFrom: { secretKeyRef: { name: db, key: url } }
---
apiVersion: v1
kind: Service
metadata: { name: app }
spec:
  selector: { app: app }
  ports: [{ port: 80, targetPort: 8000 }]
```

## Rules

- **Pin image tags**, never `latest`.
- **Set resource requests AND limits** — without requests, scheduler over-packs nodes.
- **readinessProbe + livenessProbe** — readiness controls traffic routing, liveness restarts hung pods.
- **Liveness should NOT depend on downstream services** — they kill cascading dependencies.
- **Use Secrets, not ConfigMap, for credentials**. Mount them as files when possible (env vars leak via `/proc`).
- **Set `revisionHistoryLimit: 3`** on Deployments — saves etcd from accumulating history.
- **PodDisruptionBudget** for anything user-facing — prevents evicting all replicas simultaneously.

## Anti-patterns

- `command:` overriding the image's own ENTRYPOINT — fragile.
- Running multiple processes in one container — use sidecars.
- `hostNetwork: true` "for performance" — almost always wrong; breaks isolation.
- Probes that hit `/` — `/` may auth-redirect; use a dedicated `/healthz`.

---
> Source: [ManasaEdavalli-TharunSure/opengriffin](https://github.com/ManasaEdavalli-TharunSure/opengriffin) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-05-22 -->