# Kubernetes Principles > Kubernetes and Helm standards for manifests, charts, values files, RBAC, workloads, networking, policy, validation, or deployment review. Use when this capability is needed. - Skill: `tomevault-io/kubernetes-principles` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/kubernetes-principles` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/kubernetes-principles/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/kubernetes-principles --- # Kubernetes Principles Use this skill as standing guidance for this domain. Apply the checklist first; read the detailed reference only when the task is substantial, risky, unfamiliar, or review-oriented. ## Operating Rules - Prefer the repository's existing conventions, toolchain, and CI commands over generic defaults. - Make the smallest coherent change that satisfies the request while preserving behavior. - Treat tests, linting, dependency hygiene, and security review as part of completion. - If a principle conflicts with higher-priority repository instructions or an explicit user request, follow the higher-priority instruction and call out the tradeoff. ## Core Checklist - Set requests, limits, probes, disruption budgets, and rollout strategy deliberately for production workloads. - Use namespace boundaries, least-privilege RBAC, and network policies for isolation. - Follow Kubernetes Pod Security Standards; default application workloads toward the Restricted profile. - Run containers as non-root, drop unnecessary capabilities, and avoid host namespaces and privileged containers. - Store configuration in ConfigMaps and secrets appropriately; do not commit plaintext secrets. - Validate Helm templates, CRDs, and manifests against schemas and policy before applying. - Use labels and annotations consistently for ownership, observability, selection, and lifecycle automation. - Design upgrades and rollbacks before changing stateful workloads, ingress, storage, or networking. ## Validation Run applicable checks when they exist in the project; if a tool is missing, report that it was skipped. - `helm lint` for charts - `helm template ... | kubeconform -strict` or schema validation for rendered manifests - Policy checks with Kyverno, Gatekeeper/OPA, Conftest, or the project's admission policy tooling ## Detailed Reference For the complete principle set with examples and edge cases, read [references/principles.md](references/principles.md) when deeper guidance is useful. --- > Source: [asciifylabs/asciify-skills](https://github.com/asciifylabs/asciify-skills) — distributed by [TomeVault](https://tomevault.io).