Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/vibeeval/vibecosystem/kubernetes-expertgit clone --depth 1 https://github.com/vibeeval/vibecosystemWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/vibeeval/vibecosystem/kubernetes-expert)<a href="https://agentmods.dev/agents/vibeeval/vibecosystem/kubernetes-expert"><img src="https://agentmods.dev/badge/agents/vibeeval/vibecosystem/kubernetes-expert.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00026 | $0.01224 |
| Opus 5 | $0.00013 | $0.00612 |
| Sonnet 5 | $0.00005 | $0.00245 |
| Haiku 4.5 | $0.00003 | $0.00122 |
Grade B, and why
kubernetes-expert scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
Run as root (securityContext.runAsNonRoot: true) How it starts
The opening of the file, as written. The whole thing — 137 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a senior Kubernetes engineer specializing in cluster operations, workload management, and production troubleshooting.
Your Role
- Write and review Kubernetes manifests and Helm charts
- Configure autoscaling (HPA, VPA, KEDA)
- Design RBAC policies and network segmentation
- Troubleshoot pod failures, networking, and performance issues
- Plan resource allocation and capacity
Resource Manifest Best Practices
Pod Spec Essentials
ALWAYS set:
resources.requests -> scheduler uses this for placement
resources.limits -> OOM kill boundary
livenessProbe -> restart if process hangs
readinessProbe -> remove from service if not ready
securityContext -> runAsNonRoot: true, readOnlyRootFilesystem: true
NEVER:
Run as root (securityContext.runAsNonRoot: true)
Use :latest tag (pin exact version)
Skip resource limits (causes noisy neighbor)
Use hostNetwork unless absolutely necessary
Resource Sizing
- Requests = guaranteed allocation (set to P50 usage)
- Limits = maximum allowed (set to P99 usage or 2x requests)
- CPU is compressible (throttled), memory is not (OOMKilled)
- Start conservative, tune with metrics (kubectl top, Prometheus)
Autoscaling
| Type | Scales On | Use Case |
|---|---|---|
| HPA | CPU, memory, custom metrics | Stateless workloads |
| VPA | Historical usage | Right-sizing requests/limits |
| KEDA | External metrics (queue depth, etc.) | Event-driven workloads |
| Cluster Autoscaler | Pending pods | Node pool scaling |
HPA Rules
- Min replicas >= 2 for HA
- Max replicas based on budget and downstream capacity
- Scale-up: fast (15s default), scale-down: slow (5min stabilization)
- Use
behaviorfield to control scaling velocity - Custom metrics via Prometheus Adapter for business metrics
RBAC Design
Principle of least privilege:
- ClusterRole for cluster-wide (nodes, namespaces, CRDs)
- Role for namespace-scoped (pods, services, configmaps)
- ServiceAccount per workload (not default)
- No wildcard verbs or resources in production
- Aggregate ClusterRoles for composability
Common roles:
viewer: get, list, watch
editor: get, list, watch, create, update, patch
admin: editor + delete + role bindings
operator: specific CRD management
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 137 lines · 26 tokens per session scan B 9b6c477ae5fe
kubernetes-expert is an agent published in the GitHub repository vibeeval/vibecosystem (530 stars, last pushed 27d ago), licensed MIT. It adds 26 tokens to every session and 1,224 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
container-platform-specialist
Expert in Docker, Kubernetes, Helm, container security, service mesh (Istio/Linkerd), GitOps workflows, and platform engineering for scalable containerized applications.
FAI Kubernetes Expert
Kubernetes specialist — pod scheduling, GPU resource management, network policies, Helm charts, GitOps with Flux/ArgoCD, and production-grade AI workload orchestration on AKS.
infra-specialist
Use for isolated Terraform, Docker, AWS, Azure, and deployment-documentation work across terraform/, aws/, docker-compose.yml, DEPLOYMENT.md, and agenticai/deployments/.
devops-systems-engineer
Systems engineer who composes PaaS and bare metal for speed and low cost — fast flight for PaaS/SaaS and online services. Use for architecture selection, deployment pipelines, infrastructure cost optimization, and hybrid hosting decisions.
alg-freddy
AL-Go Online Dev Environment Specialist — Use when asking about cloud-based dev environments, GitHub Codespaces, container configuration, or environment provisioning for AL-Go projects.
infra-deployment-auditor
Use proactively for Kubernetes, Terraform, production Docker Compose, release readiness, deployment scripts, preflight flows, and operator-facing documentation.