Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 0xDarkMatter/claude-mods --skill kubernetes-opsgit clone --depth 1 https://github.com/0xDarkMatter/claude-modsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/0xdarkmatter/claude-mods/kubernetes-ops)<a href="https://agentmods.dev/skills/0xdarkmatter/claude-mods/kubernetes-ops"><img src="https://agentmods.dev/badge/skills/0xdarkmatter/claude-mods/kubernetes-ops/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/0xdarkmatter/claude-mods/kubernetes-ops"><img src="https://agentmods.dev/badge/skills/0xdarkmatter/claude-mods/kubernetes-ops.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00091 | $0.02518 |
| Opus 5.5 | $0.00036 | $0.01007 |
| Sonnet 5.5 | $0.00018 | $0.00504 |
| Haiku 4.5 | $0.00009 | $0.00252 |
Grade A, and why
kubernetes-ops scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 166 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Kubernetes Operations
Manifests, charts and day-two kubectl for Kubernetes 1.35-1.37. Facts verified 2026-10-07:
Kubernetes 1.37 "Garhwal" is current (1.34 reaches end of life on 2026-10-27), Helm 4 is
current, and Gateway API v1.6 is the routing API. docker-ops'
scripts/check-docker-facts.py --live watches these versions weekly.
Why: a manifest that applies cleanly can still take production down. A pod with no readiness probe takes traffic before it can serve; a namespace delete takes its volumes with it; an Ingress controller that stopped getting security fixes in March 2026 is still routing traffic in most clusters.
Hard rules
- Know where you are before you write. Run
kubectl config current-contextbefore any apply, delete or Helm command, and name the context when you report. Deletes,apply --prune,helm uninstalland namespace teardown are Tier 2: list what goes, ask, wait (docker-ops destructive-commands.md has the Kubernetes and Helm table). - New routes use Gateway API, not ingress-nginx. ingress-nginx was retired: no releases or security fixes since March 2026, and the repo is archived. Existing installs keep working until a CVE lands. InGate was retired too, so it is not the successor. Migrate with Ingress2Gateway. gateway-api.md
- Pods meet the restricted Pod Security Standard.
runAsNonRoot: truewith a numericrunAsUser,allowPrivilegeEscalation: false,capabilities.drop: [ALL],seccompProfile.type: RuntimeDefault.readOnlyRootFilesystem: trueis recommended, but Restricted does not require it. Enforce with the namespace labelpod-security.kubernetes.io/enforce: restricted. - Every container has requests, a memory limit, and probes that mean different things. readiness = "send me traffic", liveness = "restart me", startup = "I'm still booting". A liveness probe that checks a database restarts healthy pods when the database blips.
- Images by version, and by digest in production. Never
:latest(and neverimagePullPolicy: Alwaysas a substitute for pinning). The image itself is docker-ops' job. - A Secret is base64, not encryption. Never commit Secret manifests with data. Use
External Secrets Operator, Sealed Secrets or the Secrets Store CSI driver, and limit
get secretsin RBAC. - Helm 4 changed defaults. New releases use server-side apply.
--atomicis now--rollback-on-failureand--forceis--force-replace(the old flags warn). Post-renderers are plugins. Rendering withhelm template | kubectl applyloses release tracking and rollback. helm-patterns.md - Preview before changing a shared cluster:
kubectl diff -f ...andkubectl apply --dry-run=server -f .... Prefer GitOps over hand-applies for anything long-lived.
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 166 lines · 91 tokens per session scan A b0daf36cc359
kubernetes-ops is a skill published in the GitHub repository 0xDarkMatter/claude-mods (63 stars, last pushed yesterday), licensed MIT. It adds 91 tokens to every session and 2,518 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-15.
Other skills, from other repositories
agent-cloud-architect
Specialist subagent: Multi-cloud architecture, cost optimization, serverless vs containers, disaster recovery, and infrastructure design specialist. Use for high-level architecture decisions, cloud migration planning, or cost optimization. Trigger phrases: cloud, AWS, GCP, Azure, serverless, containers, Kubernetes…
proxmox-cluster-ops
Operate a Proxmox VE cluster safely — monitoring-first state checks, quorum-respecting node updates, and joining a new node. Use for cluster operations, rolling updates, or adding a node.
docker-kubernetes
Production Docker and Kubernetes patterns including multi-stage builds, minimal base images, non-root users, layer caching, docker-compose for development, K8s Deployments, Services, Ingress, ConfigMaps, Secrets, health checks, resource limits, HPA autoscaling, security contexts, and Helm chart basics. Use when…
infra-deploy
Cal.com self-hosted deployment to GCP Cloud Run with Supabase PostgreSQL. Docker Compose for local dev.
helm
Helm chart authoring, templating, and release management for Kubernetes: charts, values, templating functions, repositories, dependencies, and lifecycle operations.
cloud-run
Generate Google Cloud Run configs.