Borrowing it
Nothing to install: this file belongs to Everyone-Needs-A-Copilot/claude-copilot. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Everyone-Needs-A-Copilot/claude-copilot/main/.claude/skills/devops/kubernetes/SKILL.mdgit clone --depth 1 https://github.com/Everyone-Needs-A-Copilot/claude-copilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/everyone-needs-a-copilot/claude-copilot/kubernetes)<a href="https://agentmods.dev/skills/everyone-needs-a-copilot/claude-copilot/kubernetes"><img src="https://agentmods.dev/badge/skills/everyone-needs-a-copilot/claude-copilot/kubernetes.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Anti-Refusal · line 172 Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.Fix: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
- high Tool Misuse · line 229 Code deploys a privileged Kubernetes workload (privileged container, hostPath mount, or host namespaces). This grants root on the node and is a node/cluster takeover vector.Fix: Remove privileged, hostPath, and host-namespace settings from workloads. Use a least-privilege securityContext, drop capabilities, and avoid mounting the host filesystem.
- high Tool Misuse · line 230 Code deploys a privileged Kubernetes workload (privileged container, hostPath mount, or host namespaces). This grants root on the node and is a node/cluster takeover vector.Fix: Remove privileged, hostPath, and host-namespace settings from workloads. Use a least-privilege securityContext, drop capabilities, and avoid mounting the host filesystem.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.02062 |
| Opus 5 | $0.00049 | $0.01031 |
| Sonnet 5 | $0.00020 | $0.00412 |
| Haiku 4.5 | $0.00010 | $0.00206 |
Grade A, and why
kubernetes scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 254 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Kubernetes Patterns
Best practices and anti-patterns for Kubernetes deployments, resource configuration, and cluster management. Run the linter on every manifest before review; use this prose guidance to explain findings and propose fixes.
Purpose
- Ensure reliable, scalable Kubernetes deployments
- Prevent resource exhaustion and scheduling failures
- Establish security and observability patterns
Core Patterns
Pattern 1: Resource Requests and Limits
When to use: Every production container deployment.
apiVersion: apps/v1
kind: Deployment
metadata:
name: api-service
spec:
template:
spec:
containers:
- name: api
image: api:v1.2.3
resources:
requests:
memory: "256Mi"
cpu: "250m"
limits:
memory: "512Mi"
cpu: "500m"
Benefits: Predictable scheduling, protection against resource exhaustion, fair resource sharing across pods.
Pattern 2: Health Probes
When to use: All production deployments.
containers:
- name: api
livenessProbe:
httpGet:
path: /health
port: 8080
initialDelaySeconds: 30
periodSeconds: 10
failureThreshold: 3
readinessProbe:
httpGet:
path: /ready
port: 8080
initialDelaySeconds: 5
periodSeconds: 5
successThreshold: 1
Benefits: Auto-restart unhealthy pods, traffic only to ready pods, graceful startup handling.
Pattern 3: Pod Disruption Budgets
When to use: Production services requiring high availability.
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
name: api-pdb
spec:
minAvailable: 2
selector:
matchLabels:
app: api
Anti-Patterns
Anti-Pattern 1: No Resource Limits
| Aspect | Description |
|---|---|
| WHY | Unlimited resources cause node exhaustion, OOM kills, and unpredictable scheduling. One pod can starve others. |
| DETECTION | Missing resources.limits in container specs. |
| FIX | Always set requests (guaranteed) and limits (maximum). |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 254 lines · 98 tokens per session scan A 9efd615608a5
kubernetes is a skill published in the GitHub repository Everyone-Needs-A-Copilot/claude-copilot (13 stars, last pushed 2d ago), licensed MIT. It adds 98 tokens to every session and 2,062 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
deployment
Kubernetes Deployment 管理.
kubernetes
Kubernetes operations playbook for deploying services: core objects, probes, resource sizing, safe rollouts, and fast kubectl debugging.
kubernetes-docs
Kubernetes 1.36 — Pods, Deployments, Services, Ingress, ConfigMaps, Secrets, RBAC, CRDs, Operators, kubectl, Helm.
kubernetes-agent
Kubernetes production patterns — manifests, resource sizing, health probes, scaling, secrets, networking, and troubleshooting.
kubectl-basics
A guide to kubectl, the command-line tool used to manage Kubernetes clusters, which run containerized applications.
bazel-k8s-expert
Expert knowledge for deploying Quarkus/Java applications to Kubernetes using Bazel. Covers rulesk8s, Helm, Kustomize, ConfigMaps, Secrets, and health probes.