kubernetes

Kubernetes

This skill covers writing production-grade Kubernetes manifests and Helm charts. It assumes you understand what Kubernetes does — the focus is on doing it correctly.

When to Use

• Writing Kubernetes manifests (Deployment, Service, Ingress, ConfigMap, Secret)
• Creating or reviewing a Helm chart for a service
• Configuring resource limits, health probes, or autoscaling
• Migrating from Docker Compose to Kubernetes or k3s
• Debugging a Pod that is CrashLooping or failing health checks

When NOT to Use

• Containerizing the application itself — use docker
• CI/CD pipeline that deploys to Kubernetes — use ci-cd
• Infrastructure provisioning (cluster creation, cloud provider config) — different scope

Core Principles

Every Manifest is Production Configuration

A manifest that works in dev but lacks resource limits, health probes, or security context will cause production incidents. Apply production standards from the first manifest.

Fail Fast, Recover Automatically

Kubernetes recovers from failures automatically — but only if health probes are configured correctly. A missing readiness probe means traffic is sent to pods that are not ready. A missing liveness probe means crashed pods are never restarted.

Immutable Deployments

Never kubectl exec to modify a running container. Every change goes through a manifest update and a rollout. The running state must always be derivable from the manifests in the repository.

Manifest Authoring Process

Kubernetes progress:
- [ ] Step 1: Define Deployment with resource limits and security context
- [ ] Step 2: Configure health probes (liveness + readiness)
- [ ] Step 3: Create Service and Ingress
- [ ] Step 4: Manage config and secrets
- [ ] Step 5: Configure autoscaling if needed
- [ ] Step 6: Verify rollout strategy

Step 1: Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: document-service
  namespace: production
  labels:
    app: document-service
    version: "1.4.2"
spec:
  replicas: 2
  selector:
    matchLabels:
      app: document-service
  template:
    metadata:
      labels:
        app: document-service
        version: "1.4.2"
    spec:
      # Security: non-root, read-only filesystem
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 1000

      containers:
        - name: document-service
          image: ghcr.io/myorg/document-service:abc1234  # always SHA, never latest
          ports:
            - containerPort: 3000

          # Resource limits — always set both requests and limits
          resources:
            requests:
              cpu: "100m"
              memory: "128Mi"
            limits:
              cpu: "500m"
              memory: "512Mi"

          # Container security
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]

          # Environment from ConfigMap and Secret
          envFrom:
            - configMapRef:
                name: document-service-config
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: document-service-secrets
                  key: database-url

          # Writable tmp for apps that need it
          volumeMounts:
            - name: tmp
              mountPath: /tmp

      volumes:
        - name: tmp
          emptyDir: {}

      # Graceful shutdown
      terminationGracePeriodSeconds: 30