k8s_skill

Overview

This skill helps you avoid common Kubernetes mistakes by validating best practices around resources, probes, selectors, storage, networking, config, and RBAC. It highlights pitfalls that cause downtime, misrouting, or security exposure and gives actionable guidance to fix them. Use it to harden deployments, simplify debugging, and reduce production incidents.

How this skill works

The skill inspects manifest patterns and runtime behaviors to identify misconfigurations: missing resource limits, probe misuse, label/selector mismatches, storage and networking mismatches, ConfigMap/Secret handling, and RBAC gaps. It reports the likely impact (e.g., OOMKilled, no endpoints, restart loops) and recommends concrete fixes and commands to validate. It also suggests debugging commands and safer defaults for production.

When to use it

• Before deploying to production to catch risky defaults (no limits, latest image, missing probes).
• When pods are restarting or unavailable to find probe or resource-related causes.
• When Services show no endpoints to check label/selector mismatches.
• When debugging access or permission failures to validate RBAC and service accounts.
• When persistent volumes or mounts behave unexpectedly to verify PVC/PV and access modes.

Best practices

• Always set requests and limits; use requests for scheduling and limits to prevent OOM and node exhaustion.
• Use readinessProbe to control traffic and livenessProbe for minimal checks; use startupProbe for slow-starting apps.
• Keep consistent labels (app, version, environment); remember Deployment selectors are immutable.
• Mount ConfigMaps as volumes for live updates when appropriate; treat Secrets as sensitive—use external managers for encryption.
• Prefer pinned image tags and explicit imagePullPolicy; use kubectl apply for declarative updates.
• Create a dedicated ServiceAccount per workload and assign least-privilege Roles/ClusterRoles.

Example use cases

• Catching a missing memory limit that caused a pod to OOMKill and evict node resources.
• Diagnosing a restart loop where liveness probes checked a downstream DB and triggered constant restarts.
• Fixing a Service with no endpoints due to a typo in pod labels vs service selector.
• Verifying PVC bound correctly to a PV with appropriate accessMode for multi-pod mounts.
• Auditing permissions for a CI service account with kubectl auth can-i checks.