Kubernetes workload patterns, resource management, RBAC, probes, autoscaling, ConfigMap/Secret handling, and kubectl debugging for production-grade deployments. Use when writing or reviewing Kubernetes manifests, or debugging probes, RBAC, autoscaling, or resource limits.

Kubernetes Patterns Production grade Kubernetes patterns for deploying, managing, and debugging workloads reliably. When to Activate Writing Kubernetes manifests (Deployments, Services, Ingress, Jobs) Configuring resource requests/limits, liveness/readiness probes Setting up RBAC, namespaces, or ServiceAccounts Managing configuration and secrets in K8s Debugging CrashLoopBackOff, OOMKilled, pending pods, or image pull errors Configuring HPA (Horizontal Pod Autoscaler) or PodDisruptionBudgets Reviewing K8s YAML for security or correctness When to Use Same as When to Activate above. This alias satisfies repo skill format conventions. Use this skill any time you are writing, reviewing, or debugging Kubernetes YAML and workloads. How It Works This skill provides copy pasteable, production grade YAML patterns and kubectl debugging commands organized by task: 1. Deployment template — A fully configured production Deployment with security context, rolling update strategy, all three probe types, resource limits, and environment injection from ConfigMap/Secret. 2. Probes — Decision table for startup vs liveness vs readiness, with correct failureThreshold × periodSeconds math. 3. Services & Ingress — ClusterIP, LoadBalancer, and TLS Ingress patterns with cert manager annotations. 4. ConfigMaps & Secrets — envFrom , file mount, and external secrets guidance. 5. Resource management — Requests vs limits rules of thumb by workload type (web API, JVM, worker, sidecar). 6. RBAC — Least privilege ServiceAccount → Role → RoleBinding chain. 7. HPA & PDB — Autoscaling and node drain safety configurations. 8. Jobs & CronJobs — One off and scheduled workload patterns with correct restartPolicy . 9. kubectl cheatsheet — Logs, exec, rollback, port forward, dry run, and common error diagnosis commands. 10. Anti patterns & checklist — What NOT to do, and a security/reliability/observability checklist. Examples See the sections below for complete, runnable examples. Quick references: Task Jump to Full production Deployment YAML [Core Workload Patterns]( core workload patterns) Probe configuration [Probes]( probes liveness readiness startup) RBAC least privilege setup [RBAC]( rbac roles and serviceaccounts) Debug a CrashLoopBackOff [kubectl Debugging Cheatsheet]( kubectl debugging cheatsheet) Autoscaling [HPA]( horizontal pod autoscaler hpa) Core Workload Patterns Deployment — Production Template Probes — Liveness, Readiness, Startup Understanding when to use each probe is critical: Probe Failure Action Use For startupProbe Kills container if slow to start Slow starting apps (JVM, Python) livenessProbe Restarts container Deadlock / hung process detection readinessProbe Removes from Service endpoints Temporary unavailability (DB reconnect) Services and Ingress Service Types Ingress with TLS ConfigMaps and Secrets ConfigMap — Non sensitive configuration Secrets — Sensitive data Important: Raw Kubernetes Secrets are only base64 encoded, not encrypted at rest unless your cluster has encryption configured. Use [Sealed Secrets](https://github.com/bitnami labs/sealed secrets) or [External Secrets Operator](https://external secrets.io) for production. Resource Requests and Limits Rules of thumb: Workload Type CPU Request Memory Request Notes Web API 100–250m 128–256Mi Set limits 2 4x requests Worker/consumer 250–500m 256–512Mi Memory limit = request for predictability JVM app 500m–1 512Mi–2Gi Allow headroom above Xmx for JVM overhead Sidecar 10–50m 32–64Mi Keep minimal RBAC — Roles and ServiceAccounts Principle of Least Privilege Two patterns depending on whether the app calls the Kubernetes API: Pattern A — App does NOT need the Kubernetes API (most apps) Disable token automounting on the ServiceAccount. The Role/RoleBinding are not needed. Pattern B — App DOES need the Kubernetes API (operators, controllers, config watchers) Enable the token and grant only the permissions actually required. Horizontal Pod Autoscaler (HPA) HPA requires resources.requests to be set on all containers — it calculates utilization as current / request . PodDisruptionBudget (PDB) Prevent too many pods going down during node drains or rolling updates: Namespaces and Multi Tenancy Jobs and CronJobs kubectl Debugging Cheatsheet Diagnosing Common Errors Anti Patterns Best Practices Checklist Security [ ] Container runs as non root ( runAsNonRoot: true , runAsUser set) [ ] readOnlyRootFilesystem: true with emptyDir for writable paths [ ] allowPrivilegeEscalation: false [ ] All capabilities dropped ( capabilities.drop: [ALL] ) [ ] Dedicated ServiceAccount per app, not default [ ] automountServiceAccountToken: false unless needed [ ] RBAC follows least privilege (use Role , not ClusterRole unless needed) [ ] Secrets managed via Sealed Secrets or External Secrets Operator Reliability [ ] All 3 probe types configured (startup + liveness + readiness) [ ] Resource requests AND limits set on every container [ ] minReplicas: 2+ for any production workload [ ] PodDisruptionBudget defined for stateful or critical services [ ] RollingUpdate strategy with maxUnavailable: 0 [ ] HPA configured for variable load services Observability [ ] App exposes /health (liveness) and /ready (readiness) endpoints [ ] Structured JSON logging (no PII in logs) [ ] Resource labels: app , version , environment Related Skills docker patterns — Multi stage Dockerfiles and image security deployment patterns — CI/CD pipelines, rollback strategy, health check endpoints security review — Broader security hardening context git workflow — GitOps integration with K8s (ArgoCD / Flux patterns)

kubernetes-patterns