[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M70GD1K6KASRQ4TNFGVPMSXS":3,"skill-same:01M70GD1K6KASRQ4TNFGVPMSXS":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":54,"repositoryHtmlUrl":55,"repositoryHomepageUrl":6,"ownerHtmlUrl":56,"ownerBlogUrl":6,"ownerDescription":57,"updatedAt":58,"install":59,"resources":72},"01M70GD1K6KASRQ4TNFGVPMSXS","kubernetes-patterns",null,"Kubernetes workload patterns, resource management, RBAC, probes, autoscaling, ConfigMap\u002FSecret handling, and kubectl debugging for production-grade deployments. Use when writing or reviewing Kubernetes manifests, or debugging probes, RBAC, autoscaling, or resource limits.","mdnaimul22\u002Fhuman-skills","mdnaimul22","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F64520358?v=4","01M70FH95MH2H796Q01TYSFZ03","Naimul","01M70FH96798CQR4YHA13F17GA",3,"MIT","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Faffaan-m_ECC\u002Fkubernetes-patterns\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"patterns","kubernetes","kubernetes patterns","management","Production","use","deployments","for","kubectl","workload","rbac","secret handling","limits","when","debugging","manifests","writing","autoscaling","kubectl debugging","resource management","2026-11-10 10:12:30",false,"---\nname: kubernetes-patterns\ndescription: Kubernetes workload patterns, resource management, RBAC, probes, autoscaling, ConfigMap\u002FSecret handling, and kubectl debugging for production-grade deployments. Use when writing or reviewing Kubernetes manifests, or debugging probes, RBAC, autoscaling, or resource limits.\nmetadata:\n  origin: ECC\n---\n\n# Kubernetes Patterns\n\nProduction-grade Kubernetes patterns for deploying, managing, and debugging workloads reliably.\n\n## When to Activate\n\n- Writing Kubernetes manifests (Deployments, Services, Ingress, Jobs)\n- Configuring resource requests\u002Flimits, liveness\u002Freadiness probes\n- Setting up RBAC, namespaces, or ServiceAccounts\n- Managing configuration and secrets in K8s\n- Debugging CrashLoopBackOff, OOMKilled, pending pods, or image pull errors\n- Configuring HPA (Horizontal Pod Autoscaler) or PodDisruptionBudgets\n- Reviewing K8s YAML for security or correctness\n\n## When to Use\n\n> Same as **When to Activate** above. This alias satisfies repo skill-format conventions. Use this skill any time you are writing, reviewing, or debugging Kubernetes YAML and workloads.\n\n## How It Works\n\nThis skill provides **copy-pasteable, production-grade YAML patterns** and **kubectl debugging commands** organized by task:\n\n1. **Deployment template** — A fully configured production `Deployment` with security context, rolling update strategy, all three probe types, resource limits, and environment injection from ConfigMap\u002FSecret.\n2. **Probes** — Decision table for startup vs liveness vs readiness, with correct `failureThreshold × periodSeconds` math.\n3. **Services & Ingress** — ClusterIP, LoadBalancer, and TLS Ingress patterns with cert-manager annotations.\n4. **ConfigMaps & Secrets** — `envFrom`, file-mount, and external secrets guidance.\n5. **Resource management** — Requests vs limits rules of thumb by workload type (web API, JVM, worker, sidecar).\n6. **RBAC** — Least-privilege ServiceAccount → Role → RoleBinding chain.\n7. **HPA & PDB** — Autoscaling and node-drain safety configurations.\n8. **Jobs & CronJobs** — One-off and scheduled workload patterns with correct `restartPolicy`.\n9. **kubectl cheatsheet** — Logs, exec, rollback, port-forward, dry-run, and common error diagnosis commands.\n10. **Anti-patterns & checklist** — What NOT to do, and a security\u002Freliability\u002Fobservability checklist.\n\n## Examples\n\nSee the sections below for complete, runnable examples. Quick references:\n\n| Task | Jump to |\n|------|---------|\n| Full production Deployment YAML | [Core Workload Patterns](#core-workload-patterns) |\n| Probe configuration | [Probes](#probes--liveness-readiness-startup) |\n| RBAC least-privilege setup | [RBAC](#rbac--roles-and-serviceaccounts) |\n| Debug a CrashLoopBackOff | [kubectl Debugging Cheatsheet](#kubectl-debugging-cheatsheet) |\n| Autoscaling | [HPA](#horizontal-pod-autoscaler-hpa) |\n\n---\n\n## Core Workload Patterns\n\n### Deployment — Production Template\n\n```yaml\napiVersion: apps\u002Fv1\nkind: Deployment\nmetadata:\n  name: my-app\n  namespace: my-namespace\n  labels:\n    app: my-app\n    version: \"1.0.0\"\nspec:\n  replicas: 3\n  selector:\n    matchLabels:\n      app: my-app\n  strategy:\n    type: RollingUpdate\n    rollingUpdate:\n      maxSurge: 1          # Allow 1 extra pod during update\n      maxUnavailable: 0    # Never reduce below desired count\n  template:\n    metadata:\n      labels:\n        app: my-app\n        version: \"1.0.0\"\n    spec:\n      # Security context at pod level\n      securityContext:\n        runAsNonRoot: true\n        runAsUser: 1001\n        fsGroup: 1001\n\n      # Graceful shutdown\n      terminationGracePeriodSeconds: 30\n\n      containers:\n        - name: my-app\n          image: ghcr.io\u002Forg\u002Fmy-app:1.0.0   # Never use :latest\n          imagePullPolicy: IfNotPresent\n\n          ports:\n            - containerPort: 8080\n              protocol: TCP\n\n          # Resource requests AND limits are both required\n          resources:\n            requests:\n              cpu: \"100m\"\n              memory: \"128Mi\"\n            limits:\n              cpu: \"500m\"\n              memory: \"256Mi\"\n\n          # Container security context\n          securityContext:\n            allowPrivilegeEscalation: false\n            readOnlyRootFilesystem: true\n            capabilities:\n              drop:\n                - ALL\n\n          # Probes (see Probes section below)\n          startupProbe:\n            httpGet:\n              path: \u002Fhealth\n              port: 8080\n            failureThreshold: 30\n            periodSeconds: 5\n          livenessProbe:\n            httpGet:\n              path: \u002Fhealth\n              port: 8080\n            initialDelaySeconds: 0\n            periodSeconds: 30\n            failureThreshold: 3\n          readinessProbe:\n            httpGet:\n              path: \u002Fready\n              port: 8080\n            initialDelaySeconds: 5\n            periodSeconds: 10\n            failureThreshold: 2\n\n          # Environment from ConfigMap and Secret\n          envFrom:\n            - configMapRef:\n                name: my-app-config\n          env:\n            - name: DB_PASSWORD\n              valueFrom:\n                secretKeyRef:\n                  name: my-app-secrets\n                  key: db-password\n\n          # Writable tmp directory when readOnlyRootFilesystem: true\n          volumeMounts:\n            - name: tmp\n              mountPath: \u002Ftmp\n\n      volumes:\n        - name: tmp\n          emptyDir: {}\n```\n\n---\n\n## Probes — Liveness, Readiness, Startup\n\nUnderstanding when to use each probe is critical:\n\n| Probe | Failure Action | Use For |\n|-------|---------------|---------|\n| `startupProbe` | Kills container if slow to start | Slow-starting apps (JVM, Python) |\n| `livenessProbe` | Restarts container | Deadlock \u002F hung process detection |\n| `readinessProbe` | Removes from Service endpoints | Temporary unavailability (DB reconnect) |\n\n```yaml\n# Correct pattern: startupProbe covers slow startup,\n# then liveness\u002Freadiness take over\nstartupProbe:\n  httpGet:\n    path: \u002Fhealth\n    port: 8080\n  failureThreshold: 30  # 30 * 5s = 150s max startup time\n  periodSeconds: 5\n\nlivenessProbe:\n  httpGet:\n    path: \u002Fhealth\n    port: 8080\n  periodSeconds: 30\n  failureThreshold: 3   # 3 * 30s = 90s before restart\n\nreadinessProbe:\n  httpGet:\n    path: \u002Fready         # Separate endpoint: checks DB, cache, etc.\n    port: 8080\n  periodSeconds: 10\n  failureThreshold: 2\n```\n\n```yaml\n# WRONG: initialDelaySeconds without startupProbe\n# If the app takes 60s to start, set a startupProbe instead\nlivenessProbe:\n  httpGet:\n    path: \u002Fhealth\n    port: 8080\n  initialDelaySeconds: 60   # BAD: Arbitrary wait, race condition\n```\n\n---\n\n## Services and Ingress\n\n### Service Types\n\n```yaml\n# ClusterIP (default) — internal-only\napiVersion: v1\nkind: Service\nmetadata:\n  name: my-app\n  namespace: my-namespace\nspec:\n  selector:\n    app: my-app\n  ports:\n    - port: 80\n      targetPort: 8080\n      protocol: TCP\n  type: ClusterIP\n```\n\n```yaml\n# LoadBalancer — external traffic (cloud providers)\nspec:\n  type: LoadBalancer\n  ports:\n    - port: 443\n      targetPort: 8080\n```\n\n### Ingress with TLS\n\n```yaml\napiVersion: networking.k8s.io\u002Fv1\nkind: Ingress\nmetadata:\n  name: my-app\n  namespace: my-namespace\n  annotations:\n    nginx.ingress.kubernetes.io\u002Fssl-redirect: \"true\"\n    cert-manager.io\u002Fcluster-issuer: \"letsencrypt-prod\"\nspec:\n  ingressClassName: nginx\n  tls:\n    - hosts:\n        - myapp.example.com\n      secretName: my-app-tls\n  rules:\n    - host: myapp.example.com\n      http:\n        paths:\n          - path: \u002F\n            pathType: Prefix\n            backend:\n              service:\n                name: my-app\n                port:\n                  number: 80\n```\n\n---\n\n## ConfigMaps and Secrets\n\n### ConfigMap — Non-sensitive configuration\n\n```yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: my-app-config\n  namespace: my-namespace\ndata:\n  LOG_LEVEL: \"info\"\n  APP_ENV: \"production\"\n  MAX_CONNECTIONS: \"100\"\n  # Mount as a file for complex config\n  app.yaml: |\n    server:\n      port: 8080\n      timeout: 30s\n```\n\n```yaml\n# Mount ConfigMap as a file\nvolumes:\n  - name: config\n    configMap:\n      name: my-app-config\n      items:\n        - key: app.yaml\n          path: app.yaml\nvolumeMounts:\n  - name: config\n    mountPath: \u002Fetc\u002Fapp\n    readOnly: true\n```\n\n### Secrets — Sensitive data\n\n```bash\n# Create secret from literal (CLI, then store in Vault\u002FSOPS)\nkubectl create secret generic my-app-secrets \\\n  --from-literal=db-password='s3cr3t' \\\n  --namespace=my-namespace \\\n  --dry-run=client -o yaml | kubectl apply -f -\n```\n\n```yaml\napiVersion: v1\nkind: Secret\nmetadata:\n  name: my-app-secrets\n  namespace: my-namespace\ntype: Opaque\n# Values are base64-encoded (NOT encrypted — use Sealed Secrets or ESO for real encryption)\ndata:\n  db-password: czNjcjN0  # base64 of 's3cr3t'\n```\n\n> **Important:** Raw Kubernetes Secrets are only base64-encoded, not encrypted at rest unless your cluster has encryption configured. Use [Sealed Secrets](https:\u002F\u002Fgithub.com\u002Fbitnami-labs\u002Fsealed-secrets) or [External Secrets Operator](https:\u002F\u002Fexternal-secrets.io) for production.\n\n---\n\n## Resource Requests and Limits\n\n```yaml\nresources:\n  requests:       # Scheduler uses this to place the pod\n    cpu: \"100m\"   # 100 millicores = 0.1 CPU\n    memory: \"128Mi\"\n  limits:         # Container is killed\u002Fthrottled above this\n    cpu: \"500m\"\n    memory: \"256Mi\"\n```\n\n**Rules of thumb:**\n\n| Workload Type | CPU Request | Memory Request | Notes |\n|---------------|-------------|----------------|-------|\n| Web API | 100–250m | 128–256Mi | Set limits 2-4x requests |\n| Worker\u002Fconsumer | 250–500m | 256–512Mi | Memory limit = request for predictability |\n| JVM app | 500m–1 | 512Mi–2Gi | Allow headroom above `-Xmx` for JVM overhead |\n| Sidecar | 10–50m | 32–64Mi | Keep minimal |\n\n```yaml\n# WRONG: No requests or limits — unpredictable scheduling, OOM evictions\ncontainers:\n  - name: app\n    image: myapp:latest\n    # Missing resources: {} — this is dangerous in production\n\n# WRONG: Limits without requests — requests default to limits, over-reserves capacity\nresources:\n  limits:\n    cpu: \"2\"\n    memory: \"1Gi\"\n  # requests missing — will default to limits values\n```\n\n---\n\n## RBAC — Roles and ServiceAccounts\n\n### Principle of Least Privilege\n\n**Two patterns depending on whether the app calls the Kubernetes API:**\n\n#### Pattern A — App does NOT need the Kubernetes API (most apps)\n\nDisable token automounting on the ServiceAccount. The Role\u002FRoleBinding are not needed.\n\n```yaml\n# ServiceAccount with token disabled — safest default\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  name: my-app-sa\n  namespace: my-namespace\nautomountServiceAccountToken: false   # No K8s API token injected into pods\n```\n\n```yaml\n# Reference in Deployment — no token, no API access\nspec:\n  template:\n    spec:\n      serviceAccountName: my-app-sa\n      automountServiceAccountToken: false   # Belt-and-suspenders: also set at pod level\n```\n\n#### Pattern B — App DOES need the Kubernetes API (operators, controllers, config watchers)\n\nEnable the token and grant only the permissions actually required.\n\n```yaml\n# 1. ServiceAccount — enable token for this SA\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  name: my-app-sa\n  namespace: my-namespace\nautomountServiceAccountToken: true    # Token required: app calls K8s API\n```\n\n```yaml\n# 2. Role — grant only what the app needs (namespace-scoped)\napiVersion: rbac.authorization.k8s.io\u002Fv1\nkind: Role\nmetadata:\n  name: my-app-role\n  namespace: my-namespace\nrules:\n  - apiGroups: [\"\"]\n    resources: [\"configmaps\"]\n    verbs: [\"get\", \"list\", \"watch\"]    # Read-only, specific resource\n  - apiGroups: [\"\"]\n    resources: [\"secrets\"]\n    resourceNames: [\"my-app-secrets\"]  # Restrict to specific secret by name\n    verbs: [\"get\"]\n```\n\n```yaml\n# 3. Bind Role to ServiceAccount\napiVersion: rbac.authorization.k8s.io\u002Fv1\nkind: RoleBinding\nmetadata:\n  name: my-app-rolebinding\n  namespace: my-namespace\nsubjects:\n  - kind: ServiceAccount\n    name: my-app-sa\n    namespace: my-namespace\nroleRef:\n  kind: Role\n  apiGroup: rbac.authorization.k8s.io\n  name: my-app-role\n```\n\n```yaml\n# 4. Reference SA in Deployment\nspec:\n  template:\n    spec:\n      serviceAccountName: my-app-sa\n      # automountServiceAccountToken defaults to true from SA — token is injected\n```\n\n---\n\n## Horizontal Pod Autoscaler (HPA)\n\n```yaml\napiVersion: autoscaling\u002Fv2\nkind: HorizontalPodAutoscaler\nmetadata:\n  name: my-app-hpa\n  namespace: my-namespace\nspec:\n  scaleTargetRef:\n    apiVersion: apps\u002Fv1\n    kind: Deployment\n    name: my-app\n  minReplicas: 2      # Always at least 2 for HA\n  maxReplicas: 10\n  metrics:\n    - type: Resource\n      resource:\n        name: cpu\n        target:\n          type: Utilization\n          averageUtilization: 70    # Scale up when avg CPU > 70%\n    - type: Resource\n      resource:\n        name: memory\n        target:\n          type: Utilization\n          averageUtilization: 80\n```\n\n> HPA requires `resources.requests` to be set on all containers — it calculates utilization as `current \u002F request`.\n\n---\n\n## PodDisruptionBudget (PDB)\n\nPrevent too many pods going down during node drains or rolling updates:\n\n```yaml\napiVersion: policy\u002Fv1\nkind: PodDisruptionBudget\nmetadata:\n  name: my-app-pdb\n  namespace: my-namespace\nspec:\n  minAvailable: 2           # OR use maxUnavailable: 1\n  selector:\n    matchLabels:\n      app: my-app\n```\n\n---\n\n## Namespaces and Multi-Tenancy\n\n```bash\n# Create namespace with resource quotas\nkubectl create namespace my-namespace\n\n# Apply ResourceQuota to limit namespace consumption\nkubectl apply -f - \u003C\u003CEOF\napiVersion: v1\nkind: ResourceQuota\nmetadata:\n  name: my-namespace-quota\n  namespace: my-namespace\nspec:\n  hard:\n    requests.cpu: \"4\"\n    requests.memory: 4Gi\n    limits.cpu: \"8\"\n    limits.memory: 8Gi\n    pods: \"20\"\nEOF\n```\n\n---\n\n## Jobs and CronJobs\n\n```yaml\n# One-off Job (DB migration, data processing)\napiVersion: batch\u002Fv1\nkind: Job\nmetadata:\n  name: db-migrate\n  namespace: my-namespace\nspec:\n  backoffLimit: 3          # Retry up to 3 times on failure\n  ttlSecondsAfterFinished: 3600   # Auto-delete after 1h\n  template:\n    spec:\n      restartPolicy: OnFailure    # Never for Jobs (not Always)\n      containers:\n        - name: migrate\n          image: ghcr.io\u002Forg\u002Fmy-app:1.0.0\n          command: [\"python\", \"manage.py\", \"migrate\"]\n          resources:\n            requests:\n              cpu: \"100m\"\n              memory: \"256Mi\"\n```\n\n```yaml\n# CronJob\napiVersion: batch\u002Fv1\nkind: CronJob\nmetadata:\n  name: cleanup-job\n  namespace: my-namespace\nspec:\n  schedule: \"0 2 * * *\"         # 2am daily\n  concurrencyPolicy: Forbid      # Don't run if previous still running\n  successfulJobsHistoryLimit: 3\n  failedJobsHistoryLimit: 1\n  jobTemplate:\n    spec:\n      template:\n        spec:\n          restartPolicy: OnFailure\n          containers:\n            - name: cleanup\n              image: ghcr.io\u002Forg\u002Fcleanup:1.0.0\n              resources:\n                requests:\n                  cpu: \"50m\"\n                  memory: \"64Mi\"\n```\n\n---\n\n## kubectl Debugging Cheatsheet\n\n```bash\n# --- Pod status and logs ---\nkubectl get pods -n my-namespace\nkubectl get pods -n my-namespace -o wide          # Show node assignment\nkubectl describe pod \u003Cpod-name> -n my-namespace   # Events and state details\nkubectl logs \u003Cpod-name> -n my-namespace           # Current logs\nkubectl logs \u003Cpod-name> -n my-namespace --previous  # Logs from crashed container\nkubectl logs \u003Cpod-name> -n my-namespace -c \u003Ccontainer>  # Multi-container pod\n\n# --- Execute into a running container ---\nkubectl exec -it \u003Cpod-name> -n my-namespace -- sh\nkubectl exec -it \u003Cpod-name> -n my-namespace -- bash\n\n# --- Check resource usage ---\nkubectl top pods -n my-namespace\nkubectl top nodes\n\n# --- Deployment operations ---\nkubectl rollout status deployment\u002Fmy-app -n my-namespace\nkubectl rollout history deployment\u002Fmy-app -n my-namespace\nkubectl rollout undo deployment\u002Fmy-app -n my-namespace      # Rollback\nkubectl rollout undo deployment\u002Fmy-app --to-revision=2 -n my-namespace\n\n# --- Scale manually ---\nkubectl scale deployment my-app --replicas=5 -n my-namespace\n\n# --- Inspect events (cluster-wide issues) ---\nkubectl get events -n my-namespace --sort-by='.lastTimestamp'\n\n# --- Port-forward for local debugging ---\nkubectl port-forward pod\u002F\u003Cpod-name> 8080:8080 -n my-namespace\nkubectl port-forward svc\u002Fmy-app 8080:80 -n my-namespace\n\n# --- Dry-run to validate YAML ---\nkubectl apply -f deployment.yaml --dry-run=client\nkubectl apply -f deployment.yaml --dry-run=server   # Validates against live cluster\n```\n\n### Diagnosing Common Errors\n\n```bash\n# CrashLoopBackOff: container keeps crashing\nkubectl logs \u003Cpod-name> --previous -n my-namespace  # Check crash logs\nkubectl describe pod \u003Cpod-name> -n my-namespace     # Check exit code & OOMKilled\n\n# ImagePullBackOff: can't pull image\nkubectl describe pod \u003Cpod-name> -n my-namespace     # Check Events section\n# Causes: wrong image tag, missing imagePullSecret, private registry\n\n# Pending pod: not scheduled\nkubectl describe pod \u003Cpod-name> -n my-namespace\n# Causes: insufficient resources, no matching node selector, taint\u002Ftoleration mismatch\n\n# OOMKilled: out of memory\n# Increase memory limits, check for memory leaks\nkubectl describe pod \u003Cpod-name> -n my-namespace | grep -A5 \"Last State\"\n```\n\n---\n\n## Anti-Patterns\n\n```yaml\n# BAD: Using :latest tag — non-deterministic deployments\nimage: myapp:latest\n\n# GOOD: Pin to a specific immutable tag (SHA or semver)\nimage: ghcr.io\u002Forg\u002Fmyapp:1.4.2\n# or\nimage: ghcr.io\u002Forg\u002Fmyapp@sha256:abc123...\n\n# ---\n\n# BAD: Running as root\nsecurityContext: {}    # Defaults to root\n\n# GOOD: Non-root with explicit UID\nsecurityContext:\n  runAsNonRoot: true\n  runAsUser: 1001\n\n# ---\n\n# BAD: No resource limits — one pod can starve the entire node\ncontainers:\n  - name: app\n    image: myapp:1.0.0\n    # No resources defined\n\n# GOOD: Always set requests and limits\nresources:\n  requests:\n    cpu: \"100m\"\n    memory: \"128Mi\"\n  limits:\n    cpu: \"500m\"\n    memory: \"256Mi\"\n\n# ---\n\n# BAD: Storing plaintext secrets in ConfigMaps\napiVersion: v1\nkind: ConfigMap\ndata:\n  DB_PASSWORD: \"mysecretpassword\"   # NEVER — use Secret or external secrets manager\n\n# ---\n\n# BAD: ClusterAdmin for application service accounts\napiVersion: rbac.authorization.k8s.io\u002Fv1\nkind: ClusterRoleBinding\nroleRef:\n  kind: ClusterRole\n  name: cluster-admin    # Grants god-mode to your app\n\n# ---\n\n# BAD: minAvailable: 0 in PDB — defeats the purpose\nspec:\n  minAvailable: 0\n\n# ---\n\n# BAD: restartPolicy: Always in a Job (causes infinite restart loop)\nspec:\n  restartPolicy: Always   # Use OnFailure or Never for Jobs\n```\n\n---\n\n## Best Practices Checklist\n\n### Security\n- [ ] Container runs as non-root (`runAsNonRoot: true`, `runAsUser` set)\n- [ ] `readOnlyRootFilesystem: true` with `emptyDir` for writable paths\n- [ ] `allowPrivilegeEscalation: false`\n- [ ] All capabilities dropped (`capabilities.drop: [ALL]`)\n- [ ] Dedicated ServiceAccount per app, not `default`\n- [ ] `automountServiceAccountToken: false` unless needed\n- [ ] RBAC follows least privilege (use `Role`, not `ClusterRole` unless needed)\n- [ ] Secrets managed via Sealed Secrets or External Secrets Operator\n\n### Reliability\n- [ ] All 3 probe types configured (startup + liveness + readiness)\n- [ ] Resource requests AND limits set on every container\n- [ ] `minReplicas: 2+` for any production workload\n- [ ] PodDisruptionBudget defined for stateful or critical services\n- [ ] `RollingUpdate` strategy with `maxUnavailable: 0`\n- [ ] HPA configured for variable-load services\n\n### Observability\n- [ ] App exposes `\u002Fhealth` (liveness) and `\u002Fready` (readiness) endpoints\n- [ ] Structured JSON logging (no PII in logs)\n- [ ] Resource labels: `app`, `version`, `environment`\n\n---\n\n## Related Skills\n\n- `docker-patterns` — Multi-stage Dockerfiles and image security\n- `deployment-patterns` — CI\u002FCD pipelines, rollback strategy, health check endpoints\n- `security-review` — Broader security hardening context\n- `git-workflow` — GitOps integration with K8s (ArgoCD \u002F Flux patterns)\n","# Kubernetes Patterns\n\nProduction-grade Kubernetes patterns for deploying, managing, and debugging workloads reliably.\n\n## When to Activate\n\n- Writing Kubernetes manifests (Deployments, Services, Ingress, Jobs)\n- Configuring resource requests\u002Flimits, liveness\u002Freadiness probes\n- Setting up RBAC, namespaces, or ServiceAccounts\n- Managing configuration and secrets in K8s\n- Debugging CrashLoopBackOff, OOMKilled, pending pods, or image pull errors\n- Configuring HPA (Horizontal Pod Autoscaler) or PodDisruptionBudgets\n- Reviewing K8s YAML for security or correctness\n\n## When to Use\n\n> Same as **When to Activate** above. This alias satisfies repo skill-format conventions. Use this skill any time you are writing, reviewing, or debugging Kubernetes YAML and workloads.\n\n## How It Works\n\nThis skill provides **copy-pasteable, production-grade YAML patterns** and **kubectl debugging commands** organized by task:\n\n1. **Deployment template** — A fully configured production `Deployment` with security context, rolling update strategy, all three probe types, resource limits, and environment injection from ConfigMap\u002FSecret.\n2. **Probes** — Decision table for startup vs liveness vs readiness, with correct `failureThreshold × periodSeconds` math.\n3. **Services & Ingress** — ClusterIP, LoadBalancer, and TLS Ingress patterns with cert-manager annotations.\n4. **ConfigMaps & Secrets** — `envFrom`, file-mount, and external secrets guidance.\n5. **Resource management** — Requests vs limits rules of thumb by workload type (web API, JVM, worker, sidecar).\n6. **RBAC** — Least-privilege ServiceAccount → Role → RoleBinding chain.\n7. **HPA & PDB** — Autoscaling and node-drain safety configurations.\n8. **Jobs & CronJobs** — One-off and scheduled workload patterns with correct `restartPolicy`.\n9. **kubectl cheatsheet** — Logs, exec, rollback, port-forward, dry-run, and common error diagnosis commands.\n10. **Anti-patterns & checklist** — What NOT to do, and a security\u002Freliability\u002Fobservability checklist.\n\n## Examples\n\nSee the sections below for complete, runnable examples. Quick references:\n\n| Task | Jump to |\n|------|---------|\n| Full production Deployment YAML | [Core Workload Patterns](#core-workload-patterns) |\n| Probe configuration | [Probes](#probes--liveness-readiness-startup) |\n| RBAC least-privilege setup | [RBAC](#rbac--roles-and-serviceaccounts) |\n| Debug a CrashLoopBackOff | [kubectl Debugging Cheatsheet](#kubectl-debugging-cheatsheet) |\n| Autoscaling | [HPA](#horizontal-pod-autoscaler-hpa) |\n\n---\n\n## Core Workload Patterns\n\n### Deployment — Production Template\n\n```yaml\napiVersion: apps\u002Fv1\nkind: Deployment\nmetadata:\n  name: my-app\n  namespace: my-namespace\n  labels:\n    app: my-app\n    version: \"1.0.0\"\nspec:\n  replicas: 3\n  selector:\n    matchLabels:\n      app: my-app\n  strategy:\n    type: RollingUpdate\n    rollingUpdate:\n      maxSurge: 1          # Allow 1 extra pod during update\n      maxUnavailable: 0    # Never reduce below desired count\n  template:\n    metadata:\n      labels:\n        app: my-app\n        version: \"1.0.0\"\n    spec:\n      # Security context at pod level\n      securityContext:\n        runAsNonRoot: true\n        runAsUser: 1001\n        fsGroup: 1001\n\n      # Graceful shutdown\n      terminationGracePeriodSeconds: 30\n\n      containers:\n        - name: my-app\n          image: ghcr.io\u002Forg\u002Fmy-app:1.0.0   # Never use :latest\n          imagePullPolicy: IfNotPresent\n\n          ports:\n            - containerPort: 8080\n              protocol: TCP\n\n          # Resource requests AND limits are both required\n          resources:\n            requests:\n              cpu: \"100m\"\n              memory: \"128Mi\"\n            limits:\n              cpu: \"500m\"\n              memory: \"256Mi\"\n\n          # Container security context\n          securityContext:\n            allowPrivilegeEscalation: false\n            readOnlyRootFilesystem: true\n            capabilities:\n              drop:\n                - ALL\n\n          # Probes (see Probes section below)\n          startupProbe:\n            httpGet:\n              path: \u002Fhealth\n              port: 8080\n            failureThreshold: 30\n            periodSeconds: 5\n          livenessProbe:\n            httpGet:\n              path: \u002Fhealth\n              port: 8080\n            initialDelaySeconds: 0\n            periodSeconds: 30\n            failureThreshold: 3\n          readinessProbe:\n            httpGet:\n              path: \u002Fready\n              port: 8080\n            initialDelaySeconds: 5\n            periodSeconds: 10\n            failureThreshold: 2\n\n          # Environment from ConfigMap and Secret\n          envFrom:\n            - configMapRef:\n                name: my-app-config\n          env:\n            - name: DB_PASSWORD\n              valueFrom:\n                secretKeyRef:\n                  name: my-app-secrets\n                  key: db-password\n\n          # Writable tmp directory when readOnlyRootFilesystem: true\n          volumeMounts:\n            - name: tmp\n              mountPath: \u002Ftmp\n\n      volumes:\n        - name: tmp\n          emptyDir: {}\n```\n\n---\n\n## Probes — Liveness, Readiness, Startup\n\nUnderstanding when to use each probe is critical:\n\n| Probe | Failure Action | Use For |\n|-------|---------------|---------|\n| `startupProbe` | Kills container if slow to start | Slow-starting apps (JVM, Python) |\n| `livenessProbe` | Restarts container | Deadlock \u002F hung process detection |\n| `readinessProbe` | Removes from Service endpoints | Temporary unavailability (DB reconnect) |\n\n```yaml\n# Correct pattern: startupProbe covers slow startup,\n# then liveness\u002Freadiness take over\nstartupProbe:\n  httpGet:\n    path: \u002Fhealth\n    port: 8080\n  failureThreshold: 30  # 30 * 5s = 150s max startup time\n  periodSeconds: 5\n\nlivenessProbe:\n  httpGet:\n    path: \u002Fhealth\n    port: 8080\n  periodSeconds: 30\n  failureThreshold: 3   # 3 * 30s = 90s before restart\n\nreadinessProbe:\n  httpGet:\n    path: \u002Fready         # Separate endpoint: checks DB, cache, etc.\n    port: 8080\n  periodSeconds: 10\n  failureThreshold: 2\n```\n\n```yaml\n# WRONG: initialDelaySeconds without startupProbe\n# If the app takes 60s to start, set a startupProbe instead\nlivenessProbe:\n  httpGet:\n    path: \u002Fhealth\n    port: 8080\n  initialDelaySeconds: 60   # BAD: Arbitrary wait, race condition\n```\n\n---\n\n## Services and Ingress\n\n### Service Types\n\n```yaml\n# ClusterIP (default) — internal-only\napiVersion: v1\nkind: Service\nmetadata:\n  name: my-app\n  namespace: my-namespace\nspec:\n  selector:\n    app: my-app\n  ports:\n    - port: 80\n      targetPort: 8080\n      protocol: TCP\n  type: ClusterIP\n```\n\n```yaml\n# LoadBalancer — external traffic (cloud providers)\nspec:\n  type: LoadBalancer\n  ports:\n    - port: 443\n      targetPort: 8080\n```\n\n### Ingress with TLS\n\n```yaml\napiVersion: networking.k8s.io\u002Fv1\nkind: Ingress\nmetadata:\n  name: my-app\n  namespace: my-namespace\n  annotations:\n    nginx.ingress.kubernetes.io\u002Fssl-redirect: \"true\"\n    cert-manager.io\u002Fcluster-issuer: \"letsencrypt-prod\"\nspec:\n  ingressClassName: nginx\n  tls:\n    - hosts:\n        - myapp.example.com\n      secretName: my-app-tls\n  rules:\n    - host: myapp.example.com\n      http:\n        paths:\n          - path: \u002F\n            pathType: Prefix\n            backend:\n              service:\n                name: my-app\n                port:\n                  number: 80\n```\n\n---\n\n## ConfigMaps and Secrets\n\n### ConfigMap — Non-sensitive configuration\n\n```yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: my-app-config\n  namespace: my-namespace\ndata:\n  LOG_LEVEL: \"info\"\n  APP_ENV: \"production\"\n  MAX_CONNECTIONS: \"100\"\n  # Mount as a file for complex config\n  app.yaml: |\n    server:\n      port: 8080\n      timeout: 30s\n```\n\n```yaml\n# Mount ConfigMap as a file\nvolumes:\n  - name: config\n    configMap:\n      name: my-app-config\n      items:\n        - key: app.yaml\n          path: app.yaml\nvolumeMounts:\n  - name: config\n    mountPath: \u002Fetc\u002Fapp\n    readOnly: true\n```\n\n### Secrets — Sensitive data\n\n```bash\n# Create secret from literal (CLI, then store in Vault\u002FSOPS)\nkubectl create secret generic my-app-secrets \\\n  --from-literal=db-password='s3cr3t' \\\n  --namespace=my-namespace \\\n  --dry-run=client -o yaml | kubectl apply -f -\n```\n\n```yaml\napiVersion: v1\nkind: Secret\nmetadata:\n  name: my-app-secrets\n  namespace: my-namespace\ntype: Opaque\n# Values are base64-encoded (NOT encrypted — use Sealed Secrets or ESO for real encryption)\ndata:\n  db-password: czNjcjN0  # base64 of 's3cr3t'\n```\n\n> **Important:** Raw Kubernetes Secrets are only base64-encoded, not encrypted at rest unless your cluster has encryption configured. Use [Sealed Secrets](https:\u002F\u002Fgithub.com\u002Fbitnami-labs\u002Fsealed-secrets) or [External Secrets Operator](https:\u002F\u002Fexternal-secrets.io) for production.\n\n---\n\n## Resource Requests and Limits\n\n```yaml\nresources:\n  requests:       # Scheduler uses this to place the pod\n    cpu: \"100m\"   # 100 millicores = 0.1 CPU\n    memory: \"128Mi\"\n  limits:         # Container is killed\u002Fthrottled above this\n    cpu: \"500m\"\n    memory: \"256Mi\"\n```\n\n**Rules of thumb:**\n\n| Workload Type | CPU Request | Memory Request | Notes |\n|---------------|-------------|----------------|-------|\n| Web API | 100–250m | 128–256Mi | Set limits 2-4x requests |\n| Worker\u002Fconsumer | 250–500m | 256–512Mi | Memory limit = request for predictability |\n| JVM app | 500m–1 | 512Mi–2Gi | Allow headroom above `-Xmx` for JVM overhead |\n| Sidecar | 10–50m | 32–64Mi | Keep minimal |\n\n```yaml\n# WRONG: No requests or limits — unpredictable scheduling, OOM evictions\ncontainers:\n  - name: app\n    image: myapp:latest\n    # Missing resources: {} — this is dangerous in production\n\n# WRONG: Limits without requests — requests default to limits, over-reserves capacity\nresources:\n  limits:\n    cpu: \"2\"\n    memory: \"1Gi\"\n  # requests missing — will default to limits values\n```\n\n---\n\n## RBAC — Roles and ServiceAccounts\n\n### Principle of Least Privilege\n\n**Two patterns depending on whether the app calls the Kubernetes API:**\n\n#### Pattern A — App does NOT need the Kubernetes API (most apps)\n\nDisable token automounting on the ServiceAccount. The Role\u002FRoleBinding are not needed.\n\n```yaml\n# ServiceAccount with token disabled — safest default\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  name: my-app-sa\n  namespace: my-namespace\nautomountServiceAccountToken: false   # No K8s API token injected into pods\n```\n\n```yaml\n# Reference in Deployment — no token, no API access\nspec:\n  template:\n    spec:\n      serviceAccountName: my-app-sa\n      automountServiceAccountToken: false   # Belt-and-suspenders: also set at pod level\n```\n\n#### Pattern B — App DOES need the Kubernetes API (operators, controllers, config watchers)\n\nEnable the token and grant only the permissions actually required.\n\n```yaml\n# 1. ServiceAccount — enable token for this SA\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  name: my-app-sa\n  namespace: my-namespace\nautomountServiceAccountToken: true    # Token required: app calls K8s API\n```\n\n```yaml\n# 2. Role — grant only what the app needs (namespace-scoped)\napiVersion: rbac.authorization.k8s.io\u002Fv1\nkind: Role\nmetadata:\n  name: my-app-role\n  namespace: my-namespace\nrules:\n  - apiGroups: [\"\"]\n    resources: [\"configmaps\"]\n    verbs: [\"get\", \"list\", \"watch\"]    # Read-only, specific resource\n  - apiGroups: [\"\"]\n    resources: [\"secrets\"]\n    resourceNames: [\"my-app-secrets\"]  # Restrict to specific secret by name\n    verbs: [\"get\"]\n```\n\n```yaml\n# 3. Bind Role to ServiceAccount\napiVersion: rbac.authorization.k8s.io\u002Fv1\nkind: RoleBinding\nmetadata:\n  name: my-app-rolebinding\n  namespace: my-namespace\nsubjects:\n  - kind: ServiceAccount\n    name: my-app-sa\n    namespace: my-namespace\nroleRef:\n  kind: Role\n  apiGroup: rbac.authorization.k8s.io\n  name: my-app-role\n```\n\n```yaml\n# 4. Reference SA in Deployment\nspec:\n  template:\n    spec:\n      serviceAccountName: my-app-sa\n      # automountServiceAccountToken defaults to true from SA — token is injected\n```\n\n---\n\n## Horizontal Pod Autoscaler (HPA)\n\n```yaml\napiVersion: autoscaling\u002Fv2\nkind: HorizontalPodAutoscaler\nmetadata:\n  name: my-app-hpa\n  namespace: my-namespace\nspec:\n  scaleTargetRef:\n    apiVersion: apps\u002Fv1\n    kind: Deployment\n    name: my-app\n  minReplicas: 2      # Always at least 2 for HA\n  maxReplicas: 10\n  metrics:\n    - type: Resource\n      resource:\n        name: cpu\n        target:\n          type: Utilization\n          averageUtilization: 70    # Scale up when avg CPU > 70%\n    - type: Resource\n      resource:\n        name: memory\n        target:\n          type: Utilization\n          averageUtilization: 80\n```\n\n> HPA requires `resources.requests` to be set on all containers — it calculates utilization as `current \u002F request`.\n\n---\n\n## PodDisruptionBudget (PDB)\n\nPrevent too many pods going down during node drains or rolling updates:\n\n```yaml\napiVersion: policy\u002Fv1\nkind: PodDisruptionBudget\nmetadata:\n  name: my-app-pdb\n  namespace: my-namespace\nspec:\n  minAvailable: 2           # OR use maxUnavailable: 1\n  selector:\n    matchLabels:\n      app: my-app\n```\n\n---\n\n## Namespaces and Multi-Tenancy\n\n```bash\n# Create namespace with resource quotas\nkubectl create namespace my-namespace\n\n# Apply ResourceQuota to limit namespace consumption\nkubectl apply -f - \u003C\u003CEOF\napiVersion: v1\nkind: ResourceQuota\nmetadata:\n  name: my-namespace-quota\n  namespace: my-namespace\nspec:\n  hard:\n    requests.cpu: \"4\"\n    requests.memory: 4Gi\n    limits.cpu: \"8\"\n    limits.memory: 8Gi\n    pods: \"20\"\nEOF\n```\n\n---\n\n## Jobs and CronJobs\n\n```yaml\n# One-off Job (DB migration, data processing)\napiVersion: batch\u002Fv1\nkind: Job\nmetadata:\n  name: db-migrate\n  namespace: my-namespace\nspec:\n  backoffLimit: 3          # Retry up to 3 times on failure\n  ttlSecondsAfterFinished: 3600   # Auto-delete after 1h\n  template:\n    spec:\n      restartPolicy: OnFailure    # Never for Jobs (not Always)\n      containers:\n        - name: migrate\n          image: ghcr.io\u002Forg\u002Fmy-app:1.0.0\n          command: [\"python\", \"manage.py\", \"migrate\"]\n          resources:\n            requests:\n              cpu: \"100m\"\n              memory: \"256Mi\"\n```\n\n```yaml\n# CronJob\napiVersion: batch\u002Fv1\nkind: CronJob\nmetadata:\n  name: cleanup-job\n  namespace: my-namespace\nspec:\n  schedule: \"0 2 * * *\"         # 2am daily\n  concurrencyPolicy: Forbid      # Don't run if previous still running\n  successfulJobsHistoryLimit: 3\n  failedJobsHistoryLimit: 1\n  jobTemplate:\n    spec:\n      template:\n        spec:\n          restartPolicy: OnFailure\n          containers:\n            - name: cleanup\n              image: ghcr.io\u002Forg\u002Fcleanup:1.0.0\n              resources:\n                requests:\n                  cpu: \"50m\"\n                  memory: \"64Mi\"\n```\n\n---\n\n## kubectl Debugging Cheatsheet\n\n```bash\n# --- Pod status and logs ---\nkubectl get pods -n my-namespace\nkubectl get pods -n my-namespace -o wide          # Show node assignment\nkubectl describe pod \u003Cpod-name> -n my-namespace   # Events and state details\nkubectl logs \u003Cpod-name> -n my-namespace           # Current logs\nkubectl logs \u003Cpod-name> -n my-namespace --previous  # Logs from crashed container\nkubectl logs \u003Cpod-name> -n my-namespace -c \u003Ccontainer>  # Multi-container pod\n\n# --- Execute into a running container ---\nkubectl exec -it \u003Cpod-name> -n my-namespace -- sh\nkubectl exec -it \u003Cpod-name> -n my-namespace -- bash\n\n# --- Check resource usage ---\nkubectl top pods -n my-namespace\nkubectl top nodes\n\n# --- Deployment operations ---\nkubectl rollout status deployment\u002Fmy-app -n my-namespace\nkubectl rollout history deployment\u002Fmy-app -n my-namespace\nkubectl rollout undo deployment\u002Fmy-app -n my-namespace      # Rollback\nkubectl rollout undo deployment\u002Fmy-app --to-revision=2 -n my-namespace\n\n# --- Scale manually ---\nkubectl scale deployment my-app --replicas=5 -n my-namespace\n\n# --- Inspect events (cluster-wide issues) ---\nkubectl get events -n my-namespace --sort-by='.lastTimestamp'\n\n# --- Port-forward for local debugging ---\nkubectl port-forward pod\u002F\u003Cpod-name> 8080:8080 -n my-namespace\nkubectl port-forward svc\u002Fmy-app 8080:80 -n my-namespace\n\n# --- Dry-run to validate YAML ---\nkubectl apply -f deployment.yaml --dry-run=client\nkubectl apply -f deployment.yaml --dry-run=server   # Validates against live cluster\n```\n\n### Diagnosing Common Errors\n\n```bash\n# CrashLoopBackOff: container keeps crashing\nkubectl logs \u003Cpod-name> --previous -n my-namespace  # Check crash logs\nkubectl describe pod \u003Cpod-name> -n my-namespace     # Check exit code & OOMKilled\n\n# ImagePullBackOff: can't pull image\nkubectl describe pod \u003Cpod-name> -n my-namespace     # Check Events section\n# Causes: wrong image tag, missing imagePullSecret, private registry\n\n# Pending pod: not scheduled\nkubectl describe pod \u003Cpod-name> -n my-namespace\n# Causes: insufficient resources, no matching node selector, taint\u002Ftoleration mismatch\n\n# OOMKilled: out of memory\n# Increase memory limits, check for memory leaks\nkubectl describe pod \u003Cpod-name> -n my-namespace | grep -A5 \"Last State\"\n```\n\n---\n\n## Anti-Patterns\n\n```yaml\n# BAD: Using :latest tag — non-deterministic deployments\nimage: myapp:latest\n\n# GOOD: Pin to a specific immutable tag (SHA or semver)\nimage: ghcr.io\u002Forg\u002Fmyapp:1.4.2\n# or\nimage: ghcr.io\u002Forg\u002Fmyapp@sha256:abc123...\n\n# ---\n\n# BAD: Running as root\nsecurityContext: {}    # Defaults to root\n\n# GOOD: Non-root with explicit UID\nsecurityContext:\n  runAsNonRoot: true\n  runAsUser: 1001\n\n# ---\n\n# BAD: No resource limits — one pod can starve the entire node\ncontainers:\n  - name: app\n    image: myapp:1.0.0\n    # No resources defined\n\n# GOOD: Always set requests and limits\nresources:\n  requests:\n    cpu: \"100m\"\n    memory: \"128Mi\"\n  limits:\n    cpu: \"500m\"\n    memory: \"256Mi\"\n\n# ---\n\n# BAD: Storing plaintext secrets in ConfigMaps\napiVersion: v1\nkind: ConfigMap\ndata:\n  DB_PASSWORD: \"mysecretpassword\"   # NEVER — use Secret or external secrets manager\n\n# ---\n\n# BAD: ClusterAdmin for application service accounts\napiVersion: rbac.authorization.k8s.io\u002Fv1\nkind: ClusterRoleBinding\nroleRef:\n  kind: ClusterRole\n  name: cluster-admin    # Grants god-mode to your app\n\n# ---\n\n# BAD: minAvailable: 0 in PDB — defeats the purpose\nspec:\n  minAvailable: 0\n\n# ---\n\n# BAD: restartPolicy: Always in a Job (causes infinite restart loop)\nspec:\n  restartPolicy: Always   # Use OnFailure or Never for Jobs\n```\n\n---\n\n## Best Practices Checklist\n\n### Security\n- [ ] Container runs as non-root (`runAsNonRoot: true`, `runAsUser` set)\n- [ ] `readOnlyRootFilesystem: true` with `emptyDir` for writable paths\n- [ ] `allowPrivilegeEscalation: false`\n- [ ] All capabilities dropped (`capabilities.drop: [ALL]`)\n- [ ] Dedicated ServiceAccount per app, not `default`\n- [ ] `automountServiceAccountToken: false` unless needed\n- [ ] RBAC follows least privilege (use `Role`, not `ClusterRole` unless needed)\n- [ ] Secrets managed via Sealed Secrets or External Secrets Operator\n\n### Reliability\n- [ ] All 3 probe types configured (startup + liveness + readiness)\n- [ ] Resource requests AND limits set on every container\n- [ ] `minReplicas: 2+` for any production workload\n- [ ] PodDisruptionBudget defined for stateful or critical services\n- [ ] `RollingUpdate` strategy with `maxUnavailable: 0`\n- [ ] HPA configured for variable-load services\n\n### Observability\n- [ ] App exposes `\u002Fhealth` (liveness) and `\u002Fready` (readiness) endpoints\n- [ ] Structured JSON logging (no PII in logs)\n- [ ] Resource labels: `app`, `version`, `environment`\n\n---\n\n## Related Skills\n\n- `docker-patterns` — Multi-stage Dockerfiles and image security\n- `deployment-patterns` — CI\u002FCD pipelines, rollback strategy, health check endpoints\n- `security-review` — Broader security hardening context\n- `git-workflow` — GitOps integration with K8s (ArgoCD \u002F Flux patterns)\n",{"name":5,"metadata":49,"description":7},{"origin":50},"ECC","main","74715deacdc69119d739f38916f8ee4f0f979ebf","skills\u002Fstorage\u002Faffaan-m_ECC\u002Fkubernetes-patterns",0,"https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills","https:\u002F\u002Fgithub.com\u002Fmdnaimul22","AI Agents Workflows Automation | Specializing in Python, FastAPI, MCP Agents & Custom ERP.","2026-11-11 06:54:12",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add mdnaimul22\u002Fhuman-skills --skill kubernetes-patterns",{"tool":65,"command":66},"bunx","bunx skills add mdnaimul22\u002Fhuman-skills --skill kubernetes-patterns",{"tool":68,"command":69},"pnpm","pnpm dlx skills add mdnaimul22\u002Fhuman-skills --skill kubernetes-patterns","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Faffaan-m_ECC\u002Fkubernetes-patterns\u002FSKILL.md",true,[],[74,82,109,130,149,164],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":80,"publishedAt":81},"01M72JT3YP1SQHD0MANGDXQ4RT","higgsfield-websites","Build, edit, and deploy full-stack websites, apps and games via the Higgsfield CLI (`higgsfield website …`). Each is a React 19 + TanStack Start SSR app in one Cloudflare Worker (D1\u002FR2\u002FKV\u002FDO\u002FContainers). THREE product types, picked via `--type` on create: `website` (standalone, no Higgsfield integration — references\u002Fwebsite-flow.md), `app` (Sign in with Higgsfield + fnf SDK, Quanta — references\u002Fapp-flow.md), `game` (realtime multiplayer rooms — references\u002Fgame-flow.md). Routes to the right flow; each carries its own rules and deploy\u002Fpublish gates.\nUse when: \"build me a website\", \"make a landing page\", \"create a web app\", \"build a SaaS dashboard \u002F portfolio\", \"make me a game\", \"deploy this site\", \"publish\". Also owns GAME ART: \"make a spritesheet\", \"tileable texture\", \"animate a 3D character\", game music\u002FSFX — see the game-* references.\nNOT for: single image\u002Fvideo\u002Faudio generation (higgsfield-generate), product photos (higgsfield-product-photoshoot), marketplace cards (higgsfield-marketplace-cards).","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fhiggsfield-ai_skills\u002Fhiggsfield-websites\u002FSKILL.md",[],[],"2026-11-10 22:39:42",{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":102,"publishedAt":44},"01M70JPK8HAXXA85P7Q8NKZZYG","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fobra_superpowers\u002Fwriting-skills\u002FSKILL.md",[88,91,96,99],{"categoryNo":89,"categoryName":90,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":92,"categoryName":93,"taxonomyType":94,"taxonomyTypeDesc":95},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",{"categoryNo":97,"categoryName":98,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":100,"categoryName":101,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[40,103,104,105,29,106,107,37,108],"writing skills","editing","deployment","Existing","new","work",{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":120,"publishedAt":44},"01M70JP4PHBH1CQVVDWZ94W159","writing-plans","Use when you have a spec or requirements for a multi-step task, before touching code","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fobra_superpowers\u002Fwriting-plans\u002FSKILL.md",[115,116,117],{"categoryNo":89,"categoryName":90,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":92,"categoryName":93,"taxonomyType":94,"taxonomyTypeDesc":95},{"categoryNo":118,"categoryName":119,"taxonomyType":94,"taxonomyTypeDesc":95},"01JBSEEDCAT000000000000030","开发工程师",[40,121,122,123,37,124,31,29,125,126,127,128,129],"writing plans","plans","you","code","requirements","task","multi","spec","multi-step task",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":136,"publishedAt":44},"01M70JNTYVGXFZT8PASZ844TH8","verification-before-completion","Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fobra_superpowers\u002Fverification-before-completion\u002FSKILL.md",[],[137,138,139,140,141,142,29,143,144,145,37,146,108,147,148],"verification","verification before completion","complete","about","output","assertions","prs","evidence","claim","claims","commands","running",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":156,"publishedAt":44},"01M70JNGVSQDESWN0Q5BPJ875V","using-superpowers","Use when starting any conversation - establishes how to find and use skills, requiring skill invocation before ANY response including clarifying questions","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fobra_superpowers\u002Fusing-superpowers\u002FSKILL.md",[155],{"categoryNo":97,"categoryName":98,"taxonomyType":21,"taxonomyTypeDesc":22},[157,158,159,160,29,37,161,162,163],"using superpowers","superpowers","conversation","how to","how","find","questions",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":170,"publishedAt":44},"01M70JN57CE588NPYPYTWH1DWG","using-git-worktrees","Use when starting feature work that needs isolation from current workspace or before executing implementation plans - ensures an isolated workspace exists via native tools or git worktree fallback","https:\u002F\u002Fgithub.com\u002Fmdnaimul22\u002Fhuman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fstorage\u002Fobra_superpowers\u002Fusing-git-worktrees\u002FSKILL.md",[],[171,172,173,174,175,176,37,108,177,178,179,180,181,182,183,122,29,184,185],"using git worktrees","Using git","git","worktrees","git worktrees","implementation","git worktree","worktree","native","Tools","isolation","fallback","feature","via","workspace"]