[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M799CJWTY4EXVKCT2MWHDG19":3,"skill-same:01M799CJWTY4EXVKCT2MWHDG19":45},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":25,"commitSha":26,"skillDirectory":27,"forksCount":14,"repositoryHtmlUrl":28,"repositoryHomepageUrl":6,"ownerHtmlUrl":29,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":30,"install":31,"resources":44},"01M799CJWTY4EXVKCT2MWHDG19","kubernetes-patterns",null,"Kubernetes deployment patterns, manifests, helm charts, service mesh, autoscaling, monitoring, and production-ready cluster management.","pjherron\u002Fhypoc","pjherron","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F800763?v=4","01M799C7XC0XKKW2D6RMYNHCY8","Patrick Herron","01M799C7XZPGZ9QZ7XAQN5MQAN",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fpjherron\u002Fhypoc\u002Fblob\u002Fmain\u002Fenterprise-toolkit\u002Fskills\u002Fkubernetes-patterns\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: kubernetes-patterns\ndescription: Kubernetes deployment patterns, manifests, helm charts, service mesh, autoscaling, monitoring, and production-ready cluster management.\norigin: Custom\n---\n\n# Kubernetes Patterns\n\nProduction-ready Kubernetes deployment and operations patterns.\n\n## When to Activate\n\n- Deploying applications to Kubernetes\n- Writing K8s manifests or Helm charts\n- Setting up ingress, services, autoscaling\n- Implementing monitoring and logging\n- Managing secrets and ConfigMaps\n- Troubleshooting cluster issues\n\n## Core Concepts\n\n### Pod - Smallest Deployable Unit\n\n```yaml\napiVersion: v1\nkind: Pod\nmetadata:\n  name: myapp\n  labels:\n    app: myapp\nspec:\n  containers:\n  - name: app\n    image: myapp:1.0\n    ports:\n    - containerPort: 8000\n    env:\n    - name: DATABASE_URL\n      valueFrom:\n        secretKeyRef:\n          name: db-credentials\n          key: url\n    resources:\n      requests:\n        memory: \"128Mi\"\n        cpu: \"100m\"\n      limits:\n        memory: \"256Mi\"\n        cpu: \"200m\"\n    livenessProbe:\n      httpGet:\n        path: \u002Fhealth\n        port: 8000\n      initialDelaySeconds: 30\n      periodSeconds: 10\n    readinessProbe:\n      httpGet:\n        path: \u002Fready\n        port: 8000\n      initialDelaySeconds: 5\n      periodSeconds: 5\n```\n\n### Deployment - Manages ReplicaSets\n\n```yaml\napiVersion: apps\u002Fv1\nkind: Deployment\nmetadata:\n  name: myapp\n  labels:\n    app: myapp\nspec:\n  replicas: 3\n  strategy:\n    type: RollingUpdate\n    rollingUpdate:\n      maxSurge: 1\n      maxUnavailable: 0\n  selector:\n    matchLabels:\n      app: myapp\n  template:\n    metadata:\n      labels:\n        app: myapp\n        version: v1\n    spec:\n      containers:\n      - name: app\n        image: myapp:1.0\n        ports:\n        - containerPort: 8000\n        envFrom:\n        - configMapRef:\n            name: myapp-config\n        - secretRef:\n            name: myapp-secrets\n        resources:\n          requests:\n            memory: \"256Mi\"\n            cpu: \"200m\"\n          limits:\n            memory: \"512Mi\"\n            cpu: \"500m\"\n```\n\n### Service - Network Abstraction\n\n```yaml\napiVersion: v1\nkind: Service\nmetadata:\n  name: myapp\nspec:\n  selector:\n    app: myapp\n  ports:\n  - protocol: TCP\n    port: 80\n    targetPort: 8000\n  type: ClusterIP  # Internal only\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: myapp-external\nspec:\n  selector:\n    app: myapp\n  ports:\n  - protocol: TCP\n    port: 80\n    targetPort: 8000\n  type: LoadBhypoccer  # External access\n```\n\n### Ingress - HTTP(S) Routing\n\n```yaml\napiVersion: networking.k8s.io\u002Fv1\nkind: Ingress\nmetadata:\n  name: myapp\n  annotations:\n    kubernetes.io\u002Fingress.class: nginx\n    cert-manager.io\u002Fcluster-issuer: letsencrypt-prod\n    nginx.ingress.kubernetes.io\u002Frate-limit: \"100\"\nspec:\n  tls:\n  - hosts:\n    - myapp.example.com\n    secretName: myapp-tls\n  rules:\n  - host: myapp.example.com\n    http:\n      paths:\n      - path: \u002F\n        pathType: Prefix\n        backend:\n          service:\n            name: myapp\n            port:\n              number: 80\n```\n\n### ConfigMap - Configuration Data\n\n```yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: myapp-config\ndata:\n  APP_ENV: \"production\"\n  LOG_LEVEL: \"info\"\n  API_TIMEOUT: \"30\"\n  config.yaml: |\n    database:\n      pool_size: 10\n      timeout: 5\n```\n\n### Secret - Sensitive Data\n\n```yaml\napiVersion: v1\nkind: Secret\nmetadata:\n  name: myapp-secrets\ntype: Opaque\nstringData:\n  DB_PASSWORD: \"my-secret-password\"\n  API_KEY: \"sk-xxxxx\"\n---\n# Reference in Pod\nspec:\n  containers:\n  - name: app\n    env:\n    - name: DB_PASSWORD\n      valueFrom:\n        secretKeyRef:\n          name: myapp-secrets\n          key: DB_PASSWORD\n```\n\n## Autoscaling\n\n### Horizontal Pod Autoscaler (HPA)\n\n```yaml\napiVersion: autoscaling\u002Fv2\nkind: HorizontalPodAutoscaler\nmetadata:\n  name: myapp-hpa\nspec:\n  scaleTargetRef:\n    apiVersion: apps\u002Fv1\n    kind: Deployment\n    name: myapp\n  minReplicas: 2\n  maxReplicas: 10\n  metrics:\n  - type: Resource\n    resource:\n      name: cpu\n      target:\n        type: Utilization\n        averageUtilization: 70\n  - type: Resource\n    resource:\n      name: memory\n      target:\n        type: Utilization\n        averageUtilization: 80\n  behavior:\n    scaleDown:\n      stabilizationWindowSeconds: 300\n      policies:\n      - type: Percent\n        value: 50\n        periodSeconds: 60\n    scaleUp:\n      stabilizationWindowSeconds: 0\n      policies:\n      - type: Percent\n        value: 100\n        periodSeconds: 15\n```\n\n### Vertical Pod Autoscaler (VPA)\n\n```yaml\napiVersion: autoscaling.k8s.io\u002Fv1\nkind: VerticalPodAutoscaler\nmetadata:\n  name: myapp-vpa\nspec:\n  targetRef:\n    apiVersion: apps\u002Fv1\n    kind: Deployment\n    name: myapp\n  updatePolicy:\n    updateMode: \"Auto\"  # or \"Off\" for recommendations only\n  resourcePolicy:\n    containerPolicies:\n    - containerName: app\n      minAllowed:\n        cpu: 100m\n        memory: 128Mi\n      maxAllowed:\n        cpu: 2\n        memory: 2Gi\n```\n\n## Persistent Storage\n\n### PersistentVolumeClaim\n\n```yaml\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n  name: postgres-data\nspec:\n  accessModes:\n  - ReadWriteOnce\n  resources:\n    requests:\n      storage: 10Gi\n  storageClassName: gp3  # AWS EBS gp3\n---\n# Use in Pod\nspec:\n  containers:\n  - name: postgres\n    image: postgres:15\n    volumeMounts:\n    - name: data\n      mountPath: \u002Fvar\u002Flib\u002Fpostgresql\u002Fdata\n  volumes:\n  - name: data\n    persistentVolumeClaim:\n      claimName: postgres-data\n```\n\n## Jobs & CronJobs\n\n### Job - Run to Completion\n\n```yaml\napiVersion: batch\u002Fv1\nkind: Job\nmetadata:\n  name: data-migration\nspec:\n  template:\n    spec:\n      containers:\n      - name: migrate\n        image: myapp:1.0\n        command: [\"python\", \"manage.py\", \"migrate\"]\n      restartPolicy: OnFailure\n  backoffLimit: 3\n```\n\n### CronJob - Scheduled Tasks\n\n```yaml\napiVersion: batch\u002Fv1\nkind: CronJob\nmetadata:\n  name: backup\nspec:\n  schedule: \"0 2 * * *\"  # 2 AM daily\n  jobTemplate:\n    spec:\n      template:\n        spec:\n          containers:\n          - name: backup\n            image: myapp:1.0\n            command: [\"python\", \"scripts\u002Fbackup.py\"]\n          restartPolicy: OnFailure\n```\n\n## Monitoring & Logging\n\n### Prometheus Annotations\n\n```yaml\napiVersion: v1\nkind: Service\nmetadata:\n  name: myapp\n  annotations:\n    prometheus.io\u002Fscrape: \"true\"\n    prometheus.io\u002Fport: \"8000\"\n    prometheus.io\u002Fpath: \"\u002Fmetrics\"\nspec:\n  selector:\n    app: myapp\n  ports:\n  - port: 80\n    targetPort: 8000\n```\n\n### Logging to stdout\u002Fstderr\n\n```python\nimport logging\nimport sys\n\n# Configure structured logging\nlogging.basicConfig(\n    level=logging.INFO,\n    format='{\"time\":\"%(asctime)s\",\"level\":\"%(levelname)s\",\"msg\":\"%(message)s\"}',\n    stream=sys.stdout\n)\n\nlogger = logging.getLogger(__name__)\nlogger.info(\"Application started\", extra={\"version\": \"1.0\"})\n```\n\n## Security\n\n### Pod Security Standards\n\n```yaml\napiVersion: v1\nkind: Pod\nmetadata:\n  name: secure-app\nspec:\n  securityContext:\n    runAsNonRoot: true\n    runAsUser: 1000\n    fsGroup: 2000\n    seccompProfile:\n      type: RuntimeDefault\n  containers:\n  - name: app\n    image: myapp:1.0\n    securityContext:\n      allowPrivilegeEscalation: false\n      readOnlyRootFilesystem: true\n      capabilities:\n        drop:\n        - ALL\n    volumeMounts:\n    - name: tmp\n      mountPath: \u002Ftmp\n  volumes:\n  - name: tmp\n    emptyDir: {}\n```\n\n### NetworkPolicy - Firewall Rules\n\n```yaml\napiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n  name: myapp-policy\nspec:\n  podSelector:\n    matchLabels:\n      app: myapp\n  policyTypes:\n  - Ingress\n  - Egress\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: frontend\n    ports:\n    - protocol: TCP\n      port: 8000\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n    ports:\n    - protocol: TCP\n      port: 5432\n  - to:  # Allow DNS\n    - namespaceSelector: {}\n      podSelector:\n        matchLabels:\n          k8s-app: kube-dns\n    ports:\n    - protocol: UDP\n      port: 53\n```\n\n## Helm Charts\n\n### Chart Structure\n\n```\nmyapp\u002F\n├── Chart.yaml\n├── values.yaml\n├── templates\u002F\n│   ├── deployment.yaml\n│   ├── service.yaml\n│   ├── ingress.yaml\n│   └── _helpers.tpl\n```\n\n### values.yaml\n\n```yaml\nreplicaCount: 3\n\nimage:\n  repository: myapp\n  tag: \"1.0\"\n  pullPolicy: IfNotPresent\n\nresources:\n  requests:\n    memory: \"256Mi\"\n    cpu: \"200m\"\n  limits:\n    memory: \"512Mi\"\n    cpu: \"500m\"\n\nautoscaling:\n  enabled: true\n  minReplicas: 2\n  maxReplicas: 10\n  targetCPUUtilizationPercentage: 70\n\ningress:\n  enabled: true\n  className: nginx\n  hosts:\n    - host: myapp.example.com\n      paths:\n        - path: \u002F\n          pathType: Prefix\n  tls:\n    - secretName: myapp-tls\n      hosts:\n        - myapp.example.com\n```\n\n### Helm Commands\n\n```bash\n# Install\nhelm install myapp .\u002Fmyapp -f values-prod.yaml\n\n# Upgrade\nhelm upgrade myapp .\u002Fmyapp -f values-prod.yaml\n\n# Rollback\nhelm rollback myapp 1\n\n# List releases\nhelm list\n\n# Get values\nhelm get values myapp\n```\n\n## kubectl Commands\n\n```bash\n# Apply manifests\nkubectl apply -f deployment.yaml\n\n# Get resources\nkubectl get pods\nkubectl get deployments\nkubectl get services\nkubectl get ingress\n\n# Describe resource\nkubectl describe pod myapp-xxx\n\n# View logs\nkubectl logs myapp-xxx\nkubectl logs -f myapp-xxx  # Follow\nkubectl logs myapp-xxx --previous  # Previous container\n\n# Execute command\nkubectl exec -it myapp-xxx -- bash\n\n# Port forward\nkubectl port-forward svc\u002Fmyapp 8000:80\n\n# Scale deployment\nkubectl scale deployment myapp --replicas=5\n\n# Delete resources\nkubectl delete -f deployment.yaml\nkubectl delete pod myapp-xxx\n\n# Namespace operations\nkubectl get pods -n production\nkubectl config set-context --current --namespace=production\n\n# Resource usage\nkubectl top nodes\nkubectl top pods\n```\n\n## Troubleshooting\n\n### Pod Won't Start\n\n```bash\n# Check pod status\nkubectl describe pod myapp-xxx\n\n# Common issues:\n# - ImagePullBackOff: Image doesn't exist or no pull credentials\n# - CrashLoopBackOff: Container exits immediately\n# - Pending: Insufficient resources or scheduling constraints\n\n# Check events\nkubectl get events --sort-by='.lastTimestamp'\n\n# Check logs\nkubectl logs myapp-xxx --previous\n```\n\n### Service Not Accessible\n\n```bash\n# Check service endpoints\nkubectl get endpoints myapp\n\n# If empty, selector doesn't match pods\nkubectl get pods --show-labels\n\n# Test from another pod\nkubectl run -it --rm debug --image=nicolaka\u002Fnetshoot -- bash\ncurl myapp.default.svc.cluster.local\n```\n\n### High Resource Usage\n\n```bash\n# Check resource usage\nkubectl top pods\n\n# Describe pod for limits\nkubectl describe pod myapp-xxx\n\n# Check HPA status\nkubectl get hpa\nkubectl describe hpa myapp-hpa\n```\n\n## Production Best Practices\n\n1. **Always set resource requests and limits**\n2. **Use health checks** (liveness + readiness)\n3. **Run multiple replicas** (min 2 for HA)\n4. **Use anti-affinity** to spread pods across nodes\n5. **Enable autoscaling** (HPA)\n6. **Use namespaces** for isolation\n7. **Apply security contexts** (non-root, read-only FS)\n8. **Use NetworkPolicies** for network isolation\n9. **Store secrets in external vault** (not in K8s secrets)\n10. **Tag all images** (never use :latest in prod)\n\n## Related Skills\n\n- `docker-patterns` - Container best practices\n- `deployment-patterns` - CI\u002FCD workflows\n- `aws-infrastructure` - EKS setup\n- `security-review` - Security checklist\n","# Kubernetes Patterns\n\nProduction-ready Kubernetes deployment and operations patterns.\n\n## When to Activate\n\n- Deploying applications to Kubernetes\n- Writing K8s manifests or Helm charts\n- Setting up ingress, services, autoscaling\n- Implementing monitoring and logging\n- Managing secrets and ConfigMaps\n- Troubleshooting cluster issues\n\n## Core Concepts\n\n### Pod - Smallest Deployable Unit\n\n```yaml\napiVersion: v1\nkind: Pod\nmetadata:\n  name: myapp\n  labels:\n    app: myapp\nspec:\n  containers:\n  - name: app\n    image: myapp:1.0\n    ports:\n    - containerPort: 8000\n    env:\n    - name: DATABASE_URL\n      valueFrom:\n        secretKeyRef:\n          name: db-credentials\n          key: url\n    resources:\n      requests:\n        memory: \"128Mi\"\n        cpu: \"100m\"\n      limits:\n        memory: \"256Mi\"\n        cpu: \"200m\"\n    livenessProbe:\n      httpGet:\n        path: \u002Fhealth\n        port: 8000\n      initialDelaySeconds: 30\n      periodSeconds: 10\n    readinessProbe:\n      httpGet:\n        path: \u002Fready\n        port: 8000\n      initialDelaySeconds: 5\n      periodSeconds: 5\n```\n\n### Deployment - Manages ReplicaSets\n\n```yaml\napiVersion: apps\u002Fv1\nkind: Deployment\nmetadata:\n  name: myapp\n  labels:\n    app: myapp\nspec:\n  replicas: 3\n  strategy:\n    type: RollingUpdate\n    rollingUpdate:\n      maxSurge: 1\n      maxUnavailable: 0\n  selector:\n    matchLabels:\n      app: myapp\n  template:\n    metadata:\n      labels:\n        app: myapp\n        version: v1\n    spec:\n      containers:\n      - name: app\n        image: myapp:1.0\n        ports:\n        - containerPort: 8000\n        envFrom:\n        - configMapRef:\n            name: myapp-config\n        - secretRef:\n            name: myapp-secrets\n        resources:\n          requests:\n            memory: \"256Mi\"\n            cpu: \"200m\"\n          limits:\n            memory: \"512Mi\"\n            cpu: \"500m\"\n```\n\n### Service - Network Abstraction\n\n```yaml\napiVersion: v1\nkind: Service\nmetadata:\n  name: myapp\nspec:\n  selector:\n    app: myapp\n  ports:\n  - protocol: TCP\n    port: 80\n    targetPort: 8000\n  type: ClusterIP  # Internal only\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: myapp-external\nspec:\n  selector:\n    app: myapp\n  ports:\n  - protocol: TCP\n    port: 80\n    targetPort: 8000\n  type: LoadBhypoccer  # External access\n```\n\n### Ingress - HTTP(S) Routing\n\n```yaml\napiVersion: networking.k8s.io\u002Fv1\nkind: Ingress\nmetadata:\n  name: myapp\n  annotations:\n    kubernetes.io\u002Fingress.class: nginx\n    cert-manager.io\u002Fcluster-issuer: letsencrypt-prod\n    nginx.ingress.kubernetes.io\u002Frate-limit: \"100\"\nspec:\n  tls:\n  - hosts:\n    - myapp.example.com\n    secretName: myapp-tls\n  rules:\n  - host: myapp.example.com\n    http:\n      paths:\n      - path: \u002F\n        pathType: Prefix\n        backend:\n          service:\n            name: myapp\n            port:\n              number: 80\n```\n\n### ConfigMap - Configuration Data\n\n```yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: myapp-config\ndata:\n  APP_ENV: \"production\"\n  LOG_LEVEL: \"info\"\n  API_TIMEOUT: \"30\"\n  config.yaml: |\n    database:\n      pool_size: 10\n      timeout: 5\n```\n\n### Secret - Sensitive Data\n\n```yaml\napiVersion: v1\nkind: Secret\nmetadata:\n  name: myapp-secrets\ntype: Opaque\nstringData:\n  DB_PASSWORD: \"my-secret-password\"\n  API_KEY: \"sk-xxxxx\"\n---\n# Reference in Pod\nspec:\n  containers:\n  - name: app\n    env:\n    - name: DB_PASSWORD\n      valueFrom:\n        secretKeyRef:\n          name: myapp-secrets\n          key: DB_PASSWORD\n```\n\n## Autoscaling\n\n### Horizontal Pod Autoscaler (HPA)\n\n```yaml\napiVersion: autoscaling\u002Fv2\nkind: HorizontalPodAutoscaler\nmetadata:\n  name: myapp-hpa\nspec:\n  scaleTargetRef:\n    apiVersion: apps\u002Fv1\n    kind: Deployment\n    name: myapp\n  minReplicas: 2\n  maxReplicas: 10\n  metrics:\n  - type: Resource\n    resource:\n      name: cpu\n      target:\n        type: Utilization\n        averageUtilization: 70\n  - type: Resource\n    resource:\n      name: memory\n      target:\n        type: Utilization\n        averageUtilization: 80\n  behavior:\n    scaleDown:\n      stabilizationWindowSeconds: 300\n      policies:\n      - type: Percent\n        value: 50\n        periodSeconds: 60\n    scaleUp:\n      stabilizationWindowSeconds: 0\n      policies:\n      - type: Percent\n        value: 100\n        periodSeconds: 15\n```\n\n### Vertical Pod Autoscaler (VPA)\n\n```yaml\napiVersion: autoscaling.k8s.io\u002Fv1\nkind: VerticalPodAutoscaler\nmetadata:\n  name: myapp-vpa\nspec:\n  targetRef:\n    apiVersion: apps\u002Fv1\n    kind: Deployment\n    name: myapp\n  updatePolicy:\n    updateMode: \"Auto\"  # or \"Off\" for recommendations only\n  resourcePolicy:\n    containerPolicies:\n    - containerName: app\n      minAllowed:\n        cpu: 100m\n        memory: 128Mi\n      maxAllowed:\n        cpu: 2\n        memory: 2Gi\n```\n\n## Persistent Storage\n\n### PersistentVolumeClaim\n\n```yaml\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n  name: postgres-data\nspec:\n  accessModes:\n  - ReadWriteOnce\n  resources:\n    requests:\n      storage: 10Gi\n  storageClassName: gp3  # AWS EBS gp3\n---\n# Use in Pod\nspec:\n  containers:\n  - name: postgres\n    image: postgres:15\n    volumeMounts:\n    - name: data\n      mountPath: \u002Fvar\u002Flib\u002Fpostgresql\u002Fdata\n  volumes:\n  - name: data\n    persistentVolumeClaim:\n      claimName: postgres-data\n```\n\n## Jobs & CronJobs\n\n### Job - Run to Completion\n\n```yaml\napiVersion: batch\u002Fv1\nkind: Job\nmetadata:\n  name: data-migration\nspec:\n  template:\n    spec:\n      containers:\n      - name: migrate\n        image: myapp:1.0\n        command: [\"python\", \"manage.py\", \"migrate\"]\n      restartPolicy: OnFailure\n  backoffLimit: 3\n```\n\n### CronJob - Scheduled Tasks\n\n```yaml\napiVersion: batch\u002Fv1\nkind: CronJob\nmetadata:\n  name: backup\nspec:\n  schedule: \"0 2 * * *\"  # 2 AM daily\n  jobTemplate:\n    spec:\n      template:\n        spec:\n          containers:\n          - name: backup\n            image: myapp:1.0\n            command: [\"python\", \"scripts\u002Fbackup.py\"]\n          restartPolicy: OnFailure\n```\n\n## Monitoring & Logging\n\n### Prometheus Annotations\n\n```yaml\napiVersion: v1\nkind: Service\nmetadata:\n  name: myapp\n  annotations:\n    prometheus.io\u002Fscrape: \"true\"\n    prometheus.io\u002Fport: \"8000\"\n    prometheus.io\u002Fpath: \"\u002Fmetrics\"\nspec:\n  selector:\n    app: myapp\n  ports:\n  - port: 80\n    targetPort: 8000\n```\n\n### Logging to stdout\u002Fstderr\n\n```python\nimport logging\nimport sys\n\n# Configure structured logging\nlogging.basicConfig(\n    level=logging.INFO,\n    format='{\"time\":\"%(asctime)s\",\"level\":\"%(levelname)s\",\"msg\":\"%(message)s\"}',\n    stream=sys.stdout\n)\n\nlogger = logging.getLogger(__name__)\nlogger.info(\"Application started\", extra={\"version\": \"1.0\"})\n```\n\n## Security\n\n### Pod Security Standards\n\n```yaml\napiVersion: v1\nkind: Pod\nmetadata:\n  name: secure-app\nspec:\n  securityContext:\n    runAsNonRoot: true\n    runAsUser: 1000\n    fsGroup: 2000\n    seccompProfile:\n      type: RuntimeDefault\n  containers:\n  - name: app\n    image: myapp:1.0\n    securityContext:\n      allowPrivilegeEscalation: false\n      readOnlyRootFilesystem: true\n      capabilities:\n        drop:\n        - ALL\n    volumeMounts:\n    - name: tmp\n      mountPath: \u002Ftmp\n  volumes:\n  - name: tmp\n    emptyDir: {}\n```\n\n### NetworkPolicy - Firewall Rules\n\n```yaml\napiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n  name: myapp-policy\nspec:\n  podSelector:\n    matchLabels:\n      app: myapp\n  policyTypes:\n  - Ingress\n  - Egress\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: frontend\n    ports:\n    - protocol: TCP\n      port: 8000\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n    ports:\n    - protocol: TCP\n      port: 5432\n  - to:  # Allow DNS\n    - namespaceSelector: {}\n      podSelector:\n        matchLabels:\n          k8s-app: kube-dns\n    ports:\n    - protocol: UDP\n      port: 53\n```\n\n## Helm Charts\n\n### Chart Structure\n\n```\nmyapp\u002F\n├── Chart.yaml\n├── values.yaml\n├── templates\u002F\n│   ├── deployment.yaml\n│   ├── service.yaml\n│   ├── ingress.yaml\n│   └── _helpers.tpl\n```\n\n### values.yaml\n\n```yaml\nreplicaCount: 3\n\nimage:\n  repository: myapp\n  tag: \"1.0\"\n  pullPolicy: IfNotPresent\n\nresources:\n  requests:\n    memory: \"256Mi\"\n    cpu: \"200m\"\n  limits:\n    memory: \"512Mi\"\n    cpu: \"500m\"\n\nautoscaling:\n  enabled: true\n  minReplicas: 2\n  maxReplicas: 10\n  targetCPUUtilizationPercentage: 70\n\ningress:\n  enabled: true\n  className: nginx\n  hosts:\n    - host: myapp.example.com\n      paths:\n        - path: \u002F\n          pathType: Prefix\n  tls:\n    - secretName: myapp-tls\n      hosts:\n        - myapp.example.com\n```\n\n### Helm Commands\n\n```bash\n# Install\nhelm install myapp .\u002Fmyapp -f values-prod.yaml\n\n# Upgrade\nhelm upgrade myapp .\u002Fmyapp -f values-prod.yaml\n\n# Rollback\nhelm rollback myapp 1\n\n# List releases\nhelm list\n\n# Get values\nhelm get values myapp\n```\n\n## kubectl Commands\n\n```bash\n# Apply manifests\nkubectl apply -f deployment.yaml\n\n# Get resources\nkubectl get pods\nkubectl get deployments\nkubectl get services\nkubectl get ingress\n\n# Describe resource\nkubectl describe pod myapp-xxx\n\n# View logs\nkubectl logs myapp-xxx\nkubectl logs -f myapp-xxx  # Follow\nkubectl logs myapp-xxx --previous  # Previous container\n\n# Execute command\nkubectl exec -it myapp-xxx -- bash\n\n# Port forward\nkubectl port-forward svc\u002Fmyapp 8000:80\n\n# Scale deployment\nkubectl scale deployment myapp --replicas=5\n\n# Delete resources\nkubectl delete -f deployment.yaml\nkubectl delete pod myapp-xxx\n\n# Namespace operations\nkubectl get pods -n production\nkubectl config set-context --current --namespace=production\n\n# Resource usage\nkubectl top nodes\nkubectl top pods\n```\n\n## Troubleshooting\n\n### Pod Won't Start\n\n```bash\n# Check pod status\nkubectl describe pod myapp-xxx\n\n# Common issues:\n# - ImagePullBackOff: Image doesn't exist or no pull credentials\n# - CrashLoopBackOff: Container exits immediately\n# - Pending: Insufficient resources or scheduling constraints\n\n# Check events\nkubectl get events --sort-by='.lastTimestamp'\n\n# Check logs\nkubectl logs myapp-xxx --previous\n```\n\n### Service Not Accessible\n\n```bash\n# Check service endpoints\nkubectl get endpoints myapp\n\n# If empty, selector doesn't match pods\nkubectl get pods --show-labels\n\n# Test from another pod\nkubectl run -it --rm debug --image=nicolaka\u002Fnetshoot -- bash\ncurl myapp.default.svc.cluster.local\n```\n\n### High Resource Usage\n\n```bash\n# Check resource usage\nkubectl top pods\n\n# Describe pod for limits\nkubectl describe pod myapp-xxx\n\n# Check HPA status\nkubectl get hpa\nkubectl describe hpa myapp-hpa\n```\n\n## Production Best Practices\n\n1. **Always set resource requests and limits**\n2. **Use health checks** (liveness + readiness)\n3. **Run multiple replicas** (min 2 for HA)\n4. **Use anti-affinity** to spread pods across nodes\n5. **Enable autoscaling** (HPA)\n6. **Use namespaces** for isolation\n7. **Apply security contexts** (non-root, read-only FS)\n8. **Use NetworkPolicies** for network isolation\n9. **Store secrets in external vault** (not in K8s secrets)\n10. **Tag all images** (never use :latest in prod)\n\n## Related Skills\n\n- `docker-patterns` - Container best practices\n- `deployment-patterns` - CI\u002FCD workflows\n- `aws-infrastructure` - EKS setup\n- `security-review` - Security checklist\n",{"name":5,"origin":24,"description":7},"Custom","main","eebcd780d62a0710aa03028091dc1e9baa995b83","enterprise-toolkit\u002Fskills\u002Fkubernetes-patterns","https:\u002F\u002Fgithub.com\u002Fpjherron\u002Fhypoc","https:\u002F\u002Fgithub.com\u002Fpjherron","2026-09-01 06:45:11",{"source":8,"skillName":5,"commands":32,"prompt":42,"zipAvailable":43},[33,36,39],{"tool":34,"command":35},"npx","npx skills add pjherron\u002Fhypoc --skill kubernetes-patterns",{"tool":37,"command":38},"bunx","bunx skills add pjherron\u002Fhypoc --skill kubernetes-patterns",{"tool":40,"command":41},"pnpm","pnpm dlx skills add pjherron\u002Fhypoc --skill kubernetes-patterns","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fpjherron\u002Fhypoc\u002Fblob\u002Fmain\u002Fenterprise-toolkit\u002Fskills\u002Fkubernetes-patterns\u002FSKILL.md",true,[],[46,53,60,67,74,81],{"skillNo":47,"name":48,"nameZh":6,"description":49,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":50,"categories":51,"keywords":52,"publishedAt":19},"01M799MNB4RVHZZECC75ZFGH0Y","workspace-surface-audit","Audit the active repo, MCP servers, plugins, connectors, env surfaces, and harness setup, then recommend the highest-value ECC-native skills, hooks, agents, and operator workflows. Use when the user wants help setting up Claude Code or understanding what capabilities are actually available in their environment.","https:\u002F\u002Fgithub.com\u002Fpjherron\u002Fhypoc\u002Fblob\u002Fmain\u002Fhypoc\u002Fskills\u002Fworkspace-surface-audit\u002FSKILL.md",[],[],{"skillNo":54,"name":55,"nameZh":6,"description":56,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":57,"categories":58,"keywords":59,"publishedAt":19},"01M799MHR27W0YV1VMW26N691S","Verification & Quality Assurance","Comprehensive truth scoring, code quality verification, and automatic rollback system with 0.95 accuracy threshold for ensuring high-quality agent outputs and codebase reliability.","https:\u002F\u002Fgithub.com\u002Fpjherron\u002Fhypoc\u002Fblob\u002Fmain\u002Fhypoc\u002Fskills\u002Fverification-quality\u002FSKILL.md",[],[],{"skillNo":61,"name":62,"nameZh":6,"description":63,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":64,"categories":65,"keywords":66,"publishedAt":19},"01M799MEX0F1D253S3KZ1635PE","verification-loop","A comprehensive verification system for Claude Code sessions.","https:\u002F\u002Fgithub.com\u002Fpjherron\u002Fhypoc\u002Fblob\u002Fmain\u002Fhypoc\u002Fskills\u002Fverification-loop\u002FSKILL.md",[],[],{"skillNo":68,"name":69,"nameZh":6,"description":70,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":71,"categories":72,"keywords":73,"publishedAt":19},"01M799MCFN5N6A9VWM6R2TFJRK","triage","Move issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.","https:\u002F\u002Fgithub.com\u002Fpjherron\u002Fhypoc\u002Fblob\u002Fmain\u002Fhypoc\u002Fskills\u002Ftriage\u002FSKILL.md",[],[],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":80,"publishedAt":19},"01M799M695F2XJBTP21YHN0R46","token-budget-advisor","Offers the user an informed choice about how much response depth to consume before answering. Use this skill when the user explicitly wants to control response length, depth, or token budget. TRIGGER when: \"token budget\", \"token count\", \"token usage\", \"token limit\", \"response length\", \"answer depth\", \"short version\", \"brief answer\", \"detailed answer\", \"exhaustive answer\", \"respuesta corta vs larga\", \"cuántos tokens\", \"ahorrar tokens\", \"responde al 50%\", \"dame la versión corta\", \"quiero controlar cuánto usas\", or clear variants where the user is explicitly asking to control answer size or depth. DO NOT TRIGGER when: user has already specified a level in the current session (maintain it), the request is clearly a one-word answer, or \"token\" refers to auth\u002Fsession\u002Fpayment tokens rather than response size.","https:\u002F\u002Fgithub.com\u002Fpjherron\u002Fhypoc\u002Fblob\u002Fmain\u002Fhypoc\u002Fskills\u002Ftoken-budget-advisor\u002FSKILL.md",[],[],{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":19},"01M799M387CZZVGC18PN0AZ70S","to-tickets","Break a plan, spec, or the current conversation into a set of tracer-bullet tickets, each declaring its blocking edges, published to the configured tracker — edges as text in a local file, or native blocking links on a real tracker.","https:\u002F\u002Fgithub.com\u002Fpjherron\u002Fhypoc\u002Fblob\u002Fmain\u002Fhypoc\u002Fskills\u002Fto-tickets\u002FSKILL.md",[],[]]