kubernetes-skill

分类: 数据与AI | 上传者: LukasNiessen | 下载: 0 | 版本: v1.0（最新）

通过诊断和修复故障模式来防止 Kubernetes 幻觉：不安全的工作负载默认值、资源匮乏、网络暴露、权限蔓延、脆弱的部署和 API 漂移。在生成、检查、重构或迁移清单、Helm 图表、Kustomize 覆盖和集群策略时使用。

更新日志: Source: GitHub https://github.com/LukasNiessen/kubernetes-skill

目录结构

当前层级: tree/main/

📁 .claude-plugin/
- 📄 marketplace.json 423 B
📁 .github/
- 📁 workflows/
  - 📄 deploy-docs.yml 931 B
  - 📄 stale.yml 1.2 KB
  - 📄 validate.yml 4.4 KB
- 📄 dependabot.yml 118 B
- 📄 PULL_REQUEST_TEMPLATE.md 921 B
📁 docs/
- 📁 advanced/
  - 📄 token-efficiency.md 3.5 KB
- 📁 architecture/
  - 📄 multi-tenancy.md 6.3 KB
  - 📄 storage-and-state.md 6.0 KB
  - 📄 workload-patterns.md 5.8 KB
- 📁 community/
  - 📄 changelog.md 1.3 KB
  - 📄 contributing.md 2.2 KB
- 📁 core-concepts/
  - 📄 failure-modes.md 7.9 KB
  - 📄 philosophy.md 5.6 KB
  - 📄 workflow.md 7.8 KB
- 📁 examples/
  - 📄 bad-patterns.md 3.3 KB
  - 📄 do-dont-checklist.md 2.1 KB
  - 📄 good-patterns.md 3.3 KB
- 📁 failure-modes/
  - 📄 api-drift.md 6.1 KB
  - 📄 fragile-rollouts.md 6.7 KB
  - 📄 insecure-workload-defaults.md 6.4 KB
  - 📄 network-exposure.md 6.2 KB
  - 📄 privilege-sprawl.md 6.3 KB
  - 📄 resource-starvation.md 6.7 KB
- 📁 getting-started/
  - 📄 installation.md 3.5 KB
  - 📄 quick-start.md 3.2 KB
- 📁 guides/
  - 📄 helm-patterns.md 4.5 KB
  - 📄 kustomize-patterns.md 4.2 KB
  - 📄 observability.md 4.0 KB
  - 📄 security-hardening.md 4.5 KB
  - 📄 validation-and-policy.md 3.4 KB
- 📁 integrations/
  - 📄 mcp-integration.md 3.2 KB
- 📄 .gitignore 21 B
- 📄 book.json 371 B
- 📄 package-lock.json 101.1 KB
- 📄 package.json 250 B
- 📄 README.md 1.2 KB
- 📄 SUMMARY.md 1.5 KB
📁 references/
- 📄 api-drift.md 11.2 KB
- 📄 daemonset-operator-patterns.md 7.0 KB
- 📄 deployment-patterns.md 6.1 KB
- 📄 do-dont-patterns.md 4.4 KB
- 📄 examples-bad.md 8.1 KB
- 📄 examples-good.md 11.1 KB
- 📄 fragile-rollouts.md 12.0 KB
- 📄 helm-patterns.md 5.9 KB
- 📄 insecure-workload-defaults.md 9.2 KB
- 📄 job-patterns.md 5.5 KB
- 📄 kustomize-patterns.md 5.4 KB
- 📄 multi-tenancy.md 9.8 KB
- 📄 network-exposure.md 14.4 KB
- 📄 observability.md 9.4 KB
- 📄 privilege-sprawl.md 9.9 KB
- 📄 resource-starvation.md 12.1 KB
- 📄 security-hardening.md 7.5 KB
- 📄 stateful-patterns.md 6.2 KB
- 📄 storage-and-state.md 10.8 KB
- 📄 validation-and-policy.md 7.4 KB
📄 .gitignore 28 B
📄 CHANGELOG.md 622 B
📄 CODE_OF_CONDUCT.md 943 B
📄 CONTRIBUTING.md 1.9 KB
📄 LICENSE 1.1 KB
📄 PHILOSOPHY.md 9.6 KB
📄 README.md 15.5 KB
📄 SKILL.md 3.5 KB

SKILL.md

---
name: kubernetes-skill
description: "Prevent Kubernetes hallucinations by diagnosing and fixing failure modes: insecure workload defaults, resource starvation, network exposure, privilege sprawl, fragile rollouts, and API drift. Use when generating, reviewing, refactoring, or migrating manifests, Helm charts, Kustomize overlays, and cluster policies."
---

# KubeShark: Failure-Mode Workflow for Kubernetes

Run this workflow top to bottom.

## 1) Capture execution context

Record before writing manifests:
- cluster version (e.g. 1.30, 1.31) and distribution (EKS, GKE, AKS, k3s, vanilla)
- target namespace and environment criticality (dev/staging/prod)
- workload type (Deployment, StatefulSet, Job, CronJob, DaemonSet)
- deployment method (raw YAML, Helm, Kustomize, operator-managed)
- policy enforcement (Pod Security Admission level, Kyverno, OPA/Gatekeeper)
- cloud provider and CNI (affects networking, storage classes, load balancers)

If unknown, state assumptions explicitly.

## 2) Diagnose likely failure mode(s)

Select one or more based on user intent and risk:
- insecure workload defaults: missing security contexts, PSS violations, host access
- resource starvation: missing requests/limits, no PDB, scheduling chaos
- network exposure: flat networking, missing policies, wrong Service types, DNS issues
- privilege sprawl: overly permissive RBAC, leaked secrets, excess ServiceAccount rights
- fragile rollouts: misconfigured probes, mutable tags, unsafe update strategies
- API drift: wrong apiVersion, deprecated APIs, schema violations, tool-specific errors

## 3) Load only the relevant reference file(s)

Primary failure-mode references:
- `references/insecure-workload-defaults.md`
- `references/resource-starvation.md`
- `references/network-exposure.md`
- `references/privilege-sprawl.md`
- `references/fragile-rollouts.md`
- `references/api-drift.md`

Supplemental references (only when needed):
- `references/deployment-patterns.md`
- `references/stateful-patterns.md`
- `references/job-patterns.md`
- `references/daemonset-operator-patterns.md`
- `references/security-hardening.md`
- `references/observability.md`
- `references/multi-tenancy.md`
- `references/storage-and-state.md`
- `references/helm-patterns.md`
- `references/kustomize-patterns.md`
- `references/validation-and-policy.md`
- `references/examples-good.md`
- `references/examples-bad.md`
- `references/do-dont-patterns.md`

## 4) Propose fix path with explicit risk controls

For each fix, include:
- why this addresses the failure mode
- what could still go wrong at deploy time or runtime
- guardrails (validation commands, policy checks, rollback path)

## 5) Generate implementation artifacts

When applicable, output:
- Kubernetes manifests (YAML with security contexts, resource limits, labels)
- Helm values/templates or Kustomize overlays
- NetworkPolicies, RBAC resources, PodDisruptionBudgets
- Policy rules (Kyverno/OPA) and admission controls

## 6) Validate before finalize

Always provide validation steps tailored to deployment method and risk tier:
- `kubectl apply --dry-run=server` or `kubectl diff`
- `kubeconform` for schema validation against target cluster version
- cross-resource consistency check (label/selector/port alignment)
- policy scan (PSS profile check, Kyverno/OPA audit)
Never recommend direct production apply without reviewed diff and approval.

## 7) Output contract

Return:
- assumptions and cluster version floor
- selected failure mode(s)
- chosen remediation and tradeoffs
- validation/test plan
- rollback/recovery notes (rollout undo, revision history, data safety)

登录后下载/点赞/收藏 ❤ 21 | ★ 0

kubernetes-skill

目录结构

SKILL.md

举报内容

提示