kubernetes

What this skill does

# Kubernetes Quick Reference

**Version**: 1.0.0 | **Target Size**: <100KB | **Purpose**: Fast reference for Kubernetes manifest development and deployment

---

## Overview

Kubernetes is a container orchestration platform for automating deployment, scaling, and management of containerized applications. This quick reference provides essential patterns for creating production-ready Kubernetes manifests with security hardening and best practices.

**When to Load This Skill**:
- Detected: `*.yaml` with `apiVersion: v1|apps/v1`, `kind: Deployment|Service|Pod`, `kustomization.yaml`
- Manual: `--tools=kubernetes` flag
- Use Case: Container orchestration and production deployments

**Progressive Disclosure**:
- **This file (SKILL.md)**: Quick reference for immediate use
- **REFERENCE.md**: Comprehensive guide with advanced patterns and 20+ production examples

---

## Table of Contents

1. [Core Resources Quick Reference](#core-resources-quick-reference)
2. [Security Hardening Checklist](#security-hardening-checklist)
3. [Resource Requests and Limits Guidelines](#resource-requests-and-limits-guidelines)
4. [Networking Basics](#networking-basics)
5. [Storage Overview](#storage-overview)
6. [RBAC Basics](#rbac-basics)
7. [Common kubectl Commands](#common-kubectl-commands)
8. [Health Checks and Probes](#health-checks-and-probes)
9. [Configuration Management](#configuration-management)
10. [Troubleshooting Quick Guide](#troubleshooting-quick-guide)

---

## Core Resources Quick Reference

### Pod

Basic unit of deployment - one or more containers running together:

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: webapp
  labels:
    app: webapp
spec:
  containers:
  - name: app
    image: nginx:1.21
    ports:
    - containerPort: 80
```

**Key Concepts**:
- Smallest deployable unit in Kubernetes
- Containers in same pod share network and storage
- Typically managed by higher-level controllers (Deployment, StatefulSet)
- Use for debugging, not production deployments

---

### Deployment

Declarative pod management with rolling updates and rollbacks:

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: webapp
  labels:
    app: webapp
spec:
  replicas: 3
  selector:
    matchLabels:
      app: webapp
  template:
    metadata:
      labels:
        app: webapp
    spec:
      containers:
      - name: app
        image: nginx:1.21
        ports:
        - containerPort: 80
```

**Key Features**:
- Manages ReplicaSets for pod scaling
- Rolling updates with zero downtime
- Rollback to previous versions
- Self-healing (restarts failed pods)

---

### Service

Network abstraction providing stable endpoint for pods:

**ClusterIP** (internal only):
```yaml
apiVersion: v1
kind: Service
metadata:
  name: webapp
spec:
  type: ClusterIP  # Default
  selector:
    app: webapp
  ports:
  - port: 80        # Service port
    targetPort: 80  # Container port
```

**NodePort** (external access via node port):
```yaml
apiVersion: v1
kind: Service
metadata:
  name: webapp
spec:
  type: NodePort
  selector:
    app: webapp
  ports:
  - port: 80
    targetPort: 80
    nodePort: 30080  # External port (30000-32767)
```

**LoadBalancer** (cloud load balancer):
```yaml
apiVersion: v1
kind: Service
metadata:
  name: webapp
spec:
  type: LoadBalancer
  selector:
    app: webapp
  ports:
  - port: 80
    targetPort: 80
```

**Service Types**:
- **ClusterIP**: Internal access only (default)
- **NodePort**: External access via node IP:port
- **LoadBalancer**: Cloud provider load balancer
- **ExternalName**: DNS CNAME record

---

### ConfigMap

Non-sensitive configuration data:

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: webapp-config
data:
  app.conf: |
    [server]
    port = 8080
    timeout = 30
  database.host: postgres.default.svc.cluster.local
  cache.ttl: "3600"
```

**Usage in Pod**:
```yaml
spec:
  containers:
  - name: app
    envFrom:
    - configMapRef:
        name: webapp-config
    # Or individual keys
    env:
    - name: DB_HOST
      valueFrom:
        configMapKeyRef:
          name: webapp-config
          key: database.host
    # Or mount as volume
    volumeMounts:
    - name: config
      mountPath: /etc/config
  volumes:
  - name: config
    configMap:
      name: webapp-config
```

---

### Secret

Sensitive data storage (base64 encoded):

```yaml
apiVersion: v1
kind: Secret
metadata:
  name: webapp-secrets
type: Opaque
data:
  # Base64 encoded values
  db-password: cGFzc3dvcmQxMjM=
  api-key: YWJjZGVmZ2hpamts
stringData:
  # Plain text (auto-encoded)
  admin-password: changeme
```

**Usage in Pod**:
```yaml
spec:
  containers:
  - name: app
    env:
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: webapp-secrets
          key: db-password
    # Or mount as volume
    volumeMounts:
    - name: secrets
      mountPath: /etc/secrets
      readOnly: true
  volumes:
  - name: secrets
    secret:
      secretName: webapp-secrets
```

**Secret Types**:
- `Opaque`: Generic secret (default)
- `kubernetes.io/dockerconfigjson`: Docker registry credentials
- `kubernetes.io/tls`: TLS certificate and key
- `kubernetes.io/service-account-token`: Service account token

---

### Ingress

HTTP/HTTPS routing to services:

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: webapp
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - www.example.com
    secretName: webapp-tls
  rules:
  - host: www.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: webapp
            port:
              number: 80
```

**Path Types**:
- `Prefix`: Matches path prefix (`/app` matches `/app`, `/app/page`)
- `Exact`: Exact path match only
- `ImplementationSpecific`: Ingress controller-specific

---

## Security Hardening Checklist

### Essential Security Settings

**From infrastructure-developer best practices** (production-validated):

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: webapp
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: webapp
  template:
    metadata:
      labels:
        app: webapp
    spec:
      # Pod-level security context
      securityContext:
        runAsNonRoot: true      # ✅ Prevent root execution
        runAsUser: 1000         # ✅ Specific non-root user
        fsGroup: 2000           # ✅ File system group
        seccompProfile:
          type: RuntimeDefault  # ✅ Seccomp profile

      containers:
      - name: app
        image: myapp:1.2.3      # ✅ Pinned version (not :latest)

        # Container-level security context
        securityContext:
          allowPrivilegeEscalation: false  # ✅ No privilege escalation
          readOnlyRootFilesystem: true     # ✅ Immutable filesystem
          capabilities:
            drop:
            - ALL                            # ✅ Drop all capabilities

        # Resource limits (prevent DoS)
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"

        # Health checks
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10

        readinessProbe:
          httpGet:
            path: /ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
```

### Security Context Fields

**Pod-level**:
```yaml
securityContext:
  runAsNonRoot: true        # Enforce non-root user
  runAsUser: 1000           # UID to run as
  runAsGroup: 3000          # GID to run as
  fsGroup: 2000             # Volume ownership group
  fsGroupChangePolicy: "OnRootMismatch"
  seccompProfile:
    type: RuntimeDefault    # Seccomp profile
  supplementalGroups: [4000]
```

**Container-level**:
```yaml
se