Kubernetes Manifests, Hardening and Pod Debugging
Production-ready Kubernetes manifests, RBAC and NetworkPolicies, plus a triage path for CrashLoopBackOff, OOMKilled and Pending pods.
Before & after
Same prompt, same agent — the only difference is the skill.
Deploying to Kubernetes involves setting up several components. You'd need a deployment manifest to define your container, configure how many replicas to run, and set up services so traffic can reach your app. You might also want to think about resource limits and security settings. There are quite a few options to consider. Do you have a Kubernetes cluster already? What's your app written in? Are there specific security requirements you need to meet? I could walk you through the general process if you'd like.
KUBERNETES DEPLOYMENT MANIFEST
apiVersion: v1
kind: Namespace
metadata:
name: production
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: app-runner
namespace: production
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: api-server
namespace: production
spec:
replicas: 3
selector:
matchLabels:
app: api-server
template:
metadata:
labels:
app: api-server
spec:
serviceAccountName: app-runner
securityContext:
runAsNonRoot: true
runAsUser: 1000
fsReadOnlyRootFilesystem: true
containers:
- name: api
image: myregistry.azurecr.io/api-server:1.0
imagePullPolicy: IfNotPresent
ports:
- containerPort: 8080
resources:
requests:
memory: 512Mi
cpu: 250m
limits:
memory: 1Gi
cpu: 500m
livenessProbe:
httpGet:
path: /health
port: 8080
initialDelaySeconds: 30
periodSeconds: 10
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop: [ALL]
volumeMounts:
- name: tmp
mountPath: /tmp
volumes:
- name: tmp
emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
name: api-service
namespace: production
spec:
type: ClusterIP
selector:
app: api-server
ports:
- port: 80
targetPort: 8080
NETWORK POLICY (Pod-to-Pod only)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny
namespace: production
spec:
podSelector: {}
policyTypes:
- Ingress
ingress:
- from:
- podSelector:
matchLabels:
role: frontend
DEPLOYMENT STEPS
1. Apply manifest: kubectl apply -f deployment.yaml
2. Verify: kubectl get pods -n production
3. Check logs: kubectl logs -f deployment/api-server -n production
4. Test health: kubectl port-forward svc/api-service 8080:80
5. Monitor: Watch resource usage via kubectl top podsAbout this skill
Your pod is in CrashLoopBackOff again, the generic advice is "raise the limit," and the NetworkPolicy you copied just broke DNS. This skill reads the failure the way an on-call platform engineer does, starting with exit codes, Last State and events, then logs. It writes manifests where every non-default field has a reason and a command that proves it works.
What it does
- Triages CrashLoopBackOff, OOMKilled, Pending, ImagePullBackOff, not-Ready pods and empty Service endpoints from status, exit codes and events.
- Sizes requests and limits from peak working set, including JVM, Node and Go memory settings that ignore container limits.
- Writes Deployments with safe probes, zero-downtime rollouts, graceful shutdown, PodDisruptionBudgets and zone spreading.
- Hardens pods to the restricted Pod Security Standard and catches requests for the removed PodSecurityPolicy.
- Builds least-privilege RBAC that avoids hidden escalation paths, with
kubectl auth can-ichecks to prove it. - Writes default-deny NetworkPolicies that keep DNS working and gets the AND/OR selector semantics right.
What you get
For a failure: a diagnosis, the evidence behind it, the exact fix, the verify commands and one prevention step. For a new workload: complete YAML, a short list explaining each non-default decision, and dry-run and verify commands.
Best for
Backend and platform engineers who deploy to or get paged for Kubernetes clusters, and teams reviewing manifests or Helm values before production.
SKILL.md preview
---
name: kubernetes-manifests-hardening-pod-debugging
description: Writes production-ready Kubernetes manifests (probes, resources, rollout safety, securityContext, least-privilege RBAC, default-deny NetworkPolicies) and diagnoses failing pods from status, exit codes and events before changing any config. Use when the user says "write a Deployment for this service", "my pod keeps getting OOMKilled", "pod stuck in CrashLoopBackOff", "pods stuck Pending", "review my k8s manifests", "lock down RBAC for this service account", "my NetworkPolicy broke DNS", "set up pod security".
---
# Kubernetes Manifests, Hardening and Pod Debugging
… (sign up to view the full skill)More development skills
View all Development skills →Chaos Experiment and Game Day Planner
Plans chaos experiments and game days: hypothesis, blast radius, abort conditions, tool manifests, rollback, and post-run review.
Claude Code Cost and Latency Routing
Configure Claude Code Router with model tiers, explicit fallbacks, compatibility checks, and a cost-aware validation plan.
CI/CD Pipeline Builder with Gated Deploys
Generates CI/CD workflows from your repo's real stack: cached fast-fail checks, pinned actions, and staging-to-prod deploys with gates.
Terraform Modules and Safe Deployments
Get reusable Terraform modules, safe state migrations, explicit provider wiring, and CI gates tied to reviewed plans.