Agent Native

kubernetes-skill

This skill helps agents diagnose and fix six common Kubernetes failure modes: insecure workload defaults, resource starvation, network exposure, privilege…

by LukasNiessenCommunityNot reviewed

Community author

Agents
Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode, claude.ai and API
License
MIT (permissive)
Pin
34f93c1pinned Oct 9, 2026
Context cost
about 1,100 tokenswhen the skill loads
GitHub stars
445on lukasniessen/kubernetes-skill
Scripts
None found

What it does

“Prevent Kubernetes hallucinations by diagnosing and fixing failure modes: insecure workload defaults, resource starvation, network exposure, privilege sprawl, fragile rollouts, and API drift. Use when generating, reviewing, refactoring, or migrating manifests, Helm charts, Kustomize overlays, cluster policies, and platform-specific Kubernetes work for EKS, GKE, AKS, OpenShift, GitOps controllers, or observability stacks.”
The author's description, from SKILL.md

Generated summary from the skill's own text

This skill helps agents diagnose and fix six common Kubernetes failure modes: insecure workload defaults, resource starvation, network exposure, privilege sprawl, fragile rollouts, and API drift. It guides agents through capturing cluster context, identifying risks, loading targeted reference documentation, and generating validated manifests, Helm charts, or Kustomize overlays with explicit guardrails for safe deployment.

When to use it

  • Generating or reviewing Kubernetes manifests, Helm charts, or Kustomize overlays
  • Migrating workloads across cluster versions or distributions like EKS, GKE, or AKS
  • Hardening security contexts, RBAC, or network policies in existing configurations
  • Refactoring deployments to address scheduling, rollout, or API compatibility issues

When not to

  • Debugging runtime container or application issues unrelated to Kubernetes manifests
  • Managing cluster infrastructure or control-plane configuration tasks
  • Troubleshooting existing production incidents without manifest review

Install

These commands install from the publisher's repository and need no account.

skills CLI

npx skills add lukasniessen/kubernetes-skill --skill kubernetes-skill

Installs from the repository's default branch, which may have changed since the commit we checked.

GitHub CLI 2.90 or later

gh skill install lukasniessen/kubernetes-skill kubernetes-skill@34f93c1e409156958cc7c410ab1aa88ab512f10f

Installs the commit we checked (34f93c1).

Copy by hand

Download the folder at 34f93c1 and put it in .claude/skills/kubernetes-skill for Claude Code and in .agents/skills/kubernetes-skill for Codex, Cursor, Gemini CLI, GitHub Copilot and OpenCode.

Skill folder on GitHub at 34f93c1

Copy for your agent

A prompt for any coding agent. It installs this skill from GitHub at the pinned commit, copies the files as they are, and runs nothing unless you ask.

Prompt

Install the agent skill "kubernetes-skill" by LukasNiessen.

Source, pinned to commit 34f93c1e409156958cc7c410ab1aa88ab512f10f:
https://github.com/lukasniessen/kubernetes-skill/tree/34f93c1e409156958cc7c410ab1aa88ab512f10f

1. Download that folder at exactly this commit. Do not use the default branch.
2. Copy every file unchanged, keeping the folder structure, into .claude/skills/kubernetes-skill/ for Claude Code and .agents/skills/kubernetes-skill/ for Codex, Cursor, Gemini CLI, GitHub Copilot and OpenCode. Create the folders if they do not exist.
3. Do not edit the files, and do not run any script in the folder unless I ask you to.
4. When you are done, list the files you copied and where you put them.

Listing and checks: https://www.agentnative.dev/skills/lukasniessen/kubernetes-skill

SKILL.md at the pin

---
name: kubernetes-skill
description: "Prevent Kubernetes hallucinations by diagnosing and fixing failure modes: insecure workload defaults, resource starvation, network exposure, privilege sprawl, fragile rollouts, and API drift. Use when generating, reviewing, refactoring, or migrating manifests, Helm charts, Kustomize overlays, cluster policies, and platform-specific Kubernetes work for EKS, GKE, AKS, OpenShift, GitOps controllers, or observability stacks."
---

# KubeShark: Failure-Mode Workflow for Kubernetes

Run this workflow top to bottom.

## 1) Capture execution context

Record before writing manifests:
- cluster version (e.g. 1.30, 1.31) and distribution (EKS, GKE, AKS, k3s, vanilla)
- target namespace and environment criticality (dev/staging/prod)
- workload type (Deployment, StatefulSet, Job, CronJob, DaemonSet)
- deployment method (raw YAML, Helm, Kustomize, operator-managed)
- policy enforcement (Pod Security Admission level, Kyverno, OPA/Gatekeeper)
- cloud provider and CNI (affects networking, storage classes, load balancers)
- platform controllers/add-ons (GitOps, observability, ingress, service mesh, autoscaling)

If unknown, state assumptions explicitly.

## 2) Diagnose likely failure mode(s)

Select one or more based on user intent and risk:
- insecure workload defaults: missing security contexts, PSS violations, host access
- resource starvation: missing requests/limits, no PDB, scheduling chaos
- network exposure: flat networking, missing policies, wrong Service types, DNS issues
- privilege sprawl: overly permissive RBAC, leaked secrets, excess ServiceAccount rights
- fragile rollouts: misconfigured probes, mutable tags, unsafe update strategies
- API drift: wrong apiVersion, deprecated APIs, schema violations, tool-specific errors

## 3) Load only the relevant reference file(s)

Primary failure-mode references:
- `references/insecure-workload-defaults.md`
- `references/resource-starvation.md`
- `references/network-exposure.md`
- `references/privilege-sprawl.md`
- `references/fragile-rollouts.md`
- `references/api-drift.md`

Supplemental references (only when needed):
- `references/deployment-patterns.md`
- `references/stateful-patterns.md`
- `references/job-patterns.md`
- `references/daemonset-operator-patterns.md`
- `references/security-hardening.md`
- `references/observability.md`
- `references/multi-tenancy.md`
- `references/storage-and-state.md`
- `references/helm-patterns.md`
- `references/kustomize-patterns.md`
- `references/validation-and-policy.md`
- `references/examples-good.md`
- `references/examples-bad.md`
- `references/do-dont-patterns.md`

Conditional Reference Retrieval (CRR) references (load only when the signal is detected):
- `references/conditional/eks-patterns.md` for EKS, AWS, IRSA, EKS Pod Identity, AWS Load Balancer Controller, EBS/EFS CSI, Karpenter
- `references/conditional/gke-patterns.md` for GKE, Autopilot, Workload Identity Federation for GKE, Dataplane V2, GCE Ingress, Config Sync
- `references/conditional/aks-patterns.md` for AKS, Microsoft Entra Workload ID, Azure CNI, AGIC, Azure Disk/File/Blob CSI
- `references/conditional/openshift-patterns.md` for OpenShift, OKD, ROSA, ARO, Routes, SCCs, OLM, `oc`
- `references/conditional/gitops-controllers.md` for Argo CD, ApplicationSet, Flux, GitOps reconciliation, sync waves
- `references/conditional/observability-stacks.md` for Prometheus Operator, ServiceMonitor, PodMonitor, OpenTelemetry, Loki, Grafana

Do not load multiple CRR files unless the task spans multiple detected platforms/tools.

## 4) Propose fix path with explicit risk controls

For each fix, include:
- why this addresses the failure mode
- what could still go wrong at deploy time or runtime
- guardrails (validation commands, policy checks, rollback path)

## 5) Generate implementation artifacts

When applicable, output:
- Kubernetes manifests (YAML with security contexts, resource limits, labels)
- Helm values/templates or Kustomize overlays
- NetworkPolicies, RBAC resources, PodDisruptionBudgets
- Policy rules (Kyverno/OPA) and admission controls

## 6) Validate before finalize

Always provide validation steps tailored to deployment method and risk tier:
- `kubectl apply --dry-run=server` or `kubectl diff`
- `kubeconform` for schema validation against target cluster version
- cross-resource consistency check (label/selector/port alignment)
- policy scan (PSS profile check, Kyverno/OPA audit)
Never recommend direct production apply without reviewed diff and approval.

## 7) Output contract

Return:
- assumptions and cluster version floor
- selected failure mode(s)
- chosen remediation and tradeoffs
- validation/test plan
- rollback/recovery notes (rollout undo, revision history, data safety)

From lukasniessen/kubernetes-skill at 34f93c1, shown as plain text under its license: MIT (permissive). The license text is in LICENSE.

View SKILL.md on GitHub at 34f93c1

Files

68 files, 2.2 MB in total. Each file has a sha256 in the pin's manifest; the first 12 characters are shown.

Skill folder on GitHub at 34f93c1
All Cloud and DevOps skills

Related in Cloud and DevOps

  • debug-openshell-cluster

    Diagnoses OpenShell gateway deployment problems across Docker, Podman, Kubernetes, and VM compute platforms.

    by NVIDIAOfficial publisher

    Claude Code, Codex, Cursor +4 · about 19.1K tokens · pinned 6 days ago

  • aws-containers

    Provides domain expertise for deploying and managing containerized workloads on AWS using EKS, ECS, Fargate, and Elastic Beanstalk.

    by Amazon (AWS)Official publisher

    Claude Code, Codex, Cursor +4 · about 1.4K tokens · pinned 6 days ago

  • elastic-beanstalk

    Deploy applications to AWS Elastic Beanstalk in Standard mode (EC2) or Cluster mode (managed EKS), handling environment configuration, platform selection, and…

    by Amazon (AWS)Official publisher

    Claude Code, Codex, Cursor +4 · about 2.9K tokens · pinned 6 days ago

  • deploying-airflow

    This skill guides deploying Airflow DAGs and projects using Astro (Astronomer's managed platform), open-source Airflow on Docker Compose, or Kubernetes with…

    by AstronomerOfficial publisher

    Claude Code, Codex, Cursor +4 · about 2.7K tokens · pinned 6 days ago

  • deploying-go-sdk-bundles

    This skill builds, packs, and deploys Go SDK bundles as self-contained AFBNDL01 executable artifacts for Airflow's ExecutableCoordinator to run.

    by AstronomerOfficial publisher

    Claude Code, Codex, Cursor +4 · about 1.7K tokens · pinned 6 days ago

  • deploying-java-sdk-bundles

    This skill teaches how to build Java SDK bundles as JAR files using Gradle or Maven, then deploy them to Airflow workers so the coordinator can execute Java…

    by AstronomerOfficial publisher

    Claude Code, Codex, Cursor +4 · about 2.6K tokens · pinned 6 days ago

The skills listed here are third-party software, collected from public GitHub repositories as a catalog of recent skills and provided as is. Agent Native does not write or control them and is not responsible for any harm, loss or damage caused by installing or using them. Labels and checks describe what we saw at one commit and are not a guarantee. Read a skill's files before you run it. Terms of use