mirror of
https://github.com/wshobson/agents.git
synced 2026-03-18 17:47:16 +00:00
style: format all files with prettier
This commit is contained in:
@@ -14,6 +14,7 @@ This skill provides comprehensive guidance for generating well-structured, secur
|
||||
## When to Use This Skill
|
||||
|
||||
Use this skill when you need to:
|
||||
|
||||
- Create new Kubernetes Deployment manifests
|
||||
- Define Service resources for network connectivity
|
||||
- Generate ConfigMap and Secret resources for configuration management
|
||||
@@ -27,6 +28,7 @@ Use this skill when you need to:
|
||||
### 1. Gather Requirements
|
||||
|
||||
**Understand the workload:**
|
||||
|
||||
- Application type (stateless/stateful)
|
||||
- Container image and version
|
||||
- Environment variables and configuration needs
|
||||
@@ -37,6 +39,7 @@ Use this skill when you need to:
|
||||
- Health check endpoints
|
||||
|
||||
**Questions to ask:**
|
||||
|
||||
- What is the application name and purpose?
|
||||
- What container image and tag will be used?
|
||||
- Does the application need persistent storage?
|
||||
@@ -70,41 +73,42 @@ spec:
|
||||
version: <version>
|
||||
spec:
|
||||
containers:
|
||||
- name: <container-name>
|
||||
image: <image>:<tag>
|
||||
ports:
|
||||
- containerPort: <port>
|
||||
name: http
|
||||
resources:
|
||||
requests:
|
||||
memory: "256Mi"
|
||||
cpu: "250m"
|
||||
limits:
|
||||
memory: "512Mi"
|
||||
cpu: "500m"
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: http
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
env:
|
||||
- name: ENV_VAR
|
||||
value: "value"
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: <app-name>-config
|
||||
- secretRef:
|
||||
name: <app-name>-secret
|
||||
- name: <container-name>
|
||||
image: <image>:<tag>
|
||||
ports:
|
||||
- containerPort: <port>
|
||||
name: http
|
||||
resources:
|
||||
requests:
|
||||
memory: "256Mi"
|
||||
cpu: "250m"
|
||||
limits:
|
||||
memory: "512Mi"
|
||||
cpu: "500m"
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: http
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
env:
|
||||
- name: ENV_VAR
|
||||
value: "value"
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: <app-name>-config
|
||||
- secretRef:
|
||||
name: <app-name>-secret
|
||||
```
|
||||
|
||||
**Best practices to apply:**
|
||||
|
||||
- Always set resource requests and limits
|
||||
- Implement both liveness and readiness probes
|
||||
- Use specific image tags (never `:latest`)
|
||||
@@ -119,6 +123,7 @@ spec:
|
||||
**Choose the appropriate Service type:**
|
||||
|
||||
**ClusterIP (internal only):**
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -132,13 +137,14 @@ spec:
|
||||
selector:
|
||||
app: <app-name>
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 8080
|
||||
protocol: TCP
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 8080
|
||||
protocol: TCP
|
||||
```
|
||||
|
||||
**LoadBalancer (external access):**
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -154,10 +160,10 @@ spec:
|
||||
selector:
|
||||
app: <app-name>
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 8080
|
||||
protocol: TCP
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 8080
|
||||
protocol: TCP
|
||||
```
|
||||
|
||||
**Reference:** See `references/service-spec.md` for service types and networking
|
||||
@@ -184,6 +190,7 @@ data:
|
||||
```
|
||||
|
||||
**Best practices:**
|
||||
|
||||
- Use ConfigMaps for non-sensitive data only
|
||||
- Organize related configuration together
|
||||
- Use meaningful names for keys
|
||||
@@ -218,6 +225,7 @@ stringData:
|
||||
```
|
||||
|
||||
**Security considerations:**
|
||||
|
||||
- Never commit secrets to Git in plain text
|
||||
- Use Sealed Secrets, External Secrets Operator, or Vault
|
||||
- Rotate secrets regularly
|
||||
@@ -236,7 +244,7 @@ metadata:
|
||||
namespace: <namespace>
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
- ReadWriteOnce
|
||||
storageClassName: gp3
|
||||
resources:
|
||||
requests:
|
||||
@@ -244,22 +252,24 @@ spec:
|
||||
```
|
||||
|
||||
**Mount in Deployment:**
|
||||
|
||||
```yaml
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- name: app
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /var/lib/app
|
||||
- name: app
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /var/lib/app
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: <app-name>-data
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: <app-name>-data
|
||||
```
|
||||
|
||||
**Storage considerations:**
|
||||
|
||||
- Choose appropriate StorageClass for performance needs
|
||||
- Use ReadWriteOnce for single-pod access
|
||||
- Use ReadWriteMany for multi-pod shared storage
|
||||
@@ -281,16 +291,17 @@ spec:
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: app
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
- name: app
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
```
|
||||
|
||||
**Security checklist:**
|
||||
|
||||
- [ ] Run as non-root user
|
||||
- [ ] Drop all capabilities
|
||||
- [ ] Use read-only root filesystem
|
||||
@@ -330,6 +341,7 @@ metadata:
|
||||
**File organization options:**
|
||||
|
||||
**Option 1: Single file with `---` separator**
|
||||
|
||||
```yaml
|
||||
# app-name.yaml
|
||||
---
|
||||
@@ -351,6 +363,7 @@ kind: Service
|
||||
```
|
||||
|
||||
**Option 2: Separate files**
|
||||
|
||||
```
|
||||
manifests/
|
||||
├── configmap.yaml
|
||||
@@ -361,6 +374,7 @@ manifests/
|
||||
```
|
||||
|
||||
**Option 3: Kustomize structure**
|
||||
|
||||
```
|
||||
base/
|
||||
├── kustomization.yaml
|
||||
@@ -396,6 +410,7 @@ kube-linter lint manifest.yaml
|
||||
```
|
||||
|
||||
**Testing checklist:**
|
||||
|
||||
- [ ] Manifest passes dry-run validation
|
||||
- [ ] All required fields are present
|
||||
- [ ] Resource limits are reasonable
|
||||
@@ -411,6 +426,7 @@ kube-linter lint manifest.yaml
|
||||
**Use case:** Standard web API or microservice
|
||||
|
||||
**Components needed:**
|
||||
|
||||
- Deployment (3 replicas for HA)
|
||||
- ClusterIP Service
|
||||
- ConfigMap for configuration
|
||||
@@ -424,6 +440,7 @@ kube-linter lint manifest.yaml
|
||||
**Use case:** Database or persistent storage application
|
||||
|
||||
**Components needed:**
|
||||
|
||||
- StatefulSet (not Deployment)
|
||||
- Headless Service
|
||||
- PersistentVolumeClaim template
|
||||
@@ -435,6 +452,7 @@ kube-linter lint manifest.yaml
|
||||
**Use case:** Scheduled tasks or batch processing
|
||||
|
||||
**Components needed:**
|
||||
|
||||
- CronJob or Job
|
||||
- ConfigMap for job parameters
|
||||
- Secret for credentials
|
||||
@@ -445,6 +463,7 @@ kube-linter lint manifest.yaml
|
||||
**Use case:** Application with sidecar containers
|
||||
|
||||
**Components needed:**
|
||||
|
||||
- Deployment with multiple containers
|
||||
- Shared volumes between containers
|
||||
- Init containers for setup
|
||||
@@ -481,16 +500,19 @@ The following templates are available in the `assets/` directory:
|
||||
## Troubleshooting
|
||||
|
||||
**Pods not starting:**
|
||||
|
||||
- Check image pull errors: `kubectl describe pod <pod-name>`
|
||||
- Verify resource availability: `kubectl get nodes`
|
||||
- Check events: `kubectl get events --sort-by='.lastTimestamp'`
|
||||
|
||||
**Service not accessible:**
|
||||
|
||||
- Verify selector matches pod labels: `kubectl get endpoints <service-name>`
|
||||
- Check service type and port configuration
|
||||
- Test from within cluster: `kubectl run debug --rm -it --image=busybox -- sh`
|
||||
|
||||
**ConfigMap/Secret not loading:**
|
||||
|
||||
- Verify names match in Deployment
|
||||
- Check namespace
|
||||
- Ensure resources exist: `kubectl get configmap,secret`
|
||||
@@ -498,6 +520,7 @@ The following templates are available in the `assets/` directory:
|
||||
## Next Steps
|
||||
|
||||
After creating manifests:
|
||||
|
||||
1. Store in Git repository
|
||||
2. Set up CI/CD pipeline for deployment
|
||||
3. Consider using Helm or Kustomize for templating
|
||||
|
||||
Reference in New Issue
Block a user