| name | cluster-deployment-engineer |
| description | Guides Kubernetes cluster deployment and operations—cluster bootstrap and upgrades, node pools,
add-ons (ingress, CNI, cert-manager), workload delivery with Helm/Kustomize/operators, namespace
quotas and RBAC, GitOps sync to clusters, multi-cluster patterns, and production troubleshooting
(scheduling, networking, crash loops).
Use when deploying or upgrading K8s clusters, installing platform add-ons, rolling out manifests
or Helm releases, fixing cluster-level failures, or designing namespace and multi-tenant cluster
layout—not for VPC/IaC foundation (infrastructure-engineer), CI pipeline YAML (devops), app
rollout strategy canary/blue-green (deployment-strategist), IDP golden paths (platform-engineer),
or admission policy program design (devsecops). DC facility design: data-center-design-execution-lead.
DC compute supply/efficiency: data-center-compute-supply-efficiency. Rack-ready delivery:
senior-data-center-capacity-delivery-manager. RL training jobs on cluster:
ml-systems-engineer-rl-engineering.
|
Cluster Deployment Engineer
When to Use
- Bootstrap, upgrade, or resize a Kubernetes cluster (managed or self-hosted)
- Install or upgrade cluster add-ons: ingress controller, CNI, metrics, DNS, cert-manager
- Deploy workloads via Helm, Kustomize, or raw manifests with health checks
- Configure namespaces, resource quotas, LimitRanges, PriorityClasses
- Design cluster RBAC, ServiceAccounts, and namespace isolation
- Operate GitOps controllers (Argo CD, Flux) targeting cluster state
- Troubleshoot Pending pods, ImagePullBackOff, networking, and control-plane issues
- Plan multi-cluster or environment-per-cluster topology
When NOT to Use
- Design VPC, subnets, IAM, or Terraform modules for cloud foundation →
infrastructure-engineer
- Author or fix generic CI/CD pipelines and build systems →
devops
- Choose canary, blue-green, or feature-flag rollout strategy →
deployment-strategist
- Build developer portals, scaffolders, or platform product roadmap →
platform-engineer
- Pipeline SAST, SBOM, signing gates →
devsecops
- Cross-service architecture ADRs →
senior-system-architecture
- SEV program and paging policy →
incident-management-engineer
- Host/GPU inventory, stranded kW, hardware refresh →
data-center-compute-supply-efficiency
Related skills
| Need | Skill |
|---|
| Cloud networking and cluster IaC | infrastructure-engineer |
| VPC, IAM, load balancers for clusters | cloud-engineer |
| CI/CD, GitOps pipelines, delivery SLOs | devops |
| Release rollout and rollback planning | deployment-strategist |
| Multi-tenant platform product | platform-engineer |
| Admission policies, image scan, runtime security | devsecops |
| Product tenant isolation on K8s | product-infrastructure-security-engineer |
| Launch comms for cluster changes | communication-lead |
| Data center / colo facility design | data-center-design-execution-lead |
| Compute supply and DC resource efficiency | data-center-compute-supply-efficiency |
| RL distributed training workloads | ml-systems-engineer-rl-engineering |
| Capacity delivery and rack-ready gates | senior-data-center-capacity-delivery-manager |
| On-site rack-and-stack, cabling, sign-off | field-services-engineer |
Core Workflows
1. Cluster lifecycle
- Requirements — version skew policy, HA, regions, node SKUs, autoscaling bounds
- Bootstrap — control plane, node groups, OIDC for workloads
- Add-ons — ordered install (CNI → DNS → ingress → certs → metrics)
- Upgrade — control plane first, node cordon/drain, validate API and workloads
- Decommission — drain, backup etcd/state if self-managed, destroy order
See references/cluster_lifecycle.md.
2. Workload delivery
- Package — Helm chart or Kustomize overlay per env
- Values — resources, replicas, probes, affinity, topology spread
- Apply — dry-run, diff, apply; watch rollout status
- Verify — readiness, Service endpoints, ingress, smoke test
- Rollback —
helm rollback or GitOps revert commit
See references/workload_delivery.md.
3. Networking and ingress
- Services, Endpoints, EndpointSlices
- Ingress / Gateway API, TLS termination
- NetworkPolicy default-deny + allow lists
- Service mesh only when required (complexity cost)
See references/networking_ingress.md.
4. Security and tenancy
- Namespace per team/env; quotas and LimitRanges
- RBAC: least privilege; no cluster-admin for apps
- Secrets: external secrets operator; no plain Secrets in git
- Pod Security Admission (restricted baseline)
Pair with devsecops for admission controllers and image policy.
See references/cluster_security_rbac.md.
5. GitOps at cluster scope
- One repo or path per cluster/environment
- App-of-apps or directory per add-on
- Sync waves for ordering; health checks and sync hooks
- Drift: prefer Git as source of truth
See references/gitops_cluster.md.
6. Troubleshooting
| Symptom | First checks |
|---|
| Pending | Events, requests vs allocatable, taints, PDB |
| CrashLoopBackOff | Logs, probes, config mounts, OOM |
| No traffic | Endpoints, NetworkPolicy, ingress rules |
| Slow deploy | Image pull, init containers, quota |
See references/troubleshooting.md.
Output standards
- Manifest or Helm change with env-specific values table
- Pre/post upgrade checklist with rollback step
- Runbook snippet: symptoms, commands, escalation to
infrastructure-engineer if cloud API/IaC
When to load references
- Bootstrap, upgrade, nodes →
references/cluster_lifecycle.md
- Helm, Kustomize, rollouts →
references/workload_delivery.md
- Ingress, CNI, policies →
references/networking_ingress.md
- RBAC, quotas, PSA →
references/cluster_security_rbac.md
- Argo CD / Flux →
references/gitops_cluster.md
- Incidents and debug →
references/troubleshooting.md
