Use this skill when a DevOps task deploys or verifies services on a Kubernetes cluster. Project-root .k8s/ may contain manifests, overlays, or kubeconfig files. Kubeconfig and Secret material are operator-owned credentials: DevOps may reference them in kubectl or helm commands, but must not read, summarize, copy, or print their contents.
-
Resolve cluster, namespace, and kubeconfig by reference. Use explicit --kubeconfig <path> and --namespace <name> or an approved context from the task. Do not rely on an implicit current context. Do not run kubectl config view, especially with --raw.
-
Separate manifests from secrets. It is safe to read ordinary Deployment, Service, Ingress, ConfigMap, HPA, and Kustomize/Helm metadata. Do not read kubeconfig files, Kubernetes Secret manifests, sealed-secret private keys, service-account tokens, or files whose path implies secret material.
-
Validate before mutation. Run schema or server dry-run validation first:
kubectl --kubeconfig .k8s/<config> --namespace <ns> apply --dry-run=server -f <manifest-or-overlay>
kubectl --kubeconfig .k8s/<config> --namespace <ns> diff -f <manifest-or-overlay>
If diff output contains secret values, stop and rerun with safer tooling or ask the operator for a redacted plan.
-
Use explicit image and config inputs. Apply manifests or Helm values that reference immutable image tags/digests. Non-secret ConfigMaps may be reviewed. Secrets must come from the cluster's approved secret manager, ExternalSecret, sealed-secret public workflow, or operator-managed injection path.
-
Deploy with bounded blast radius. Apply only the task-scoped namespace/resources. Avoid cluster-wide operations unless the task is explicitly a platform task with approval. Never run kubectl delete against broad selectors without a reviewed manifest list.
-
Watch rollouts. Use kubectl rollout status deployment/<name> --timeout=<n>s, pod readiness, service endpoints, and application health checks. Capture only resource names, statuses, events, and sanitized logs.
-
Prepare rollback. Record kubectl rollout undo, Helm rollback revision, or re-apply previous manifest/tag. For database migrations or irreversible changes, route back to SA/TL before production deployment.
-
Write the deploy report. Include cluster alias/context name, namespace, manifest path, image tag/digest, validation/diff result, rollout status, health evidence, and rollback command. Never include kubeconfig contents, tokens, cert data, or Secret values.
