End-to-end application deployment orchestration for the Kubernetes homelab.
Covers research, worktree setup, Flux ResourceSet configuration, dev cluster testing,
monitoring integration, and PR creation.
Use when: (1) Deploying a new application to the cluster, (2) Adding a new Helm release to the platform,
(3) Setting up monitoring, alerting, and health checks for a new service, (4) Testing deployment on
dev cluster before GitOps promotion.
Triggers: "deploy app", "add new application", "deploy to kubernetes", "install helm chart",
"/deploy-app", "set up new service", "add monitoring for", "deploy with monitoring"
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
End-to-end application deployment orchestration for the Kubernetes homelab.
Covers research, worktree setup, Flux ResourceSet configuration, dev cluster testing,
monitoring integration, and PR creation.
Use when: (1) Deploying a new application to the cluster, (2) Adding a new Helm release to the platform,
(3) Setting up monitoring, alerting, and health checks for a new service, (4) Testing deployment on
dev cluster before GitOps promotion.
Triggers: "deploy app", "add new application", "deploy to kubernetes", "install helm chart",
"/deploy-app", "set up new service", "add monitoring for", "deploy with monitoring"
user-invocable
false
Deploy App Workflow
End-to-end orchestration for deploying applications to the Kubernetes homelab with full monitoring integration.
For Garage S3 storage, see Section 3.8 below — the access.network-policy.homelab/garage-s3 label alone is not sufficient.
3.3 Add to helm-charts.yaml
Add to kubernetes/platform/helm-charts.yaml inputs array:
-name:"<app-name>"namespace:"<namespace>"chart:name:"<chart-name>"version:"${<APP>_VERSION}"url:"https://charts.example.com"# or oci://registry.io/pathdependsOn: [cilium]
Security context for restricted namespaces (cert-manager, external-secrets, system, database, kromgo): add full restricted context to all containers. task k8s:validate does NOT catch PodSecurity violations — only admission time reveals them.
# Pod-levelpodSecurityContext:# key varies by chartrunAsNonRoot:trueseccompProfile:type:RuntimeDefault# Container-level (every container and init container)securityContext:allowPrivilegeEscalation:falsecapabilities:drop: ["ALL"]
readOnlyRootFilesystem:truerunAsNonRoot:trueseccompProfile:type:RuntimeDefault
Check the image's default user — if it runs as root, add runAsUser: 65534.
3.5 Register in kustomization.yaml
Add to kubernetes/platform/kustomization.yaml configMapGenerator files list: - charts/<app-name>.yaml
3.6 Configure Renovate Tracking
Renovate tracks versions.env entries automatically via inline # renovate: annotations added in step 3.1. No changes to .github/renovate.json5 are needed unless adding grouping or automerge overrides. See the versions-renovate skill.
3.7 Optional: Additional Configuration
Create kubernetes/platform/config/<app-name>/ for extra resources. See references/file-templates.md for HTTPRoute, secret, and ExternalSecret templates. See references/monitoring-patterns.md for Canary, PrometheusRule, and Grafana dashboard examples.
Also register it in kubernetes/platform/config/garage/kustomization.yaml. Without this, the Garage admission webhook (vgaragekey.kb.io) will deny the GarageKey with cross-namespace reference not permitted.
Namespace label (also required for network access):
access.network-policy.homelab/garage-s3:"true"
S3 env vars in the app (GarageKey generates the <app>-s3-credentials secret automatically):
