Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
Provides Kubernetes resource management, Helm chart patterns, service mesh configuration, and autoscaling strategies. Covers HPA, VPA, KEDA, operators, security contexts, and namespace isolation. Use when user mentions 'kubernetes', 'k8s', 'helm', 'istio', 'linkerd', 'service mesh', 'HPA', 'VPA', 'KEDA', 'pod security', 'resource quotas', 'operators'.
type
skill
category
patterns
status
stable
origin
tibsfox
modified
false
first_seen
"2026-02-07T00:00:00.000Z"
first_path
examples/kubernetes-patterns/SKILL.md
superseded_by
null
Kubernetes Patterns
Best practices for deploying, scaling, securing, and managing workloads on Kubernetes. This skill covers resource management, Helm chart structure, service mesh configuration, autoscaling strategies, and security hardening.
Resource Management
Every container must declare resource requests and limits. Without them, the scheduler cannot make informed placement decisions and nodes can become overcommitted.
Resource Type
Request (Guaranteed)
Limit (Maximum)
What Happens at Limit
CPU
Reserved on node
Throttled (not killed)
Container slows down
Memory
Reserved on node
OOM-killed
Container restarts
Ephemeral Storage
Reserved on node
Evicted
Pod removed from node
GPU
Reserved on node
Hard limit
Cannot exceed
QoS Classes
Kubernetes assigns QoS classes based on resource declarations. This determines eviction priority.
Namespaces provide logical boundaries. Combine with NetworkPolicies and RBAC for true isolation.
Strategy
Isolation Level
Use Case
Per-team
Medium
Small org, shared cluster
Per-environment
Medium
Dev/staging/prod in one cluster
Per-application
High
Microservices with strict boundaries
Per-tenant
Highest
Multi-tenant SaaS
Resource Quotas and Limit Ranges
# ResourceQuota: caps total resource consumption per namespaceapiVersion:v1kind:ResourceQuotametadata:name:team-alpha-quotanamespace:team-alphaspec:hard:requests.cpu:"10"requests.memory:20Gilimits.cpu:"20"limits.memory:40Gipods:"50"services:"20"persistentvolumeclaims:"10"secrets:"30"configmaps:"30"---# LimitRange: sets defaults and bounds per containerapiVersion:v1kind:LimitRangemetadata:name:team-alpha-limitsnamespace:team-alphaspec:limits:-type:Containerdefault:cpu:500mmemory:256MidefaultRequest:cpu:100mmemory:128Mimin:cpu:50mmemory:64Mimax:cpu:"4"memory:4Gi-type:PersistentVolumeClaimmin:storage:1Gimax:storage:50Gi
Network Policy for Namespace Isolation
# Default deny all ingress and egressapiVersion:networking.k8s.io/v1kind:NetworkPolicymetadata:name:default-deny-allnamespace:team-alphaspec:podSelector: {}
policyTypes:-Ingress-Egress---# Allow only within namespace + DNSapiVersion:networking.k8s.io/v1kind:NetworkPolicymetadata:name:allow-intra-namespacenamespace:team-alphaspec:podSelector: {}
policyTypes:-Ingress-Egressingress:-from:-podSelector: {}
egress:-to:-podSelector: {}
-to:-namespaceSelector:matchLabels:kubernetes.io/metadata.name:kube-systempodSelector:matchLabels:k8s-app:kube-dnsports:-protocol:UDPport:53-protocol:TCPport:53
Helm Chart Structure
Helm charts package Kubernetes manifests with templating and dependency management.
apiVersion:v2name:my-appdescription:AHelmchartfortheMyAppAPIservicetype:applicationversion:1.4.0# Chart version (bump on chart changes)appVersion:"2.1.0"# Application version (bump on app changes)dependencies:-name:postgresqlversion:"13.x"repository:https://charts.bitnami.com/bitnamicondition:postgresql.enabled-name:redisversion:"18.x"repository:https://charts.bitnami.com/bitnamicondition:redis.enabledmaintainers:-name:PlatformTeamemail:platform@company.com
Service meshes handle traffic management, security, and observability at the infrastructure layer.
Istio vs Linkerd Comparison
Aspect
Istio
Linkerd
Complexity
High (many CRDs, control plane components)
Low (minimal, opinionated)
Resource Overhead
~100MB per sidecar
~25MB per sidecar
mTLS
Configurable (permissive/strict)
On by default
Traffic Management
Very flexible (VirtualService, DestinationRule)
Basic (TrafficSplit, ServiceProfile)
Multi-cluster
Built-in
Supported with multicluster extension
Learning Curve
Steep
Gentle
Best For
Complex routing, advanced policies
Simple mTLS + observability
Istio VirtualService: Canary with Header Routing
apiVersion:networking.istio.io/v1kind:VirtualServicemetadata:name:api-servernamespace:productionspec:hosts:-api-server-api.company.comgateways:-mesh# In-mesh traffic-api-gateway# External traffichttp:# Route internal testers to canary via header-match:-headers:x-canary:exact:"true"route:-destination:host:api-serversubset:canaryweight:100# Weighted canary for production traffic-route:-destination:host:api-serversubset:stableweight:90-destination:host:api-serversubset:canaryweight:10retries:attempts:3perTryTimeout:2sretryOn:5xx,reset,connect-failuretimeout:10s---apiVersion:networking.istio.io/v1kind:DestinationRulemetadata:name:api-servernamespace:productionspec:host:api-servertrafficPolicy:connectionPool:tcp:maxConnections:100http:h2UpgradePolicy:DEFAULTmaxRequestsPerConnection:1000outlierDetection:consecutive5xxErrors:5interval:30sbaseEjectionTime:30smaxEjectionPercent:50subsets:-name:stablelabels:version:v2.0.0-name:canarylabels:version:v2.1.0
Autoscaling Strategies
HPA with Custom Metrics
apiVersion:autoscaling/v2kind:HorizontalPodAutoscalermetadata:name:api-server-hpanamespace:productionspec:scaleTargetRef:apiVersion:apps/v1kind:Deploymentname:api-serverminReplicas:3maxReplicas:50behavior:scaleUp:stabilizationWindowSeconds:60policies:-type:Percentvalue:100# Double capacity per minuteperiodSeconds:60-type:Podsvalue:5# Or add 5 pods, whichever is higherperiodSeconds:60selectPolicy:MaxscaleDown:stabilizationWindowSeconds:300# Wait 5 min before scaling downpolicies:-type:Percentvalue:25# Remove 25% per 2 minutesperiodSeconds:120selectPolicy:Minmetrics:# CPU-based scaling-type:Resourceresource:name:cputarget:type:UtilizationaverageUtilization:70# Memory-based scaling-type:Resourceresource:name:memorytarget:type:UtilizationaverageUtilization:80# Custom metric: requests per second from Prometheus-type:Podspods:metric:name:http_requests_per_secondtarget:type:AverageValueaverageValue:"1000"
KEDA ScaledObject: Event-Driven Autoscaling
apiVersion:keda.sh/v1alpha1kind:ScaledObjectmetadata:name:order-processornamespace:productionspec:scaleTargetRef:name:order-processorpollingInterval:15# Check triggers every 15scooldownPeriod:60# Wait 60s after last trigger before scale-downminReplicaCount:1# Minimum replicas (0 for scale-to-zero)maxReplicaCount:100fallback:failureThreshold:3replicas:5# Fallback if scaler failstriggers:# Scale based on Kafka consumer lag-type:kafkametadata:bootstrapServers:kafka.production:9092consumerGroup:order-processortopic:orderslagThreshold:"50"# Scale up when lag > 50 per partition# Scale based on RabbitMQ queue depth-type:rabbitmqmetadata:host:amqp://rabbitmq.production:5672queueName:order-queuequeueLength:"100"# Scale based on Prometheus metric-type:prometheusmetadata:serverAddress:http://prometheus.monitoring:9090query:|
sum(rate(http_requests_total{service="order-processor"}[2m]))
threshold:"500"---# Scale-to-zero for batch jobsapiVersion:keda.sh/v1alpha1kind:ScaledObjectmetadata:name:report-generatornamespace:batchspec:scaleTargetRef:name:report-generatorminReplicaCount:0# Scale to zero when idlemaxReplicaCount:10triggers:-type:cronmetadata:timezone:America/New_Yorkstart:02***# Scale up at 2 AMend:06***# Scale down at 6 AMdesiredReplicas:"5"
Autoscaling Strategy Comparison
Strategy
Scales On
Scale-to-Zero
Latency
Best For
HPA (CPU/Memory)
Resource utilization
No
Seconds
Steady traffic patterns
HPA (Custom)
Application metrics
No
Seconds
API servers, web apps
VPA
Historical usage
No
Pod restart
Right-sizing resources
KEDA
External events
Yes
Seconds
Event-driven workloads
Cluster Autoscaler
Node pressure
No
Minutes
Node pool management
Karpenter
Pod scheduling needs
No
Seconds
Fast, flexible node scaling
Pod Security Best Practices
Security Context Configuration
apiVersion:v1kind:Podmetadata:name:secure-appnamespace:productionspec:# Pod-level security contextsecurityContext:runAsNonRoot:truerunAsUser:10001runAsGroup:10001fsGroup:10001seccompProfile:type:RuntimeDefaultserviceAccountName:app-service-accountautomountServiceAccountToken:false# Disable unless neededcontainers:-name:appimage:ghcr.io/our-org/app@sha256:abc123# Container-level security contextsecurityContext:allowPrivilegeEscalation:falsereadOnlyRootFilesystem:truecapabilities:drop:-ALL# Only add specific capabilities if absolutely needed# add:# - NET_BIND_SERVICEvolumeMounts:-name:tmpmountPath:/tmp-name:cachemountPath:/app/cachevolumes:# Writable dirs for read-only root filesystem-name:tmpemptyDir:sizeLimit:100Mi-name:cacheemptyDir:sizeLimit:500Mi
Pod Security Standards (PSS)
Level
Description
Key Restrictions
Privileged
Unrestricted
None (cluster admin workloads)
Baseline
Minimally restrictive
No hostNetwork, hostPID, hostIPC, privileged containers
Restricted
Heavily restricted
runAsNonRoot, drop ALL capabilities, readOnlyRootFilesystem, seccomp
# Enforce restricted standard on namespaceapiVersion:v1kind:Namespacemetadata:name:productionlabels:pod-security.kubernetes.io/enforce:restrictedpod-security.kubernetes.io/enforce-version:latestpod-security.kubernetes.io/audit:restrictedpod-security.kubernetes.io/warn:restricted
Operator Pattern
Operators extend Kubernetes with domain-specific controllers that encode operational knowledge.