---
name: k8s-manifest
description: Hardens Kubernetes Deployment manifests to production standards without changing what the workload does. Use this skill when the user asks to review, fix or harden a Kubernetes YAML manifest, add probes, resource limits or a security context, or pin a container image.
allowed-tools: [Read, Write, Glob]
license: MIT
---

# K8s Manifest

Most outages traced to a manifest come from four omissions: a floating image
tag, no resource bounds, no probes, and a root container. This skill fixes those
four and reports what it changed — it never talks to a cluster.

## When this applies

- "harden deploy/api.yaml"
- "this Deployment has no probes or limits"
- "review our Kubernetes manifests before we ship"

Do not activate for cluster debugging ("why is my pod CrashLooping?") or for
Helm chart templating logic.

## Procedure

1. **Read the manifest** and identify every `kind` in the file. Handle each
   document in a multi-document YAML separately; never merge them.
2. **Pin the image.** `:latest` and any floating tag becomes an explicit
   semantic version, plus a digest when one is available:
   `registry/app:2.4.0@sha256:…`. Set `imagePullPolicy: IfNotPresent`.
3. **Bound the resources.** Every container gets `requests` and `limits` for
   both CPU and memory. If the user gave no numbers, use conservative defaults
   and say clearly that they are placeholders to be tuned from real usage.
4. **Add both probes.** `readinessProbe` gates traffic; `livenessProbe` restarts
   a wedged process. Use different endpoints — a liveness probe that hits a
   dependency turns a slow database into a restart loop.
5. **Drop privileges.** Pod-level `runAsNonRoot: true` with a numeric
   `runAsUser`, and container-level `allowPrivilegeEscalation: false`,
   `readOnlyRootFilesystem: true`, `capabilities.drop: [ALL]`.
6. **Move secrets out of the YAML.** Any inline password, token or connection
   string becomes a `secretKeyRef`. Name the Secret; never emit its value.
7. **Make it survivable.** At least 2 replicas for anything serving traffic, and
   a `topologySpreadConstraint` or pod anti-affinity if the user mentions
   multiple nodes or zones.
8. **Report** every change as a one-line diff summary, and flag every placeholder
   value the human must tune.

## Guardrails

- Never run `kubectl`, `helm`, or anything else that touches a cluster. This
  skill edits YAML; applying it is a deploy, and a deploy is a human decision.
- Never invent a Secret's contents, a real image digest, or a hostname.
- Never change the workload's behaviour — ports, args, command and env *names*
  stay exactly as they were.

## Output contract

The manifest keeps its `kind`, `metadata.name` and container ports, gains
probes, resource bounds and a security context, and contains no floating image
tag and no inline credential.