{"slug": "kubernetes-skill-pack", "title": "Kubernetes Skill Pack", "summary": "A new Kubernetes Skill Pack from an unnamed author teaches agents to build two read-only skills: k8s-pod-diagnose, which diagnoses pod failures by branching on CrashLoopBackOff, ImagePullBackOff, Pending, and OOMKilled states, and k8s-manifest-review, which checks manifests for missing resource limits, probes, and security settings. The pack emphasizes a read-only skill boundary, excluding destructive commands like kubectl delete and kubectl apply, and is part of a course on production agent skills engineering.", "body_md": "· Agentic AI · 5 min read\n\n### 📋 Prerequisites\n\n- GitHub Skill Pack (previous lesson)\n\n### 🎯 What You'll Learn\n\n- Build a Decision skill that diagnoses common pod failure states\n- Build a Validator skill that checks manifests for missing resource limits and probes\n- Design a read-only skill boundary for a domain with genuinely destructive commands nearby\n\n## What This Pack Covers\n\nTwo skills: one that diagnoses why a pod is failing, branching on the specific failure signature; one that reviews a manifest before it’s applied. Kubernetes is a good domain for practicing a specific discipline from [Security and Governance](/courses/production-agent-skills-engineering/skill-security-governance): both skills here are deliberately scoped to read-only diagnosis and review, explicitly excluding the destructive commands (`kubectl delete`\n\n, `kubectl apply`\n\n) that live right next to the safe, read-only ones in the same CLI.\n\n## Skill 1: `k8s-pod-diagnose`\n\n```\n---\nname: k8s-pod-diagnose\ndescription: Diagnoses why a Kubernetes pod is failing or not starting — CrashLoopBackOff, ImagePullBackOff, Pending, and OOMKilled states. Use when a pod is failing, stuck, or the user asks why a deployment isn't working.\nmetadata:\n  version: \"1.0.0\"\ncompatibility: Requires kubectl configured with read access to the target cluster\n---\n\n## Available commands (read-only)\n\n- `kubectl get pod <name> -o wide` — status and node placement\n- `kubectl describe pod <name>` — events and container state detail\n- `kubectl logs <name> --previous` — logs from the last crashed instance\n\n## Diagnosis by status\n\n- **CrashLoopBackOff** — check `logs --previous` first; this is almost\n  always an application-level failure (unhandled exception, missing\n  config, failed startup check), not a Kubernetes problem. Report the\n  actual error from the logs, not just the pod status.\n- **ImagePullBackOff** — check `describe pod` events for the specific pull\n  error. Common causes: wrong image tag, private registry without\n  imagePullSecrets configured, or a typo in the image name.\n- **Pending** — check `describe pod` events for scheduling failures:\n  insufficient CPU/memory on any node, an unsatisfied node selector or\n  affinity rule, or an unbound PersistentVolumeClaim.\n- **OOMKilled** — visible in `describe pod` under \"Last State\". This means\n  the container exceeded its memory limit; report the configured limit\n  and suggest reviewing whether it's set appropriately for the workload.\n\n## Constraints\n\nThis skill is read-only. It diagnoses and reports — it does not restart,\ndelete, or scale anything. If a fix requires a cluster change, describe\nwhat change is needed and let the user apply it themselves.\n```\n\n**Pattern:** Decision — the correct diagnosis path branches entirely on which failure signature is present, per [Skill Design Patterns](/courses/production-agent-skills-engineering/skill-design-patterns).\n\n## Skill 2: `k8s-manifest-review`\n\n```\n---\nname: k8s-manifest-review\ndescription: Reviews a Kubernetes manifest (Deployment, StatefulSet, or Pod spec) before it's applied — missing resource limits, missing probes, and risky security settings. Use when reviewing a manifest, before running kubectl apply, or when the user asks if a manifest is production-ready.\nmetadata:\n  version: \"1.0.0\"\n---\n\n## Review checklist\n\n1. **Resource requests and limits.** Flag any container missing `resources.\n   requests` or `resources.limits` for CPU and memory — an unbounded\n   container can starve or be starved by its neighbors on a shared node.\n2. **Liveness and readiness probes.** Flag a missing `readinessProbe` on\n   any container serving traffic — without it, Kubernetes may route\n   traffic to a pod before it's actually ready. A missing `livenessProbe`\n   is worth flagging too, though less severe.\n3. **Privileged or root containers.** Flag `securityContext.privileged: true`\n   or a missing `runAsNonRoot: true` as a security concern requiring\n   explicit justification, not a default.\n4. **`latest` image tags.** Flag any `image:` using the `latest` tag rather\n   than a pinned version — this makes rollouts non-reproducible and\n   rollback unreliable.\n\nReport every finding, categorized as blocking (missing resource limits on\na production-bound manifest, privileged containers without justification)\nor advisory (missing liveness probe, latest tag in a non-production\nmanifest).\n```\n\n**Pattern:** Validator, with the same blocking-vs-advisory severity distinction used in the [SQL pack](/courses/agent-skill-library/sql-skill-pack) — not every finding deserves equal weight.\n\n## Why This Pack Stays Read-Only on Purpose\n\n`kubectl delete pod`\n\n, `kubectl apply -f`\n\n, and `kubectl scale`\n\nare one command away from everything covered above, and it would be easy to fold “just apply the fix” into either skill. Deliberately not doing that is the point: a diagnosis skill that also takes destructive action collapses the review step a human would otherwise get before a cluster changes state. If you extend this pack for your own use, treat any skill that *does* apply changes as a separate, more tightly governed skill — with its own explicit confirmation requirements, following [Security and Governance](/courses/production-agent-skills-engineering/skill-security-governance)’s guidance on pairing destructive tools with stated constraints — rather than quietly adding that capability to a skill that was scoped as read-only.\n\n## Testing Both Skills\n\nFor `k8s-pod-diagnose`\n\n, you’ll get the most realistic signal by testing against real (or realistically reproduced) failure states rather than descriptions of them — a genuinely misconfigured image tag, an intentionally-too-low memory limit — since the diagnosis depends on correctly reading actual `describe`\n\nand `logs`\n\noutput, not just recognizing a status name. For `k8s-manifest-review`\n\n, test against a manifest with every issue present, one that’s fully compliant, and one with only advisory-level issues — confirm advisory findings don’t get reported with the same urgency as blocking ones.\n\n## Summary\n\n`k8s-pod-diagnose`\n\nis a Decision skill branching on failure signature (CrashLoopBackOff, ImagePullBackOff, Pending, OOMKilled), strictly read-only`k8s-manifest-review`\n\nis a Validator checking resource limits, probes, security context, and image tags, with blocking-vs-advisory severity- Both skills deliberately exclude destructive commands available right next to the read-only ones — a governance boundary worth keeping explicit rather than convenient\n- Test diagnosis against real failure output, not just descriptions of failure types, since the skill’s value is in reading actual\n`describe`\n\n/`logs`\n\noutput correctly\n\nNext, the same read-only-first discipline applied to Terraform — plan review and drift detection before anything gets applied.", "url": "https://wpnews.pro/news/kubernetes-skill-pack", "canonical_source": "https://superml.org/tutorials/kubernetes-skill-pack", "published_at": "2026-07-26 00:00:00+00:00", "updated_at": "2026-08-01 04:59:46.653215+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools"], "entities": ["Kubernetes", "kubectl", "k8s-pod-diagnose", "k8s-manifest-review", "GitHub Skill Pack"], "alternates": {"html": "https://wpnews.pro/news/kubernetes-skill-pack", "markdown": "https://wpnews.pro/news/kubernetes-skill-pack.md", "text": "https://wpnews.pro/news/kubernetes-skill-pack.txt", "jsonld": "https://wpnews.pro/news/kubernetes-skill-pack.jsonld"}}