agentsclimarketplace

Kubernetes pod spec review

Skill Raishin/vanguard-frontier-agentic/skills/kubernetes/kubernetes-pod-spec-review

Curated marketplace of AI skills, agents, and rules for cloud, zero-trust, and compliance-aware engineering - works with Claude Code, Codex, Cursor, Copilot, and more.

Install
npx -y skills add Raishin/vanguard-frontier-agentic --skill kubernetes-pod-spec-review

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 18 stars18 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use this skill when reviewing a Kubernetes Pod spec, Deployment spec, or StatefulSet spec for correctness, security posture, and production-readiness. Trigger on any request to audit, validate, or score a workload manifest.

SKILL.md

2.5 KB, 447 tokens by cl100k_base, as published. Nobody here has run it

Kubernetes Pod Spec Review

Purpose

Review Kubernetes Pod, Deployment, and StatefulSet specifications for probe correctness, resource QoS configuration, securityContext posture, image pull policy safety, secret consumption patterns, topology spread, and termination grace period alignment. Output a structured findings list with severity, evidence, and safe remediation steps — aligned with CKAD domain knowledge and production-readiness standards.

Lean operating rules

  • Check both livenessProbe and readinessProbe; flag missing probes as HIGH for Deployments receiving traffic. Flag aggressive livenessProbe.failureThreshold (<=2) that kills pods during GC pauses.
  • Review resources.requests and resources.limits; flag missing requests (unschedulable under pressure) as MEDIUM and flag CPU limits without requests as Burstable QoS risk.
  • Audit securityContext at both pod level (runAsNonRoot, seccompProfile) and container level (allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, capabilities.drop: [ALL]).
  • Flag latest image tag combined with imagePullPolicy: IfNotPresent as HIGH — image is never refreshed after first pull.
  • Flag Secrets consumed via envFrom.secretRef (bulk-mount exposes all keys) as MEDIUM; recommend volume mounts or specific env.valueFrom.secretKeyRef.
  • Check topologySpreadConstraints for multi-replica Deployments; flag absence as MEDIUM (single AZ failure = full outage).
  • Review terminationGracePeriodSeconds against application drain time; flag default 30s for gRPC or database workloads as MEDIUM.
  • Label all findings as live evidence, documentation-based, or inference.

References

Load these only when needed:

Response minimum

  • Severity-labeled findings list (CRITICAL / HIGH / MEDIUM / LOW)
  • Evidence source for each finding
  • Specific field path that caused the finding (e.g., spec.containers[0].livenessProbe)
  • Recommended remediation with example YAML snippet
  • Overall production-readiness verdict

What ships with it: 2 files

8.2 KB alongside SKILL.md

references/

Keep looking

Skills are one crate of 327,167. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.