Kubernetes Skill

Kubernetes debugging, security hardening, and infrastructure tooling. Covers pod triage, RBAC, network policies, and cobaltcore hypervisor components.

Reference Loading Table

Signal	Reference	Size
CrashLoopBackOff, OOMKilled, config error, health check, liveness probe, ImagePullBackOff, Pending, FailedScheduling	references/crash-diagnosis.md	~140 lines
service resolution, DNS, CoreDNS, port-forward, NetworkPolicy ingress/egress	references/network-debugging.md	~50 lines
CPU throttling, memory limit, OOMKill, ephemeral storage, DiskPressure, debug container	references/resource-debugging.md	~100 lines
RBAC, Role, RoleBinding, ClusterRole, ServiceAccount, least-privilege	references/rbac-patterns.md	~60 lines
PodSecurity, SecurityContext, runAsNonRoot, readOnlyRootFilesystem, restricted, baseline	references/pod-security.md	~90 lines
NetworkPolicy, default-deny, allow-list, namespace isolation	references/network-policies.md	~70 lines
cosign, Kyverno, OPA, admission controller, Sealed Secrets, External Secrets	references/supply-chain.md	~120 lines
kvm-exporter, metrics, prometheus, libvirt, hypervisor, collector, scrape, steal time, NUMA, cgroups, cloud hypervisor	references/cobalt-kvm-exporter.md	~800 lines
cobaltcore concurrency, goroutine, semaphore, TryLock	references/cobalt-concurrency-patterns.md	~200 lines
cobaltcore testing, mock, moq, Kind cluster	references/cobalt-testing-patterns.md	~200 lines
kubernetes debugging process, triage flow, diagnosis routing	references/kubernetes-debugging.md	~50 lines
kubernetes security process, RBAC + pod security + network hardening	references/kubernetes-security.md	~50 lines
cobaltcore overview, KVM exporter architecture, component identification	references/cobalt-core.md	~50 lines

Loading rule. Read the references whose signals match the task before responding.

---

Phase 1: TRIAGE

Determine which Kubernetes domain the request targets:

Domain	Load references	Action
Pod failure, CrashLoop, OOM	crash-diagnosis, resource-debugging	Triage flow
Network, DNS, service resolution	network-debugging, network-policies	Connectivity diagnosis
RBAC, permissions, roles	rbac-patterns	Access control
Pod hardening, container security	pod-security	Security posture
Image signing, secrets, admission	supply-chain	Supply chain
Cobaltcore / KVM exporter	kvm-exporter + cobalt refs	Component-specific

Always specify -n <namespace> explicitly in every kubectl command.

Gate: Domain identified and relevant references loaded.

---

Phase 2: DIAGNOSE / RESPOND

For debugging: follow the triage flow — describe, logs, events, exec. Use read-only commands to gather evidence before proposing changes.

For security: provide concrete YAML manifests and specific configurations. Answer with reference-backed specifics, not generic advice.

For cobaltcore: use component-specific reference knowledge for architecture, metrics, configuration, and deployment details.

Gate: Specific, reference-backed diagnosis or response provided.

---

Phase 3: VERIFY

For debugging: confirm the fix resolves the symptom. For security: validate against the misconfiguration table in supply-chain.md. For cobaltcore: verify against component test patterns.