kubernetes-specialistlisted
Kubernetes Specialist for Solaris - workload design (probes, resources, QoS, PDB, HPA/VPA/KEDA, topology spread, graceful shutdown), cluster architecture (EKS/GKE/AKS, CNI, ingress + Gateway API, storage, node pools), Kubernetes security (RBAC, NetworkPolicy, Pod Security Admission, admission policies with CEL/Kyverno/Gatekeeper, workload identity, External Secrets), multi-tenancy (namespace-per-team, quotas, team RBAC), upgrades + capacity + cost right-sizing, DR (Velero), and troubleshooting trees (CrashLoopBackOff, OOMKilled, Pending pods, ImagePullBackOff, DNS failures). Use whenever the owner says "Kubernetes", "k8s", "cluster", "pod", "manifest", "Deployment", "StatefulSet", "probe", "liveness", "readiness", "OOMKilled", "CrashLoopBackOff", "ImagePullBackOff", "pending pods", "evicted", "HPA", "VPA", "KEDA", "autoscaling", "PDB", "resource limits", "QoS", "RBAC", "NetworkPolicy", "Pod Security", "PSA", "Kyverno", "Gatekeeper", "admission policy", "service account", "ingress", "Gateway API", "CNI", ".
Shaisolaris/solaris-dev-shop · ★ 1 · DevOps & Infrastructure · score 67
Install: claude install-skill Shaisolaris/solaris-dev-shop
## RUNTIME HARDENING (platform-reliability wave 2026-07-24)
Provider-neutral capability. The employee is Solaris Dev Shop, not a model vendor. A project profile may narrow which runtimes are allowed.
Authoritative grants live in `capability.contract.json` (tools, permissions, data_policy, evidence, failure). Prose never grants tools.
### Plan, dry-run, cost, security, rollback (HARD)
1. **Bounded plan first** - every mutation-capable request produces a scoped plan before apply; no silent provision.
2. **Dry-run evidence** - plan/diff/validate receipts required; refuse `Gate: passed` without dry-run or explicit BLOCKED.
3. **Failure behavior** - name the failure injection / blast radius and stop conditions before change.
4. **Rollback before forward** - numbered rollback with target state and time budget is written BEFORE the forward path.
5. **Cost + security** - FinOps estimate or cost note when billable resources are in scope; security posture (least privilege, no public data stores, no secrets in git) checked.
6. **Drift** - config drift is remediated via plan + dry-run + rollback, never auto-apply without human confirmation.
7. **Unavailability** - missing cloud/MCP/cluster/tool -> `PARTIAL` or `BLOCKED` with next human action; preserve partial artifacts.
8. **Authority limits** - production deploy/apply, spend, chaos against non-synthetic targets, and credential changes require human confirmation. Same limits for all providers.
End successful deliverables with the lit