Kubernetes专家技能指南：部署、网络、存储、安全与故障排查全流程

kubernetes-specialist by jeffallan/claude-skills

4,600 周安装量

7,200 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/jeffallan/claude-skills --skill kubernetes-specialist

云服务开发运维

🇨🇳中文介绍

Kubernetes 专家

何时使用此技能

部署工作负载（Deployments、StatefulSets、DaemonSets、Jobs）
配置网络（Services、Ingress、NetworkPolicies）
管理配置（ConfigMaps、Secrets、环境变量）
设置持久化存储（PV、PVC、StorageClasses）
为应用程序打包创建 Helm charts
排查集群和工作负载问题
实施安全最佳实践

核心工作流程

分析需求 — 了解工作负载特性、扩缩容需求、安全要求
设计架构 — 选择工作负载类型、网络模式、存储解决方案
实现清单 — 使用适当的资源限制、健康检查创建声明式 YAML
安全加固 — 应用 RBAC、NetworkPolicies、Pod 安全标准、最小权限原则
验证 — 运行 kubectl rollout status、kubectl get pods -w 和 kubectl describe pod <name> 以确认健康状态；如有需要，使用 kubectl rollout undo 回滚

参考指南

根据上下文加载详细指导：

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

包含资源限制、探针和安全上下文的 Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  namespace: my-namespace
  labels:
    app: my-app
    version: "1.2.3"
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
        version: "1.2.3"
    spec:
      serviceAccountName: my-app-sa   # 切勿使用默认 SA
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 2000
      containers:
        - name: my-app
          image: my-registry/my-app:1.2.3   # 切勿使用 latest
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: "100m"
              memory: "128Mi"
            limits:
              cpu: "500m"
              memory: "512Mi"
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 20
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          envFrom:
            - secretRef:
                name: my-app-secret   # 从 Secret 拉取凭据，而非 ConfigMap

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-app-sa
  namespace: my-namespace
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: my-app-role
  namespace: my-namespace
rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list"]   # 仅授予所需权限
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: my-app-rolebinding
  namespace: my-namespace
subjects:
  - kind: ServiceAccount
    name: my-app-sa
    namespace: my-namespace
roleRef:
  kind: Role
  name: my-app-role
  apiGroup: rbac.authorization.k8s.io

NetworkPolicy（默认拒绝 + 显式允许）

# 默认拒绝所有入站和出站流量
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: my-namespace
spec:
  podSelector: {}
  policyTypes: ["Ingress", "Egress"]
---
# 仅允许特定流量
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-my-app
  namespace: my-namespace
spec:
  podSelector:
    matchLabels:
      app: my-app
  policyTypes: ["Ingress"]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080

部署后，验证健康状态和安全态势：

# 观察滚动更新完成
kubectl rollout status deployment/my-app -n my-namespace

# 流式传输 Pod 事件以捕获崩溃循环或镜像拉取错误
kubectl get pods -n my-namespace -w

# 检查特定 Pod 的故障
kubectl describe pod <pod-name> -n my-namespace

# 检查容器日志
kubectl logs <pod-name> -n my-namespace --previous   # 对已崩溃的容器使用 --previous

# 验证资源使用情况与限制
kubectl top pods -n my-namespace

# 审计服务账户的 RBAC 权限
kubectl auth can-i --list --as=system:serviceaccount:my-namespace:my-app-sa

# 回滚失败的部署
kubectl rollout undo deployment/my-app -n my-namespace

实现 Kubernetes 资源时，请提供：

具有适当结构的完整 YAML 清单
所需的 RBAC 配置（ServiceAccount、Role、RoleBinding）
用于网络隔离的 NetworkPolicy
设计决策和安全考量的简要说明

🇺🇸English

Kubernetes Specialist

When to Use This Skill

Deploying workloads (Deployments, StatefulSets, DaemonSets, Jobs)
Configuring networking (Services, Ingress, NetworkPolicies)
Managing configuration (ConfigMaps, Secrets, environment variables)
Setting up persistent storage (PV, PVC, StorageClasses)
Creating Helm charts for application packaging
Troubleshooting cluster and workload issues
Implementing security best practices

Core Workflow

Analyze requirements — Understand workload characteristics, scaling needs, security requirements
Design architecture — Choose workload types, networking patterns, storage solutions
Implement manifests — Create declarative YAML with proper resource limits, health checks
Secure — Apply RBAC, NetworkPolicies, Pod Security Standards, least privilege
Validate — Run kubectl rollout status, kubectl get pods -w, and kubectl describe pod <name> to confirm health; roll back with kubectl rollout undo if needed

Reference Guide

Load detailed guidance based on context:

Topic	Reference	Load When
Workloads	`references/workloads.md`	Deployments, StatefulSets, DaemonSets, Jobs, CronJobs
Networking	`references/networking.md`	Services, Ingress, NetworkPolicies, DNS
Configuration	`references/configuration.md`	ConfigMaps, Secrets, environment variables
Storage	`references/storage.md`	PV, PVC, StorageClasses, CSI drivers
Helm Charts	`references/helm-charts.md`

Constraints

MUST DO

Use declarative YAML manifests (avoid imperative kubectl commands)
Set resource requests and limits on all containers
Include liveness and readiness probes
Use secrets for sensitive data (never hardcode credentials)
Apply least privilege RBAC permissions
Implement NetworkPolicies for network segmentation
Use namespaces for logical isolation
Label resources consistently for organization
Document configuration decisions in annotations

MUST NOT DO

Deploy to production without resource limits
Store secrets in ConfigMaps or as plain environment variables
Use default ServiceAccount for application pods
Allow unrestricted network access (default allow-all)
Run containers as root without justification
Skip health checks (liveness/readiness probes)
Use latest tag for production images
Expose unnecessary ports or services

Common YAML Patterns

Deployment with resource limits, probes, and security context

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  namespace: my-namespace
  labels:
    app: my-app
    version: "1.2.3"
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
        version: "1.2.3"
    spec:
      serviceAccountName: my-app-sa   # never use default SA
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 2000
      containers:
        - name: my-app
          image: my-registry/my-app:1.2.3   # never use latest
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: "100m"
              memory: "128Mi"
            limits:
              cpu: "500m"
              memory: "512Mi"
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 20
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          envFrom:
            - secretRef:
                name: my-app-secret   # pull credentials from Secret, not ConfigMap

Minimal RBAC (least privilege)

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-app-sa
  namespace: my-namespace
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: my-app-role
  namespace: my-namespace
rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list"]   # grant only what is needed
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: my-app-rolebinding
  namespace: my-namespace
subjects:
  - kind: ServiceAccount
    name: my-app-sa
    namespace: my-namespace
roleRef:
  kind: Role
  name: my-app-role
  apiGroup: rbac.authorization.k8s.io

NetworkPolicy (default-deny + explicit allow)

# Deny all ingress and egress by default
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: my-namespace
spec:
  podSelector: {}
  policyTypes: ["Ingress", "Egress"]
---
# Allow only specific traffic
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-my-app
  namespace: my-namespace
spec:
  podSelector:
    matchLabels:
      app: my-app
  policyTypes: ["Ingress"]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080

Validation Commands

After deploying, verify health and security posture:

# Watch rollout complete
kubectl rollout status deployment/my-app -n my-namespace

# Stream pod events to catch crash loops or image pull errors
kubectl get pods -n my-namespace -w

# Inspect a specific pod for failures
kubectl describe pod <pod-name> -n my-namespace

# Check container logs
kubectl logs <pod-name> -n my-namespace --previous   # use --previous for crashed containers

# Verify resource usage vs. limits
kubectl top pods -n my-namespace

# Audit RBAC permissions for a service account
kubectl auth can-i --list --as=system:serviceaccount:my-namespace:my-app-sa

# Roll back a failed deployment
kubectl rollout undo deployment/my-app -n my-namespace

Output Templates

When implementing Kubernetes resources, provide:

Complete YAML manifests with proper structure
RBAC configuration if needed (ServiceAccount, Role, RoleBinding)
NetworkPolicy for network isolation
Brief explanation of design decisions and security considerations

Weekly Installs

4.6K

Repository

jeffallan/claude-skills

GitHub Stars

7.2K

First Seen

Jan 21, 2026

Security Audits

Gen Agent Trust HubPass SocketPass SnykPass

Installed on

claude-code3.1K

opencode2.8K

gemini-cli2.8K

codex2.8K

github-copilot2.7K

amp2.5K

工作负载	`references/workloads.md`	Deployments, StatefulSets, DaemonSets, Jobs, CronJobs
网络	`references/networking.md`	Services, Ingress, NetworkPolicies, DNS
配置	`references/configuration.md`	ConfigMaps, Secrets, 环境变量
存储	`references/storage.md`	PV, PVC, StorageClasses, CSI 驱动程序
Helm Charts	`references/helm-charts.md`	Chart 结构、values、模板、hooks、测试、仓库
故障排查	`references/troubleshooting.md`	kubectl debug、日志、事件、常见问题
自定义 Operator	`references/custom-operators.md`	CRD、Operator SDK、controller-runtime、调和循环
服务网格	`references/service-mesh.md`	Istio、Linkerd、流量管理、mTLS、金丝雀发布
GitOps	`references/gitops.md`	ArgoCD、Flux、渐进式交付、密封密钥
成本优化	`references/cost-optimization.md`	VPA、HPA 调优、Spot 实例、配额、资源规格调整
多集群	`references/multi-cluster.md`	Cluster API、联邦、跨集群网络、灾难恢复