Cluster Deployment Engineer

Cluster Deployment Engineer

When to Use

• Bootstrap, upgrade, or resize a Kubernetes cluster (managed or self-hosted)
• Install or upgrade cluster add-ons: ingress controller, CNI, metrics, DNS, cert-manager
• Deploy workloads via Helm, Kustomize, or raw manifests with health checks
• Configure namespaces, resource quotas, LimitRanges, PriorityClasses
• Design cluster RBAC, ServiceAccounts, and namespace isolation
• Operate GitOps controllers (Argo CD, Flux) targeting cluster state
• Troubleshoot Pending pods, ImagePullBackOff, networking, and control-plane issues
• Plan multi-cluster or environment-per-cluster topology

When NOT to Use

• Design VPC, subnets, IAM, or Terraform modules for cloud foundation → infrastructure-engineer
• Author or fix generic CI/CD pipelines and build systems → devops
• Choose canary, blue-green, or feature-flag rollout strategy → deployment-strategist
• Build developer portals, scaffolders, or platform product roadmap → platform-engineer
• Pipeline SAST, SBOM, signing gates → devsecops
• Cross-service architecture ADRs → senior-system-architecture
• SEV program and paging policy → incident-management-engineer
• Host/GPU inventory, stranded kW, hardware refresh → data-center-compute-supply-efficiency

Related skills

| Need | Skill | |---|---| | Cloud networking and cluster IaC | infrastructure-engineer | | VPC, IAM, load balancers for clusters | cloud-engineer | | CI/CD, GitOps pipelines, delivery SLOs | devops | | Release rollout and rollback planning | deployment-strategist | | Multi-tenant platform product | platform-engineer | | Admission policies, image scan, runtime security | devsecops | | Product tenant isolation on K8s | product-infrastructure-security-engineer | | Launch comms for cluster changes | communication-lead | | Data center / colo facility design | data-center-design-execution-lead | | Compute supply and DC resource efficiency | data-center-compute-supply-efficiency | | RL distributed training workloads | ml-systems-engineer-rl-engineering | | Capacity delivery and rack-ready gates | senior-data-center-capacity-delivery-manager | | On-site rack-and-stack, cabling, sign-off | field-services-engineer |

Core Workflows

1. Cluster lifecycle

1. Requirements — version skew policy, HA, regions, node SKUs, autoscaling bounds
2. Bootstrap — control plane, node groups, OIDC for workloads
3. Add-ons — ordered install (CNI → DNS → ingress → certs → metrics)
4. Upgrade — control plane first, node cordon/drain, validate API and workloads
5. Decommission — drain, backup etcd/state if self-managed, destroy order

See references/cluster_lifecycle.md.

2. Workload delivery

1. Package — Helm chart or Kustomize overlay per env
2. Values — resources, replicas, probes, affinity, topology spread
3. Apply — dry-run, diff, apply; watch rollout status
4. Verify — readiness, Service endpoints, ingress, smoke test
5. Rollback — helm rollback or GitOps revert commit

See references/workload_delivery.md.

3. Networking and ingress

• Services, Endpoints, EndpointSlices
• Ingress / Gateway API, TLS termination
• NetworkPolicy default-deny + allow lists
• Service mesh only when required (complexity cost)

See references/networking_ingress.md.

4. Security and tenancy

• Namespace per team/env; quotas and LimitRanges
• RBAC: least privilege; no cluster-admin for apps
• Secrets: external secrets operator; no plain Secrets in git
• Pod Security Admission (restricted baseline)

Pair with devsecops for admission controllers and image policy.

See references/cluster_security_rbac.md.

5. GitOps at cluster scope

• One repo or path per cluster/environment
• App-of-apps or directory per add-on
• Sync waves for ordering; health checks and sync hooks
• Drift: prefer Git as source of truth

See references/gitops_cluster.md.

6. Troubleshooting

| Symptom | First checks | |---|---| | Pending | Events, requests vs allocatable, taints, PDB | | CrashLoopBackOff | Logs, probes, config mounts, OOM | | No traffic | Endpoints, NetworkPolicy, ingress rules | | Slow deploy | Image pull, init containers, quota |

See references/troubleshooting.md.

Output standards

• Manifest or Helm change with env-specific values table
• Pre/post upgrade checklist with rollback step
• Runbook snippet: symptoms, commands, escalation to infrastructure-engineer if cloud API/IaC

When to load references

• Bootstrap, upgrade, nodes → references/cluster_lifecycle.md
• Helm, Kustomize, rollouts → references/workload_delivery.md
• Ingress, CNI, policies → references/networking_ingress.md
• RBAC, quotas, PSA → references/cluster_security_rbac.md
• Argo CD / Flux → references/gitops_cluster.md
• Incidents and debug → references/troubleshooting.md

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: daemon-blockint-tech
• Source: daemon-blockint-tech/Agentic-Enteprises-Skill
• License: MIT

Install and usage instructions live in the source repository linked above.