Kubernetes Orchestration

Kubernetes Orchestration Skill — Production-Ready Cluster Management

Overview

This skill provides comprehensive guidance for deploying and managing applications on Kubernetes, including deployment strategies, pod security policies, resource management, autoscaling, service mesh integration, ingress configuration, secrets management, and production best practices. Based on official Kubernetes documentation and CKA/CKAD/CKS certification standards.

When to Use

Use this skill when:

• Deploying applications to Kubernetes clusters
• Implementing deployment strategies (rolling, blue-green, canary)
• Configuring pod security policies and Pod Security Admission
• Setting up resource requests, limits, and quotas
• Implementing Horizontal Pod Autoscaling (HPA) or Vertical Pod Autoscaling (VPA)
• Configuring ingress controllers (NGINX, Traefik, AWS ALB)
• Setting up service mesh (Istio, Linkerd)
• Managing secrets and config maps securely
• Deploying stateful sets for databases and stateful applications
• Configuring daemon sets for logging and monitoring agents
• Setting up jobs and cron jobs for batch processing
• Implementing monitoring with Prometheus and Grafana
• Setting up logging with EFK/ELK stack
• Configuring network policies for pod isolation
• Implementing RBAC and service accounts
• Setting up persistent volumes and storage classes
• Using Helm charts for application packaging
• Implementing GitOps with ArgoCD or Flux
• Configuring node affinity, anti-affinity, taints and tolerations
• Setting up pod disruption budgets for high availability
• Implementing multi-cluster management strategies
• Configuring namespace isolation and resource quotas
• Securing clusters with OPA/Gatekeeper or Falco
• Scanning images with Trivy before deployment

Do NOT use this skill when:

• Containerizing applications (use docker-containerization skill)
• Setting up cloud infrastructure (use terraform-iac skill)
• Configuring CI/CD pipelines (use devops-pipeline skill)
• Building serverless functions (use aws-serverless or cloudflare-workers skill)
• Managing database schema (use database-design skill)
• Implementing application code (use backend-developer or frontend-developer skill)
• Setting up standalone monitoring without Kubernetes (use monitoring skill)
• Deploying to PaaS platforms without Kubernetes (use vercel-deployment or cloudflare-pages skill)

Why avoid: Kubernetes is for container orchestration, not containerization, infrastructure provisioning, or application development. Use the right tool for each layer of the stack.

Core Concepts

Workload Types

| Type | Use Case | State | Scaling | | ------------------------- | -------------------------- | ---------- | ---------- | | Deployment | Stateless applications | Stateless | Horizontal | | StatefulSet | Databases, message queues | Stateful | Ordered | | DaemonSet | Logging, monitoring agents | Node-bound | 1 per node | | Job | One-time batch processing | Ephemeral | Fixed | | CronJob | Scheduled batch processing | Ephemeral | Scheduled | | ReplicationController | Legacy pod replication | Stateless | Horizontal |

Deployment Strategies

| Strategy | Downtime | Risk | Rollback | Use Case | | ------------------ | -------- | ------ | --------- | ------------------------------- | | Rolling Update | Zero | Low | Automatic | Most applications | | Blue-Green | Zero | Medium | Instant | High-traffic apps | | Canary | Zero | Low | Gradual | Risky deployments | | Recreate | Full | High | Manual | Database migrations | | Shadow | Zero | Lowest | N/A | Testing with production traffic |

Resource Management Hierarchy

Cluster
├── Namespaces (logical isolation)
│   ├── ResourceQuotas (namespace limits)
│   └── LimitRanges (default pod limits)
│   └── Pods
│       ├── Containers
│       │   ├── Requests (guaranteed resources)
│       │   └── Limits (maximum resources)

Deployment Strategy Examples

Rolling Update (Default)

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web-app
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1 # Max pods unavailable during update
      maxSurge: 1 # Max extra pods during update
  template:
    metadata:
      labels:
        app: web-app
        version: v1
    spec:
      containers:
        - name: web-app
          image: myregistry/web-app:v1.2.0
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: '100m'
              memory: '128Mi'
            limits:
              cpu: '500m'
              memory: '512Mi'
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 5

Blue-Green Deployment

# Blue (current production)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app-blue
spec:
  replicas: 3
  template:
    metadata:
      labels:
        app: web-app
        track: blue
    spec:
      containers:
        - name: web-app
          image: myregistry/web-app:v1.1.0
---
# Green (new version)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app-green
spec:
  replicas: 3
  template:
    metadata:
      labels:
        app: web-app
        track: green
    spec:
      containers:
        - name: web-app
          image: myregistry/web-app:v1.2.0
---
# Service switches between blue and green
apiVersion: v1
kind: Service
metadata:
  name: web-app-service
spec:
  selector:
    app: web-app
    track: green # Change to 'blue' to rollback
  ports:
    - port: 80
      targetPort: 8080
  type: ClusterIP

Canary Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app-stable
spec:
  replicas: 9 # 90% traffic
  template:
    metadata:
      labels:
        app: web-app
        version: stable
    spec:
      containers:
        - name: web-app
          image: myregistry/web-app:v1.1.0
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app-canary
spec:
  replicas: 1 # 10% traffic
  template:
    metadata:
      labels:
        app: web-app
        version: canary
    spec:
      containers:
        - name: web-app
          image: myregistry/web-app:v1.2.0
---
# Service distributes traffic based on replica count
apiVersion: v1
kind: Service
metadata:
  name: web-app-service
spec:
  selector:
    app: web-app
  ports:
    - port: 80
      targetPort: 8080

Pod Security and RBAC

Pod Security Admission (Replaces PSP)

apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    # Pod Security Standards: restricted (most secure)
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

RBAC Configuration

apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-service-account
  namespace: production
automountServiceAccountToken: false # Disable by default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: production
rules:
  - apiGroups: ['']
    resources: ['pods']
    verbs: ['get', 'watch', 'list']
  - apiGroups: ['apps']
    resources: ['deployments']
    verbs: ['get', 'watch', 'list']
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: production
subjects:
  - kind: ServiceAccount
    name: app-service-account
    namespace: production
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Security Context

apiVersion: apps/v1
kind: Deployment
metadata:
  name: secure-app
spec:
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: app
          image: myregistry/app:latest
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir: {}

Resource Management and Autoscaling

Horizontal Pod Autoscaler

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: web-app-hpa
  namespace: production
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: web-app
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80
    - type: Pods
      pods:
        metric:
          name: requests-per-second
        target:
          type: AverageValue
          averageValue: '1000'
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:
        - type: Percent
          value: 10
          periodSeconds: 60
    scaleUp:
      stabilizationWindowSeconds: 60
      policies:
        - type: Percent
          value: 100
          periodSeconds: 60
        - type: Pods
          value: 4
          periodSeconds: 60
      selectPolicy: Max

Resource Quotas and Limit Ranges

apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-quota
  namespace: production
spec:
  hard:
    requests.cpu: '10'
    requests.memory: 20Gi
    limits.cpu: '20'
    limits.memory: 40Gi
    pods: '50'
    services: '20'
    persistentvolumeclaims: '10'
---
apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: production
spec:
  limits:
    - default:
        cpu: '500m'
        memory: '512Mi'
      defaultRequest:
        cpu: '100m'
        memory: '128Mi'
      max:
        cpu: '2'
        memory: '4Gi'
      min:
        cpu: '50m'
        memory: '64Mi'
      type: Container

Ingress Configuration

NGINX Ingress Controller

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-app-ingress
  namespace: production
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: 'true'
    nginx.ingress.kubernetes.io/rate-limit: '100'
    nginx.ingress.kubernetes.io/rate-limit-window: '1m'
    nginx.ingress.kubernetes.io/proxy-body-size: '50m'
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  tls:
    - hosts:
        - app.example.com
      secretName: app-tls-secret
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web-app-service
                port:
                  number: 80
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: api-service
                port:
                  number: 8080

Ingress with Canary (NGINX)

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-app-canary-ingress
  annotations:
    nginx.ingress.kubernetes.io/canary: 'true'
    nginx.ingress.kubernetes.io/canary-weight: '10' # 10% traffic
spec:
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web-app-canary
                port:
                  number: 80

Service Mesh (Istio)

VirtualService and DestinationRule

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: web-app-vs
spec:
  hosts:
    - web-app
  http:
    - route:
        - destination:
            host: web-app
            subset: v1
          weight: 90
        - destination:
            host: web-app
            subset: v2
          weight: 10
      timeout: 5s
      retries:
        attempts: 3
        perTryTimeout: 2s
        retryOn: gateway-error,connect-failure,refused-stream
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: web-app-dr
spec:
  host: web-app
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        h2UpgradePolicy: DEFAULT
        http1MaxPendingRequests: 100
        http2MaxRequests: 1000
    outlierDetection:
      consecutive5xxErrors: 5
      interval: 30s
      baseEjectionTime: 30s
      maxEjectionPercent: 50
  subsets:
    - name: v1
      labels:
        version: v1
    - name: v2
      labels:
        version: v2

Secrets and Config Maps

Secrets Management

apiVersion: v1
kind: Secret
metadata:
  name: app-secrets
  namespace: production
type: Opaque
stringData:
  database-url: 'postgresql://user:password@db:5432/app'
  api-key: 'sk-xxxxxxxxxxxxxxxx'
  jwt-secret: 'super-secret-jwt-key'
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app
spec:
  template:
    spec:
      containers:
        - name: app
          image: myregistry/app:latest
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: app-secrets
                  key: database-url
            - name: API_KEY
              valueFrom:
                secretKeyRef:
                  name: app-secrets
                  key: api-key
          # Mount secrets as files (more secure than env vars)
          volumeMounts:
            - name: secret-volume
              mountPath: /etc/secrets
              readOnly: true
      volumes:
        - name: secret-volume
          secret:
            secretName: app-secrets

Config Maps

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
  namespace: production
data:
  APP_ENV: 'production'
  LOG_LEVEL: 'info'
  CACHE_TTL: '3600'
  # Configuration file
  app.conf: |
    [server]
    port = 8080
    workers = 4

    [database]
    pool_size = 10
    timeout = 30
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app
spec:
  template:
    spec:
      containers:
        - name: app
          image: myregistry/app:latest
          envFrom:
            - configMapRef:
                name: app-config
          volumeMounts:
            - name: config-volume
              mountPath: /etc/app
      volumes:
        - name: config-volume
          configMap:
            name: app-config
            items:
              - key: app.conf
                path: app.conf

Stateful Sets for Databases

PostgreSQL StatefulSet

apiVersion: v1
kind: Service
metadata:
  name: postgres-headless
  namespace: production
spec:
  clusterIP: None
  selector:
    app: postgres
  ports:
    - port: 5432
      name: postgres
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: postgres
  namespace: production
spec:
  serviceName: postgres-headless
  replicas: 3
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 999
        fsGroup: 999
      containers:
        - name: postgres
          image: postgres:16-alpine
          ports:

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Omar-Obando](https://github.com/Omar-Obando)
- **Source:** [Omar-Obando/qwen-orchestrator](https://github.com/Omar-Obando/qwen-orchestrator)
- **License:** MIT
- **Homepage:** https://qwen.ai/qwencode

Install and usage instructions live in the source repository linked above.