# Kubernetes Orchestration

> Use when deploying applications to Kubernetes, implementing deployment strategies, pod security, resource management, horizontal pod autoscaling, service mesh, ingress controllers, secrets management, and production-ready cluster configurations. Includes Helm charts, Kustomize, GitOps, and CKA/CKAD/CKS best practices.

- **Type:** Skill
- **Install:** `agentstack add skill-omar-obando-qwen-orchestrator-kubernetes-orchestration`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Omar-Obando](https://agentstack.voostack.com/s/omar-obando)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Omar-Obando](https://github.com/Omar-Obando)
- **Source:** https://github.com/Omar-Obando/qwen-orchestrator/tree/main/skills/kubernetes-orchestration
- **Website:** https://qwen.ai/qwencode

## Install

```sh
agentstack add skill-omar-obando-qwen-orchestrator-kubernetes-orchestration
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Kubernetes Orchestration Skill — Production-Ready Cluster Management

## Overview

This skill provides comprehensive guidance for **deploying and managing applications on Kubernetes**, including deployment strategies, pod security policies, resource management, autoscaling, service mesh integration, ingress configuration, secrets management, and production best practices. Based on official Kubernetes documentation and CKA/CKAD/CKS certification standards.

## When to Use

**Use this skill when:**

- Deploying applications to Kubernetes clusters
- Implementing deployment strategies (rolling, blue-green, canary)
- Configuring pod security policies and Pod Security Admission
- Setting up resource requests, limits, and quotas
- Implementing Horizontal Pod Autoscaling (HPA) or Vertical Pod Autoscaling (VPA)
- Configuring ingress controllers (NGINX, Traefik, AWS ALB)
- Setting up service mesh (Istio, Linkerd)
- Managing secrets and config maps securely
- Deploying stateful sets for databases and stateful applications
- Configuring daemon sets for logging and monitoring agents
- Setting up jobs and cron jobs for batch processing
- Implementing monitoring with Prometheus and Grafana
- Setting up logging with EFK/ELK stack
- Configuring network policies for pod isolation
- Implementing RBAC and service accounts
- Setting up persistent volumes and storage classes
- Using Helm charts for application packaging
- Implementing GitOps with ArgoCD or Flux
- Configuring node affinity, anti-affinity, taints and tolerations
- Setting up pod disruption budgets for high availability
- Implementing multi-cluster management strategies
- Configuring namespace isolation and resource quotas
- Securing clusters with OPA/Gatekeeper or Falco
- Scanning images with Trivy before deployment

**Do NOT use this skill when:**

- Containerizing applications (use docker-containerization skill)
- Setting up cloud infrastructure (use terraform-iac skill)
- Configuring CI/CD pipelines (use devops-pipeline skill)
- Building serverless functions (use aws-serverless or cloudflare-workers skill)
- Managing database schema (use database-design skill)
- Implementing application code (use backend-developer or frontend-developer skill)
- Setting up standalone monitoring without Kubernetes (use monitoring skill)
- Deploying to PaaS platforms without Kubernetes (use vercel-deployment or cloudflare-pages skill)

**Why avoid:** Kubernetes is for container orchestration, not containerization, infrastructure provisioning, or application development. Use the right tool for each layer of the stack.

## Core Concepts

### Workload Types

| Type                      | Use Case                   | State      | Scaling    |
| ------------------------- | -------------------------- | ---------- | ---------- |
| **Deployment**            | Stateless applications     | Stateless  | Horizontal |
| **StatefulSet**           | Databases, message queues  | Stateful   | Ordered    |
| **DaemonSet**             | Logging, monitoring agents | Node-bound | 1 per node |
| **Job**                   | One-time batch processing  | Ephemeral  | Fixed      |
| **CronJob**               | Scheduled batch processing | Ephemeral  | Scheduled  |
| **ReplicationController** | Legacy pod replication     | Stateless  | Horizontal |

### Deployment Strategies

| Strategy           | Downtime | Risk   | Rollback  | Use Case                        |
| ------------------ | -------- | ------ | --------- | ------------------------------- |
| **Rolling Update** | Zero     | Low    | Automatic | Most applications               |
| **Blue-Green**     | Zero     | Medium | Instant   | High-traffic apps               |
| **Canary**         | Zero     | Low    | Gradual   | Risky deployments               |
| **Recreate**       | Full     | High   | Manual    | Database migrations             |
| **Shadow**         | Zero     | Lowest | N/A       | Testing with production traffic |

### Resource Management Hierarchy

```
Cluster
├── Namespaces (logical isolation)
│   ├── ResourceQuotas (namespace limits)
│   └── LimitRanges (default pod limits)
│   └── Pods
│       ├── Containers
│       │   ├── Requests (guaranteed resources)
│       │   └── Limits (maximum resources)
```

## Deployment Strategy Examples

### Rolling Update (Default)

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web-app
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1 # Max pods unavailable during update
      maxSurge: 1 # Max extra pods during update
  template:
    metadata:
      labels:
        app: web-app
        version: v1
    spec:
      containers:
        - name: web-app
          image: myregistry/web-app:v1.2.0
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: '100m'
              memory: '128Mi'
            limits:
              cpu: '500m'
              memory: '512Mi'
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 5
```

### Blue-Green Deployment

```yaml
# Blue (current production)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app-blue
spec:
  replicas: 3
  template:
    metadata:
      labels:
        app: web-app
        track: blue
    spec:
      containers:
        - name: web-app
          image: myregistry/web-app:v1.1.0
---
# Green (new version)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app-green
spec:
  replicas: 3
  template:
    metadata:
      labels:
        app: web-app
        track: green
    spec:
      containers:
        - name: web-app
          image: myregistry/web-app:v1.2.0
---
# Service switches between blue and green
apiVersion: v1
kind: Service
metadata:
  name: web-app-service
spec:
  selector:
    app: web-app
    track: green # Change to 'blue' to rollback
  ports:
    - port: 80
      targetPort: 8080
  type: ClusterIP
```

### Canary Deployment

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app-stable
spec:
  replicas: 9 # 90% traffic
  template:
    metadata:
      labels:
        app: web-app
        version: stable
    spec:
      containers:
        - name: web-app
          image: myregistry/web-app:v1.1.0
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app-canary
spec:
  replicas: 1 # 10% traffic
  template:
    metadata:
      labels:
        app: web-app
        version: canary
    spec:
      containers:
        - name: web-app
          image: myregistry/web-app:v1.2.0
---
# Service distributes traffic based on replica count
apiVersion: v1
kind: Service
metadata:
  name: web-app-service
spec:
  selector:
    app: web-app
  ports:
    - port: 80
      targetPort: 8080
```

## Pod Security and RBAC

### Pod Security Admission (Replaces PSP)

```yaml
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    # Pod Security Standards: restricted (most secure)
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted
```

### RBAC Configuration

```yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-service-account
  namespace: production
automountServiceAccountToken: false # Disable by default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: production
rules:
  - apiGroups: ['']
    resources: ['pods']
    verbs: ['get', 'watch', 'list']
  - apiGroups: ['apps']
    resources: ['deployments']
    verbs: ['get', 'watch', 'list']
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: production
subjects:
  - kind: ServiceAccount
    name: app-service-account
    namespace: production
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io
```

### Security Context

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: secure-app
spec:
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: app
          image: myregistry/app:latest
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir: {}
```

## Resource Management and Autoscaling

### Horizontal Pod Autoscaler

```yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: web-app-hpa
  namespace: production
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: web-app
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80
    - type: Pods
      pods:
        metric:
          name: requests-per-second
        target:
          type: AverageValue
          averageValue: '1000'
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:
        - type: Percent
          value: 10
          periodSeconds: 60
    scaleUp:
      stabilizationWindowSeconds: 60
      policies:
        - type: Percent
          value: 100
          periodSeconds: 60
        - type: Pods
          value: 4
          periodSeconds: 60
      selectPolicy: Max
```

### Resource Quotas and Limit Ranges

```yaml
apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-quota
  namespace: production
spec:
  hard:
    requests.cpu: '10'
    requests.memory: 20Gi
    limits.cpu: '20'
    limits.memory: 40Gi
    pods: '50'
    services: '20'
    persistentvolumeclaims: '10'
---
apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: production
spec:
  limits:
    - default:
        cpu: '500m'
        memory: '512Mi'
      defaultRequest:
        cpu: '100m'
        memory: '128Mi'
      max:
        cpu: '2'
        memory: '4Gi'
      min:
        cpu: '50m'
        memory: '64Mi'
      type: Container
```

## Ingress Configuration

### NGINX Ingress Controller

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-app-ingress
  namespace: production
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: 'true'
    nginx.ingress.kubernetes.io/rate-limit: '100'
    nginx.ingress.kubernetes.io/rate-limit-window: '1m'
    nginx.ingress.kubernetes.io/proxy-body-size: '50m'
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  tls:
    - hosts:
        - app.example.com
      secretName: app-tls-secret
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web-app-service
                port:
                  number: 80
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: api-service
                port:
                  number: 8080
```

### Ingress with Canary (NGINX)

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-app-canary-ingress
  annotations:
    nginx.ingress.kubernetes.io/canary: 'true'
    nginx.ingress.kubernetes.io/canary-weight: '10' # 10% traffic
spec:
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web-app-canary
                port:
                  number: 80
```

## Service Mesh (Istio)

### VirtualService and DestinationRule

```yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: web-app-vs
spec:
  hosts:
    - web-app
  http:
    - route:
        - destination:
            host: web-app
            subset: v1
          weight: 90
        - destination:
            host: web-app
            subset: v2
          weight: 10
      timeout: 5s
      retries:
        attempts: 3
        perTryTimeout: 2s
        retryOn: gateway-error,connect-failure,refused-stream
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: web-app-dr
spec:
  host: web-app
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        h2UpgradePolicy: DEFAULT
        http1MaxPendingRequests: 100
        http2MaxRequests: 1000
    outlierDetection:
      consecutive5xxErrors: 5
      interval: 30s
      baseEjectionTime: 30s
      maxEjectionPercent: 50
  subsets:
    - name: v1
      labels:
        version: v1
    - name: v2
      labels:
        version: v2
```

## Secrets and Config Maps

### Secrets Management

```yaml
apiVersion: v1
kind: Secret
metadata:
  name: app-secrets
  namespace: production
type: Opaque
stringData:
  database-url: 'postgresql://user:password@db:5432/app'
  api-key: 'sk-xxxxxxxxxxxxxxxx'
  jwt-secret: 'super-secret-jwt-key'
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app
spec:
  template:
    spec:
      containers:
        - name: app
          image: myregistry/app:latest
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: app-secrets
                  key: database-url
            - name: API_KEY
              valueFrom:
                secretKeyRef:
                  name: app-secrets
                  key: api-key
          # Mount secrets as files (more secure than env vars)
          volumeMounts:
            - name: secret-volume
              mountPath: /etc/secrets
              readOnly: true
      volumes:
        - name: secret-volume
          secret:
            secretName: app-secrets
```

### Config Maps

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
  namespace: production
data:
  APP_ENV: 'production'
  LOG_LEVEL: 'info'
  CACHE_TTL: '3600'
  # Configuration file
  app.conf: |
    [server]
    port = 8080
    workers = 4

    [database]
    pool_size = 10
    timeout = 30
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app
spec:
  template:
    spec:
      containers:
        - name: app
          image: myregistry/app:latest
          envFrom:
            - configMapRef:
                name: app-config
          volumeMounts:
            - name: config-volume
              mountPath: /etc/app
      volumes:
        - name: config-volume
          configMap:
            name: app-config
            items:
              - key: app.conf
                path: app.conf
```

## Stateful Sets for Databases

### PostgreSQL StatefulSet

```yaml
apiVersion: v1
kind: Service
metadata:
  name: postgres-headless
  namespace: production
spec:
  clusterIP: None
  selector:
    app: postgres
  ports:
    - port: 5432
      name: postgres
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: postgres
  namespace: production
spec:
  serviceName: postgres-headless
  replicas: 3
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 999
        fsGroup: 999
      containers:
        - name: postgres
          image: postgres:16-alpine
          ports:

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Omar-Obando](https://github.com/Omar-Obando)
- **Source:** [Omar-Obando/qwen-orchestrator](https://github.com/Omar-Obando/qwen-orchestrator)
- **License:** MIT
- **Homepage:** https://qwen.ai/qwencode

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-omar-obando-qwen-orchestrator-kubernetes-orchestration
- Seller: https://agentstack.voostack.com/s/omar-obando
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.