kubernetes-specialist

Define a Deployment manifest with containers specifying resources.requests and resources.limits for CPU and memory, plus livenessProbe and readinessProbe HTTP checks. Set securityContext with runAsNonRoot and readOnlyRootFilesystem, then apply with kubectl and verify using kubectl rollout status.

Run kubectl describe pod to inspect events and failure reasons, then use kubectl logs with the --previous flag to view output from the crashed container. Common causes include failed liveness probes, image pull errors, and exceeded memory limits.

ArgoCD provides a built-in web UI, AppProject-based multi-tenancy, and centralized architecture, while Flux uses distributed controllers with native ImagePolicy automation and Kubernetes RBAC. Both support Helm and automated sync with prune and self-heal.

Apply a default-deny NetworkPolicy selecting all pods for Ingress and Egress, then add explicit allow policies using podSelector and namespaceSelector rules for required ports. This enforces zero-trust segmentation between tiers like frontend, backend, and database.

Use ConfigMaps for non-sensitive settings like hostnames and feature flags, and Secrets for credentials, tokens, and TLS keys. Never store secrets in ConfigMaps or plain environment variables; mount them as files with restrictive permissions or use External Secrets Operator.

Compare kubectl top pods usage against configured requests, then deploy a VerticalPodAutoscaler in recommendation mode to get suggested values. Set requests near average usage with a small buffer, tune HPA stabilization windows, and use spot instances for fault-tolerant workloads.