Codex skills for Kubernetes
These skills keep Codex careful on a cluster: debugging starts with read-only kubectl describe, events and logs --previous, and anything that mutates a shared cluster waits for your approval. Manifests are checked with kubeconform and server-side dry runs, Helm and Kustomize changes are rendered and diffed, and Argo CD promotion happens through Git.
Start with these 3
- Kubernetes Debugging Root cause from events and exit codes, not restarts Codex investigates broken pods with read-only kubectl first: describe, events and logs from the previous container, then routes by status and exit code to the likely cause. It attaches ephemeral debug containers to distroless images only with permission, traces connectivity one hop at a time, fixes the source manifest instead of the live object, and reports the evidence behind the root cause.
- Kubernetes Manifests Deployments that survive rollouts and node drains Codex writes Deployments where each field has a job: startup probes instead of long initial delays, liveness that never checks the database, memory limits equal to requests, a preStop pause so endpoints drain before SIGTERM, and a PDB that lets node drains proceed one pod at a time. Manifests are checked with kubeconform and a server-side dry run before anything is applied.
- Kubernetes Autoscaling Right-size first, then scale on the real bottleneck Codex starts autoscaling work by fixing resource requests from observed usage, because HPA utilisation and node scaling both read requests. It then picks the signal per workload, CPU for compute-bound services, request rate or queue lag for the rest, writes explicit scale-up and scale-down behavior, checks that nodes and PDBs can follow, and proves it with a staging load test.
13 more Kubernetes skills
-
Kubernetes Security
Restricted pods, least RBAC, default-deny networks -
Google Kubernetes Engine
Autopilot clusters that upgrade without drama -
Kubernetes Observability
Cluster monitoring that scrapes, alerts and scales -
Helm Charts
Charts that fail on bad values, not in the cluster -
Argo CD GitOps
Promote by commit, roll back by revert -
Cron Scheduling
Scheduled jobs that run once, on time, visibly -
Kustomize Overlays
One base, thin overlays, rendered diffs for every env -
Deployment Strategies
Ship to 5% first, roll back in a minute -
Preview Environments
A live URL per PR, gone when the PR closes -
Service Mesh: Istio and Linkerd
Adopt a mesh for a reason, roll it out safely -
Twelve-Factor Apps
One build, any environment, kill it anytime -
Health Checks
Probes that heal instead of causing outages -
Production Debugging
Find the fault in live systems without adding a new one
General skills with Kubernetes guidance
Not built around Kubernetes, but they include steps or tools for it. Not part of the install-all command.
-
TLS Certificates
Certificates that renew themselves and never surprise you -
Secrets Management
No plaintext keys, rotation you have rehearsed -
Multi-Cloud Strategy
Pay for portability only where it buys something -
Log Forensics
Every conclusion backed by a log line -
API Gateway Patterns
A thin edge that never turns into a monolith -
Distributed Locks
Leases, fencing tokens, or no lock at all
Every Kubernetes skill in one command
Installs these 16 into ~/.agents/skills/. Add --project after -- to install into the current repository instead.
The installer is a 104-line POSIX shell script. It fetches the skills you name from codexskills.dev and unpacks each into its own folder in your skills directory. No sudo, no telemetry, and every skill page shows the full SKILL.md first. Read install.sh
curl -fsSL codexskills.dev/install.sh | sh -s -- kubernetes-debugging kubernetes-manifests kubernetes-autoscaling kubernetes-security gcp-gke kubernetes-observability helm-charts argocd-gitops cron-scheduling kustomize-overlays deployment-strategies preview-environments service-mesh-istio twelve-factor-apps health-checks production-debugging Kubernetes FAQ
Will Codex delete pods or restart deployments while debugging Kubernetes?
Not without asking. Kubernetes Debugging confirms the context and namespace first, works from describe, events and logs --previous, and asks before deleting pods, rollout restart or undo, scaling, kubectl debug or exec. It refuses kubectl delete pod --force on StatefulSet pods without explicit confirmation, because two copies could run against one volume.
How does Codex validate Kubernetes YAML before applying it?
Kubernetes Manifests validates offline with kubeconform -strict against a target Kubernetes version, then runs kubectl apply --dry-run=server and kubectl diff against the namespace. Helm Charts renders and diffs every chart change against a baseline, lints it strictly, unit tests it with helm-unittest and supports both Helm 3 and Helm 4.
Is there a Codex skill for Kubernetes security hardening?
Kubernetes Security audits workloads with a bundled audit_pods.py script that flags privileged pods, host mounts, root users and mutable image tags. It rolls out Pod Security Admission and other policies in warn or audit mode first, keeps a DNS egress rule in default-deny NetworkPolicies, and waits for your confirmation before removing RBAC on shared clusters.
How do I install all 16 Kubernetes skills at once?
Pass every name to the installer in one command: curl -fsSL https://codexskills.dev/install.sh | sh -s -- kubernetes-debugging kubernetes-manifests kubernetes-autoscaling kubernetes-security gcp-gke kubernetes-observability helm-charts argocd-gitops cron-scheduling kustomize-overlays deployment-strategies preview-environments service-mesh-istio twelve-factor-apps health-checks production-debugging. Add --project right after -- to put them in the current repository's .agents/skills/ so your team gets them too.
Which Kubernetes skill should I try first?
Kubernetes Debugging is the closest fit for most Kubernetes work. Mention it with $kubernetes-debugging in a prompt to load it on purpose; after that, Codex picks it up on its own whenever a task matches.