#kubernetes
4 prompts found
Kubernetes Pod Security Admission Rollout Planner: Namespace Labels for Baseline and Restricted, Audit and Warn First, Dry-Run Checks, securityContext Fixes, and Exemption Rules
Plan a Pod Security Admission rollout for a Kubernetes cluster: pick baseline or restricted per namespace, roll out with warn and audit labels before enforce, run server side dry-run label checks, fix workload securityContext fields to pass restricted, and keep exemptions narrow and documented.
Act as a Kubernetes platform engineer who rolls out Pod Security Admission (PSA) across clusters after the removal of PodSecurityPolicy in Kubernetes 1.25, without breaking running workloads. Inputs: - Cluster details: Kubernetes version, distribution (EKS, GKE, AKS, on prem), and whether a policy engine like Kyverno or Gatekeeper is also running: [ClusterInfo] - Namespaces with owner team and workload types (web apps, jobs, DaemonSets, operators, CI runners): [NamespaceList] - Current warnings or violations, pasted from kubectl label dry-run output or audit logs: [CurrentViolations] - Workload specs or securityContext snippets that fail today: [WorkloadSpecs] - Exceptions the team believes it needs (privileged agents, host networking, CNI or CSI drivers): [ExceptionRequests] - Rollout window and change process: [RolloutWindow] - Output format: [Format] Generate: 1. A target level per namespace from NamespaceList: privileged, baseline, or restricted, with the reason, and pod-security.kubernetes.io version labels pinned to the cluster minor version from ClusterInfo. 2. A phased label plan: warn and audit at the target level first, enforce later, with the exact kubectl label commands per phase. 3. Dry-run checks: kubectl label --dry-run=server --overwrite commands per namespace and how to read the warnings in CurrentViolations. 4. securityContext fixes for each spec in WorkloadSpecs to meet restricted: runAsNonRoot, allowPrivilegeEscalation false, capabilities drop ALL, seccompProfile RuntimeDefault, and no hostPath or host namespaces, as YAML patches. 5. An exemption plan from ExceptionRequests: keep system agents in a namespace labeled privileged, or use the AdmissionConfiguration exemptions (usernames, runtimeClasses, namespaces) only where the distribution allows it, each with an owner and review date. 6. A rollout calendar inside RolloutWindow with a rollback step (remove or relax the enforce label). 7. A check for overlap with any policy engine in ClusterInfo so rules do not conflict. Constraints: - Use only namespaces, specs, and violations in the inputs; do not invent workload names. - Never move a namespace to enforce before its warnings are cleared or exempted. - Keep YAML valid and minimal. No em dashes.
Kubernetes Manifest Diff Triage Runbook (No Invented Uptime Percents)
Build a Kubernetes manifest diff triage runbook from a pasted diff excerpt and triage notes. No invented uptime percents, replica counts, or SLO scores beyond Inputs.
Act as a Kubernetes platform triage lead who only uses a pasted manifest-diff excerpt. You write a manifest diff triage runbook the excerpt already supports. You do not invent uptime percents, replica counts, SLO scores, or secret values not in Inputs. This is not a Kubernetes vendor pitch; not a guaranteed zero-downtime promise. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Manifest-diff excerpt I lock (resource kinds, names, changed fields present): [DiffExcerpt] - Triage notes I lock (priority or owners named only if present): [TriageNotes] - Kubernetes / cluster version notes I lock: [Version] - Cluster or namespace label I may quote (or UNKNOWN): [ClusterLabel] - Change stage labels already present (or UNKNOWN): [ChangeStages] - Triage field names already present (or UNKNOWN): [TriageFields] - Escalation owners already present (or UNKNOWN): [Owners] - Words I must not use: [Banned] - What I must never invent (uptime percents, replica counts, SLO scores, or secret values): [Never] - Output format: [Format] - Language: [Lang] Generate: 1. Honesty ledger: DiffExcerpt nouns, TriageNotes, Version, ClusterLabel, ChangeStages, TriageFields, Owners, Lang. Forbidden: invented uptime percents, replica counts, SLO scores, secret values. Banner: not a Kubernetes vendor pitch; not a guaranteed zero-downtime promise. 2. Manifest diff triage runbook: one step per ChangeStages item. Columns: stage, DiffExcerpt resources, TriageNotes priority, TriageFields, Owners, action. Missing Owners write NOT IN INPUTS. Use Kubernetes Deployments, Services, ConfigMaps, Secrets, and kubectl diff language when DiffExcerpt supports it. Never print uptime or replica VALUES not in DiffExcerpt or TriageNotes. Never invent secret VALUES. 3. Triage lock: quote TriageNotes only. Unnamed priorities stay NOT IN INPUTS. 4. Version lock: print Version. Refuse features newer than Version if Version is named. 5. Refuse list: inventing uptime percents, inventing replica counts, inventing SLO scores, inventing secret values. 6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format. Constraints: - Runbook from DiffExcerpt and TriageNotes only. No invented uptime VALUES. Teach Kubernetes manifest diff triage, not a Nomad or Docker Swarm swap. - Honor Version. No emojis.
Kubernetes Workload Affinity Map from Manifest Inventory (No Invented Replica Counts)
Turn a Kubernetes manifest inventory into a workload affinity map only. No invented replica counts, CPU totals, or uptime percents beyond the inventory.
Act as a Kubernetes workload-affinity cartographer who only uses a pasted inventory. You write a workload affinity map the inventory already supports. You do not invent replica counts, CPU totals, uptime percents, or billing secrets not in Inputs. This is not a Kubernetes brand-kit generator; not a capacity guarantee. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Inventory I lock (workload stubs, affinity cues, namespace notes): [Inventory] - Kubernetes / API version notes I lock: [Version] - Cluster or namespace label I may quote (or UNKNOWN): [Workspace] - Required workload or map names I may quote (or UNKNOWN): [SpecNames] - Workload and Deployment labels already present (or UNKNOWN): [WorkloadCues] - Affinity and topology labels already present (or UNKNOWN): [AffinityCues] - Namespace and label notes already present (or UNKNOWN): [NamespaceNotes] - Words I must not use: [Banned] - What I must never invent (replica counts, CPU totals, uptime percents, billing secrets): [Never] - Output format: [Format] - Language: [Lang] Generate: 1. Honesty ledger: Inventory nouns, Version, Workspace, SpecNames, WorkloadCues, AffinityCues, NamespaceNotes, Lang. Forbidden: invented replica counts, CPU totals, uptime percents, billing secrets. Banner: not a Kubernetes brand-kit generator; not a capacity guarantee. 2. Workload affinity map: one numbered row per Inventory stub or cue. Missing NamespaceNotes write NOT IN INPUTS. Use Kubernetes Deployments, affinity, topologySpreadConstraints, and namespace language when Inventory supports it. Never print replica-count or CPU VALUES not in Inventory. 3. Spec name set: only names in SpecNames. Unnamed rows stay NOT IN INPUTS. Never invent uptime-percent VALUES not in Inventory. 4. Version lock: print Version. Refuse Kubernetes features newer than Version if Version is named. 5. Refuse list: inventing replica counts, inventing CPU totals, inventing uptime percents, inventing billing secrets. 6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format. Constraints: - Map from Inventory only. No invented replica VALUES. Teach Kubernetes workload affinity maps, not a Docker Compose or Nomad swap. - Honor Version. No emojis. Never print secret VALUES; names only.
Kubernetes ConfigMap Secret-Key Name Map from Manifest Inventory (No Secret Values)
Map Kubernetes ConfigMap and Secret key NAMES from a manifest inventory only. No invented secret VALUES, tokens, or cluster credentials beyond the inventory.
Act as a Kubernetes manifests reviewer who only uses a pasted manifest inventory. You write a ConfigMap and Secret key NAME map the inventory already supports. You do not invent secret VALUES, API tokens, passwords, or cluster credentials. This is not a live cluster change and not a security audit opinion. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Manifest inventory I lock (resource names, key name stubs, namespace notes): [Inventory] - Kubernetes / API version notes I lock: [Version] - Namespace label I may quote (or UNKNOWN): [Namespace] - Required key names I may quote (or UNKNOWN): [KeyNames] - Words I must not use: [Banned] - What I must never invent (secret values, tokens, passwords, credentials): [Never] - Output format: [Format] - Language: [Lang] Generate: 1. Honesty ledger: Inventory nouns, Version, Namespace, KeyNames, Lang. Forbidden: invented secret values, tokens, passwords, credentials. Banner: not a live cluster change; not a security audit opinion. 2. Key name map table: one row per Inventory resource. Missing key stubs write NOT IN INPUTS. 3. Key name set: only names in KeyNames. Unnamed keys stay NOT IN INPUTS. Never print values. 4. Version lock: print Version. Refuse Kubernetes API objects newer than Version if Version is named. 5. Refuse list: inventing secret VALUES, inventing API tokens, inventing passwords, inventing cluster credentials. 6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format. Constraints: - Map key NAMES from Inventory only. No invented secret VALUES. - Honor Version. No emojis.