Kubernetes Skill for Claude Code and Codex: KubeShark

Fixes Hallucinations.

LLMs hallucinate a lot when it comes to Kubernetes. They omit security contexts, generate deprecated APIs, use wildcard RBAC, forget resource limits, and produce probes that cause cascading failures. This skill fixes it. It includes best practices for Kubernetes -- good, bad, and neutral examples so the AI avoids common mistakes. Using KubeShark, the AI keeps proven practices in mind, eliminates hallucinations, and defaults to secure, reliable, production-ready manifests.

Very Token-Efficient.

Most Kubernetes skills dump huge walls of text onto the agent and burn expensive tokens -- with no upside. LLMs don't need the entire Kubernetes docs again. KubeShark was aggressively de-duplicated and optimized for maximum quality per token.

Based on Official Best Practices.

KubeShark is primarily based on the official Kubernetes documentation, the NSA/CISA Kubernetes Hardening Guide, OWASP Kubernetes Top 10, Pod Security Standards, and the CIS Kubernetes Benchmark. When guidance conflicts, it prioritizes official Kubernetes documentation.

Quick Start · Why KubeShark · Token Strategy · What's Included · How It Works · Philosophy

2 min Quickstart

Option 1: Clone

macOS / Linux:

git clone https://github.com/LukasNiessen/kubernetes-skill.git ~/.claude/skills/kubernetes-skill

Windows (Powershell):

git clone https://github.com/LukasNiessen/kubernetes-skill.git "$env:USERPROFILE\.claude\skills\kubernetes-skill"

Windows (Command Prompt):

git clone https://github.com/LukasNiessen/kubernetes-skill.git "%USERPROFILE%\.claude\skills\kubernetes-skill"

That's it. Claude Code auto-discovers skills in ~/.claude/skills/ -- no restart needed.

Option 2: Marketplace

Claude Code has a built-in plugin system with marketplace support. Instead of cloning manually, you can add KubeShark's marketplace and install directly from the CLI:

/plugin marketplace add LukasNiessen/kubernetes-skill
/plugin install kubernetes-skill

Or use the interactive plugin manager -- run /plugin, switch to the Discover tab, and install from there. The marketplace reads the .claude-plugin/marketplace.json in this repo to register KubeShark as an installable plugin.

Option 3: Codex

Codex has no global skill system -- setup is per-project. Clone KubeShark into your repo and reference it from your AGENTS.md:

# Clone into your project root
git clone https://github.com/LukasNiessen/kubernetes-skill.git .kubernetes-skill

Then add to your AGENTS.md (or create one in the repo root):

## Kubernetes

When working with Kubernetes manifests, Helm charts, or Kustomize overlays, follow the workflow in `.kubernetes-skill/SKILL.md`.
Load references from `.kubernetes-skill/references/` as needed.

That's it!

Done. Now ask Claude Code / Codex any Kubernetes question. KubeShark responses follow the 7-step failure-mode workflow and include an output contract with assumptions, tradeoffs, and rollback notes.

Invoke explicitly:

/kubernetes-skill Create a production-ready Deployment with an Ingress and autoscaling

/kubernetes-skill Review my Deployment for security issues and add proper RBAC, NetworkPolicies, and resource limits

Or just ask naturally -- KubeShark activates automatically for any Kubernetes task:

Review my deployment.yaml for security issues

Create a Helm chart for a PostgreSQL StatefulSet with backup CronJobs

Why KubeShark

Overview

Why Failure-Mode-First Matters for Kubernetes

The key insight is architectural. A static reference manual gives Claude information but never tells it how to think about a problem. There's no diagnosis step, no risk assessment, and no structured output -- Claude reads the reference and generates whatever it thinks fits.

KubeShark takes the opposite approach. The core SKILL.md is an 85-line operational workflow that costs ~650 tokens on activation. It forces Claude through a diagnostic sequence: capture context -> identify failure modes -> load only the relevant references -> propose fixes with explicit risk controls -> validate -> deliver a structured output contract.

This matters for Kubernetes specifically because:

1. Silent failures are common. A Service with the wrong selector deploys successfully but routes to nothing. A NetworkPolicy with a mistyped label silently does nothing. Unlike Terraform, Kubernetes accepts most manifests without error -- failures surface at runtime.

2. Multi-dimensional risk. Kubernetes operates across security, networking, scheduling, storage, and application lifecycle simultaneously. An LLM must reason about all these dimensions for every resource.

3. Training data pollution. Kubernetes has had aggressive API deprecation. The LLM training corpus contains vast amounts of pre-1.22 YAML using removed APIs. Without diagnosis, the LLM confidently generates deprecated configurations.

Token Strategy

• Keep SKILL.md procedural and compact
• Keep references focused on failure-prone decisions
• Exclude broad tutorial material with low safety impact
• Add depth only when measured quality would otherwise drop

What's Included

• A focused SKILL.md execution flow
• Failure-mode-first guidance to prevent common Kubernetes hallucinations
• Core failure-mode references: insecure workload defaults, resource starvation, network exposure, privilege sprawl, fragile rollouts, API drift
• Workload pattern guides for Deployments, StatefulSets, Jobs, DaemonSets
• Cross-cutting concern references: security hardening, observability, multi-tenancy, storage
• Helm and Kustomize best practices
• Validation and policy engine integration (Kyverno, OPA/Gatekeeper, kubeconform)
• Good/bad example banks with LLM mistake checklists
• Do/Don't pattern checklist

Repository Layout

Here is an overview of the repository layout.

How It Works

The skill runs as a failure-mode workflow whenever Claude Code handles Kubernetes tasks:

1. Capture execution context - Cluster version, distribution, namespace, environment, workload type, deployment method, policies
2. Diagnose likely failure mode(s) - Insecure workload defaults, resource starvation, network exposure, privilege sprawl, fragile rollouts, API drift
3. Load only relevant references - Pull targeted guidance for the failure mode(s) in scope
4. Propose fix path with controls - Include risk notes, runtime behavior, tests, and rollback expectations
5. Generate implementation artifacts - YAML manifests, Helm charts, Kustomize overlays, RBAC, policies
6. Validate before finalize - Dry-run, schema validation, cross-resource consistency, policy scan
7. Deliver complete output - Assumptions, remediation choices, tradeoffs, validation plan, recovery notes

Scope

• Kubernetes manifest design, review, and refactoring
• Helm chart and Kustomize overlay creation
• RBAC, NetworkPolicy, and security hardening
• Workload reliability: probes, resources, rollout strategies
• Policy engine integration (Kyverno, OPA/Gatekeeper)
• CI validation pipelines for Kubernetes

FAQ

Q: Does this work with all Kubernetes distributions?

Yes. KubeShark supports vanilla Kubernetes, EKS, GKE, AKS, k3s, and other distributions. The workflow captures cluster version and distribution first and adapts guidance accordingly.

Q: Will this slow down my AI interactions?

No. The skill is designed for low token overhead. Only relevant references are loaded for a given failure mode.

Q: Can I use this outside Claude Code?

Yes. The references are plain Markdown and can be used from any workflow or AI assistant, including Codex. The trigger behavior in SKILL.md is optimized for skill-enabled environments.

Q: What Kubernetes versions are supported?

KubeShark targets Kubernetes 1.25+ as the baseline (all pre-1.25 deprecated APIs are flagged). Guidance is version-aware and the workflow captures cluster version in Step 1.

Q: Does this cover Helm and Kustomize?

Yes. Dedicated reference files cover Helm chart patterns and Kustomize overlay patterns, including common LLM mistakes in both tools.

Contributing

We highly appreciate contributions. See CONTRIBUTING.md and use the PR template for failure-mode and validation details.

Community

Maintainers

• LukasNiessen - Creator and main maintainer

• janMagnusHeimann - Main maintainer

• TristanKruse - Main maintainer

Contributors

Questions

Found a bug? Want to discuss features?

• Submit an issue on GitHub
• Join GitHub Discussions

If KubeShark helps your project, please consider:

• Starring the repository
• Suggesting new features
• Contributing code or documentation

Star History

License

This project is under the MIT license.

Go Back to Top

Other

Version: v1.0.0

GitHub Pages: https://lukasniessen.github.io/kubernetes-skill/