# k8s AGENTS

Role:
- own Kubernetes/K3s source-of-truth manifests and Kustomize composition
- keep base resources, environment overlays, helper scripts, and Vault Secrets Operator assets separate
- make render / validate / diff / apply possible from Git without relying on live cluster state

Scope:
- `base/`: environment-neutral bases
- `overlays/<env>/`: environment-specific composition
- `scripts/`: helper automation
- `vso/`: Vault Secrets Operator assets

Read first:
- `/docs/standards/infra/architecture-environments.md`
- `/docs/standards/infra/kustomize.md`
- `/docs/standards/infra/k3s-specific.md`
- `/docs/standards/infra/operations-runbook-upgrade-rollback.md`

Rules:
- prefer `kubectl kustomize`, `kubectl diff -k`, and `kubectl apply -k`
- do not use server-local manifests as source of truth
- do not place environment differences in `base/`
- do not place base resource definitions directly in overlays unless the resource is environment-only by design
- do not commit production secret values
- keep scripts as helpers; manifests remain declarative source