# k8s/base AGENTS

Role:
- own environment-neutral Kustomize base resources
- define reusable workload, namespace, service, storage, policy, and platform/plugin shapes
- keep environment-specific values out of base

Scope:
- `app/`: application-facing base units
- `managing/`: management and operational base units
- `plugins/`: platform/plugin base resources

Allowed:
- shared labels/selectors
- common workload shape
- common probe/resource shape
- common service/storage/policy shape
- unit composition through nested `kustomization.yaml`

Forbidden:
- environment-specific hostnames
- production-only replicas/resources
- environment-specific secret values
- direct references to a specific cluster context
- overlay-only patches masquerading as base manifests

Read first:
- `/docs/standards/infra/kustomize.md`
- `/docs/standards/infra/architecture-environments.md`
- `/docs/standards/infra/workload-selection.md`
- `/docs/standards/infra/config-and-secrets.md`
- `/docs/standards/infra/security-hardening.md`

Rules:
- base must be reusable by dev, staging, and prod overlays
- base may define default shape, but overlays own environment differences
- unit ownership should be visible in path names
- large fleets should stay navigable by role first, then domain/unit