# k8s/base/managing AGENTS

Role:
- own management and operational Kubernetes base units
- model bootstrap, migration, backup, restore, maintenance, and admin workloads as declarative Kustomize bases
- keep operational workloads separate from long-running application serving workloads

Allowed:
- Job / CronJob base resources for operational tasks
- maintenance ServiceAccount / RBAC / ConfigMap / Secret reference wiring
- backup / restore / migration helper workload shapes
- admin-only service shapes when explicitly justified

Forbidden:
- long-running product application workloads
- environment-specific values that belong in `k8s/overlays/<env>`
- scripts becoming the primary source of YAML truth
- large heredoc-generated manifests as the default path
- embedding production secret values
- hiding environment differences in shell conditionals instead of overlays
- giant all-in-one jobs that mix unrelated concerns

Read first:
- `/docs/standards/infra/workload-selection.md`
- `/docs/standards/infra/db-and-migration.md`
- `/docs/standards/infra/flyway.md`
- `/docs/standards/infra/backup-restore.md`
- `/docs/standards/infra/operations-runbook-upgrade-rollback.md`
- `/docs/standards/infra/config-and-secrets.md`
- `/docs/standards/infra/security-hardening.md`
- `/docs/standards/infra/kustomize.md`

Examples:
- `/docs/examples/infra/flyway.md`
- `/docs/examples/infra/backup-restore.md`
- `/docs/examples/infra/operations-runbook-upgrade-rollback.md`
- `/docs/examples/infra/db-and-migration.md`
- `/docs/examples/infra/kustomize.md`
- `/docs/examples/infra/scripts.md`

Rules:
- management jobs are explicit operational units, not hidden app startup hooks
- migrations must stay separate from app startup
- backup and restore paths must be documented before risky stateful changes
- destructive operations require explicit opt-in and runbook backing
- operational workloads must still follow security, resource, secret, and namespace standards