1.9 KiB
1.9 KiB
k8s/base/managing AGENTS
Role:
- own management and operational Kubernetes base units
- model bootstrap, migration, backup, restore, maintenance, and admin workloads as declarative Kustomize bases
- keep operational workloads separate from long-running application serving workloads
Allowed:
- Job / CronJob base resources for operational tasks
- maintenance ServiceAccount / RBAC / ConfigMap / Secret reference wiring
- backup / restore / migration helper workload shapes
- admin-only service shapes when explicitly justified
Forbidden:
- long-running product application workloads
- environment-specific values that belong in
k8s/overlays/<env> - scripts becoming the primary source of YAML truth
- large heredoc-generated manifests as the default path
- embedding production secret values
- hiding environment differences in shell conditionals instead of overlays
- giant all-in-one jobs that mix unrelated concerns
Read first:
/docs/standards/infra/workload-selection.md/docs/standards/infra/db-and-migration.md/docs/standards/infra/flyway.md/docs/standards/infra/backup-restore.md/docs/standards/infra/operations-runbook-upgrade-rollback.md/docs/standards/infra/config-and-secrets.md/docs/standards/infra/security-hardening.md/docs/standards/infra/kustomize.md
Examples:
/docs/examples/infra/flyway.md/docs/examples/infra/backup-restore.md/docs/examples/infra/operations-runbook-upgrade-rollback.md/docs/examples/infra/db-and-migration.md/docs/examples/infra/kustomize.md/docs/examples/infra/scripts.md
Rules:
- management jobs are explicit operational units, not hidden app startup hooks
- migrations must stay separate from app startup
- backup and restore paths must be documented before risky stateful changes
- destructive operations require explicit opt-in and runbook backing
- operational workloads must still follow security, resource, secret, and namespace standards