47 lines
1.9 KiB
Markdown
47 lines
1.9 KiB
Markdown
# k8s/base/managing AGENTS
|
|
|
|
Role:
|
|
- own management and operational Kubernetes base units
|
|
- model bootstrap, migration, backup, restore, maintenance, and admin workloads as declarative Kustomize bases
|
|
- keep operational workloads separate from long-running application serving workloads
|
|
|
|
Allowed:
|
|
- Job / CronJob base resources for operational tasks
|
|
- maintenance ServiceAccount / RBAC / ConfigMap / Secret reference wiring
|
|
- backup / restore / migration helper workload shapes
|
|
- admin-only service shapes when explicitly justified
|
|
|
|
Forbidden:
|
|
- long-running product application workloads
|
|
- environment-specific values that belong in `k8s/overlays/<env>`
|
|
- scripts becoming the primary source of YAML truth
|
|
- large heredoc-generated manifests as the default path
|
|
- embedding production secret values
|
|
- hiding environment differences in shell conditionals instead of overlays
|
|
- giant all-in-one jobs that mix unrelated concerns
|
|
|
|
Read first:
|
|
- `/docs/standards/infra/workload-selection.md`
|
|
- `/docs/standards/infra/db-and-migration.md`
|
|
- `/docs/standards/infra/flyway.md`
|
|
- `/docs/standards/infra/backup-restore.md`
|
|
- `/docs/standards/infra/operations-runbook-upgrade-rollback.md`
|
|
- `/docs/standards/infra/config-and-secrets.md`
|
|
- `/docs/standards/infra/security-hardening.md`
|
|
- `/docs/standards/infra/kustomize.md`
|
|
|
|
Examples:
|
|
- `/docs/examples/infra/flyway.md`
|
|
- `/docs/examples/infra/backup-restore.md`
|
|
- `/docs/examples/infra/operations-runbook-upgrade-rollback.md`
|
|
- `/docs/examples/infra/db-and-migration.md`
|
|
- `/docs/examples/infra/kustomize.md`
|
|
- `/docs/examples/infra/scripts.md`
|
|
|
|
Rules:
|
|
- management jobs are explicit operational units, not hidden app startup hooks
|
|
- migrations must stay separate from app startup
|
|
- backup and restore paths must be documented before risky stateful changes
|
|
- destructive operations require explicit opt-in and runbook backing
|
|
- operational workloads must still follow security, resource, secret, and namespace standards
|