# Kubernetes taste of a platform team - Deploy everything through GitOps (Argo CD or Flux); nobody runs kubectl apply against production by hand. Confidence: 0.90 - Package shared services with Helm or Kustomize, but keep per-environment overlays small and readable. Confidence: 0.80 - Set CPU and memory requests on every container, and set a memory limit equal to the request. Confidence: 0.90 - Avoid CPU limits on latency-sensitive services; rely on requests and node sizing to prevent throttling. Confidence: 0.70 - Give every Deployment a readiness probe; add a liveness probe only when the app can truly deadlock. Confidence: 0.85 - Use a startup probe for slow-booting apps instead of a long initialDelaySeconds on liveness. Confidence: 0.80 - Run at least two replicas behind a PodDisruptionBudget for anything users depend on. Confidence: 0.90 - Spread replicas across zones with topologySpreadConstraints. Confidence: 0.80 - Pin images by digest or an immutable version tag, never latest. Confidence: 0.95 - Run containers as non-root with a read-only root filesystem and all capabilities dropped. Confidence: 0.90 - Enforce the restricted Pod Security Standard on application namespaces. Confidence: 0.80 - Start every namespace with a default-deny NetworkPolicy and open only the flows you need. Confidence: 0.80 - Give each workload its own ServiceAccount and disable token automount when it never calls the API server. Confidence: 0.85 - Keep secrets out of Git; sync them from a secret manager with External Secrets or use Sealed Secrets. Confidence: 0.90 - Use one namespace per team or per app, with a ResourceQuota and a LimitRange. Confidence: 0.80 - Apply the standard app.kubernetes.io labels to every resource. Confidence: 0.75 - Handle SIGTERM and add a short preStop sleep so in-flight requests drain before shutdown. Confidence: 0.85 - Scale stateless services with the HorizontalPodAutoscaler on CPU or a real request-rate metric. Confidence: 0.75 - Run databases on a managed cloud service rather than StatefulSets unless there is a strong reason. Confidence: 0.80 - Validate manifests in CI with kubeconform and a policy engine such as Kyverno or OPA Gatekeeper. Confidence: 0.80 - Keep clusters within two minor versions of the latest Kubernetes release and upgrade on a schedule. Confidence: 0.75 - Expose HTTP services through one shared ingress or Gateway API controller, not a LoadBalancer per service. Confidence: 0.75
Rightsizes Kubernetes CPU and memory requests and limits from real usage (p50, p95 and max per container). Recommends requests at p95 plus headroom, memory limits above the peak and no CPU limits, and estimates the cores, GiB and money freed. Flags OOM kills, memory above the request, CPU throttling, missing requests or memory limits, overprovisioning and short data windows. Includes a stdlib Python rightsizer with --self-test.
Plans and audits backup retention (grandfather-father-son) policies. Simulates hourly, daily, weekly, monthly and yearly keep rules like restic or borg, lists the restore points you really keep and the gaps between them, and estimates storage and cost now and in 12 months. Flags missed RPO, short history, legal retention gaps, no offsite or immutable copy, stale restore tests and job overlap. Includes a stdlib Python planner with --self-test.
Plans and checks IPv4 subnet layouts for AWS, Azure, GCP or on-prem networks. Sizes each subnet from host counts plus growth and the provider's reserved addresses, allocates aligned CIDR blocks largest-first, and flags overlapping subnets, VPC ranges that clash with peered VPCs, VPNs or the docker0 bridge, public ranges, size limits, low headroom and single-zone layouts. Includes a stdlib Python planner with --self-test.
Reviews nginx.conf and site configs for security problems such as TLS 1.0/1.1, weak ciphers, missing HSTS and security headers, the add_header inheritance trap, alias off-by-slash path traversal, autoindex, unlimited body size, $uri in redirects, HTTP without an HTTPS redirect, open admin paths and logins without rate limits. Gives a fixed config. Includes a stdlib Python checker with --self-test.
