Generate a production-ready Kubernetes deployment
A repeatable workflow that turns a service description into manifests that pass admission policy and code review.
Intermediate45 minCOMMUNITY ANALYSISKubernetesKustomize
Prompt
Generate Kubernetes manifests for a stateless HTTP service named {name} on port {port}.
Include: Deployment, Service, HPA, PodDisruptionBudget, default-deny NetworkPolicy.
Requirements: resource requests/limits, readiness+liveness probes, runAsNonRoot, readOnlyRootFilesystem, seccompProfile RuntimeDefault, no service account token mount unless required.
Output a Kustomize base and overlays for dev and prod. Explain each securityContext field in a short table.Problem
Hand-written manifests drift between services and inherit whatever was wrong with the original.
Goal
A Kustomize base and overlays that pass `kubeconform -strict` and restricted Pod Security Admission.
Context
A cluster enforcing PSA restricted, NetworkPolicies required, images pulled from an internal registry.
Expected Output
Deployment, Service, HPA, PDB and NetworkPolicy YAML plus a table explaining each security field.
Steps
- State the cluster constraints in the prompt (PSA level, registry, ingress class)
- Ask for the manifest plan before the YAML
- Generate the base, review securityContext line by line
- Generate overlays; pin prod images to digests
- Run validation locally before opening a pull request
Validation
- `kubectl apply --dry-run=server`
- `kubeconform -strict`
- Admission policy check in audit mode
Security Considerations
- Reject any manifest that mounts a service account token without justification
- Digest-pinned images in prod overlays only, never `latest`
Lessons Learned
- Resource limits need profiling data; treat generated values as placeholders
- Ask for a per-field explanation — it makes review much faster
Related prompts