Kubernetes Optimizer

Audit a Kubernetes workload/config, report what is unsafe, unreliable or expensive and why, agree a plan, then change it. Order: evidence, approval, edits. Cluster changes can cause outages; nothing is applied before approval.

Workflow

1. Scope (quick)

• Find the manifests/Helm/Kustomize and record: cluster version (1.37 current; 1.36/1.35 supported; 1.34 EOL), distribution, ingress/CNI/CSI, autoscaler, workload types, namespaces and environment.
• Run python <skill-dir>/scripts/audit.py <repo-root> -- static scan for floating images, missing probes/resources/securityContext, privileged/host access, deprecated APIs, missing PDB/NetworkPolicy/HPA, secrets in env and risky Services/Ingress, with file:line evidence. Use --json to post-process.
• Classify the pain: reliability (OOM/crash/restarts), latency/throughput, scheduling/capacity, security/compliance, cost, or upgrade risk. Ask which hurts if unclear.
• Read references/upgrades-tooling.md once: what can be measured here (kubectl, metrics-server, kube-state-metrics, scans, cost tools).

2. Audit

The script finds cheap leads; you find the rest by reading the manifests and the live cluster. Load only what applies:

Measure, never guess. Read the live objects (kubectl get/describe), metrics (CPU/memory throttling, OOMKills, restarts, pending pods), events and traces. A YAML review without cluster evidence is a hypothesis; a healthy pod at low load is not capacity proof.

Mark each finding Confirmed (kubectl/metrics/event/code evidence) or Suspected (needs measuring).

3. Report

Fill assets/report-template.md, save it as KUBERNETES_OPTIMIZATION_REPORT.md in the repo root, and show the user. Five-line summary, findings table by impact/effort/risk, then per-finding detail (evidence, why it hurts, fix, risk, rollout/rollback). Group near-duplicates.

4. Plan -- then stop for approval

Use plan mode: EnterPlanMode (load with ToolSearch if deferred), write the plan, present with ExitPlanMode; if unavailable show it in chat and wait for an explicit "go". Structure:

1. Quick wins -- pin images, set requests/limits, add readiness/startup probes, securityContext, PDB, NetworkPolicy, HPA, fix deprecated APIs. Low risk, manifest-only.
2. Structural -- right-size requests from metrics, split workloads, topology spread/anti-affinity, HPA/VPA strategy, ingress/TLS, RBAC least privilege, resource quotas, cost labels. Name each behavior change.
3. Heavy -- cluster upgrade, CNI/CSI/ingress replacement, autoscaler migration, multi-cluster/multi-tenant architecture. Separately approved with a staged rollout. Each step: files/cluster objects touched, expected effect, how to verify, how to roll back.

5. Fix

Only approved items, in small groups. After each: kubectl diff/server-side dry-run, policy/scan checks, rollout status, and the relevant metrics. A break must trace to one change. Do not mix a cluster upgrade with workload optimization. If a change alters availability (PDB/replicas), security posture, or network reachability, stop and ask.

6. Verify and wrap up

Re-check the same objects/metrics: restarts/OOMKills, pending pods, CPU throttling, p95/p99 latency, availability during rollout, HPA behavior, cost. State plainly what could not be measured. End with deferred items and one suggested next step.

Principles

• Requests are scheduling; limits are enforcement. Set requests from measured usage, not guesses.
• Probes must reflect readiness, not liveness theater. Startup protects slow boots; readiness removes traffic; liveness restarts only true hangs.
• Least privilege by default. Non-root, no privilege escalation, read-only rootfs, dropped capabilities, scoped RBAC.
• Availability is a budget. PDB, replicas, topology spread and graceful termination are part of correctness.
• Network is deny-by-default where possible. NetworkPolicy + explicit ingress/egress.
• Autoscaling needs signals. HPA on meaningful metrics, requests set, and a node autoscaler that can react.
• Upgrade one minor at a time. Check deprecated APIs and add-on compatibility before the control plane moves.
• Cost is a workload property. Requests, replicas, storage class and idle capacity have owners.