Kubernetes Cluster and Workload Operations

Use kubectl, helm, kustomize, kubeconform, and stern for Kubernetes cluster inspection, manifest authoring, Helm releases, and log debugging. docker manages container runtimes and infra-as-code provisions managed cloud clusters.

The workstation installs none of these tools globally: declare the ones the project uses, including k3d for local clusters, in its mise.toml with mise use --pin <tool> per mise.

Confirm user authority for cluster mutations and spending, reusing existing authorization. Pin --context and --namespace (or Helm's --kube-context) after resolving the intended cluster.

Workflow

1. Verify active context and namespace: inspect the current cluster context before running any command; never assume terminal defaults point to dev.

   kubectl config get-contexts
   kubectl --context <context> cluster-info

2. Lint and validate manifests: validate schemas against the target cluster's version (kubeconform defaults to master schemas) and scan for misconfigurations with trivy and the project's trivy.yaml before applying manifests.

   kubeconform -strict -summary -kubernetes-version <cluster-version> <file-or-directory>
   trivy --config trivy.yaml config <file-or-directory>
   kustomize build <kustomization-dir> | kubeconform -strict -summary -kubernetes-version <cluster-version> -

3. Use a local cluster only when needed: read k3d before creating or deleting one; manifest checks often answer the question without it.

4. Deploy declaratively: apply configurations using Helm or Kustomize; preview changes before mutating cluster state.

   helm upgrade --install <release-name> <chart-path> --kube-context <context> --namespace <namespace> --dry-run=server --hide-secret
   kubectl --context <context> --namespace <namespace> diff -k <kustomization-dir>

   A diff exit status of 1 means differences; higher values are errors. Review the preview, then apply within the authorized scope; with Helm 4 add --rollback-on-failure --timeout <duration>, which replaces the deprecated --atomic (as --force-replace replaces --force). kubectl diff masks Secret data unless --show-secrets is passed, but ConfigMaps and rendered chart values are not masked; exclude sensitive values from captured output.

5. Inspect workloads and bounded logs: narrow to the relevant workload and time window. Use finite log reads for agents; reserve streaming stern for an explicitly interactive investigation. The line limit applies per pod/container, so keep the pod query narrow.

   stern <pod-query> --context <context> -n <namespace> --since 15m --tail 50 --no-follow
   kubectl --context <context> get pods,events -n <namespace>

Gotchas

• Pin the context explicitly: omitted context flags use mutable kubeconfig defaults. Pass the selected context on each call; change the persistent current context only when that change is requested.
• Keep Secret payloads out of logs: avoid running unbounded kubectl get secret -o yaml; inspect metadata and key names (kubectl describe secret <name> shows sizes, not values) without printing raw base64 payloads to terminal logs.

Task guides

• k3d: Create, budget, and tear down disposable local k3d clusters for runtime tests.

Documentation

• Kubernetes Documentation · Helm Documentation
• Stern Log Tailer · kubeconform
• Releases: Kubernetes Releases · Helm
• Companion skills: docker (container runtimes), infra-as-code (provisioning).