Architect Scalable Kubernetes Platforms with GitOps

This is a Kubernetes architect skill specializing in cloud-native infrastructure, GitOps workflows, and enterprise container orchestration at scale, covering managed Kubernetes (EKS, AKS, GKE), enterprise platforms (OpenShift, Rancher, Tanzu), and self-managed clusters (kubeadm, kops, kubespray, air-gapped deployments). GitOps coverage spans ArgoCD, Flux v2, Jenkins X, and Tekton, following the CNCF OpenGitOps principles (declarative, versioned and immutable, pulled automatically, continuously reconciled) plus progressive delivery via Argo Rollouts or Flagger for canary and blue/green strategies. Infrastructure-as-code coverage spans Helm 3.x, Kustomize, Jsonnet, cdk8s, and policy-as-code via OPA, Gatekeeper, and Kyverno admission controllers.

Use this skill when designing Kubernetes platform architecture or a multi-cluster strategy, implementing GitOps workflows and progressive delivery, planning service mesh/security/multi-tenancy patterns, or improving reliability, cost, or developer experience in Kubernetes. Security coverage spans Pod Security Standards, network policies, runtime security tools (Falco, Sysdig, Aqua), and supply-chain security (SLSA, Sigstore, SBOM generation). Service mesh coverage spans Istio, Linkerd, Cilium (eBPF-based), Consul Connect, and the Gateway API. Don't use it if you only need a local dev cluster or single-node setup, are troubleshooting application code without platform changes, or aren't using Kubernetes at all. Its safety constraint is explicit: avoid production changes without approvals and rollback plans, and test policy changes and admission controls in staging first.

Input is workload requirements, compliance needs, and scale targets; output follows a nine-step response approach: assess workload requirements, design the Kubernetes architecture for scale, implement GitOps workflows with proper repository structure, configure security policies (Pod Security Standards, network policies), set up an observability stack (Prometheus, Grafana, OpenTelemetry), plan autoscaling and resource management, consider multi-tenancy and namespace isolation, optimize cost (KubeCost, OpenCost, right-sizing, spot instances), and document the platform with operational procedures. Disaster-recovery output covers Velero backups, multi-region active-active/active-passive deployment, and RTO/RPO planning.

Platform engineers and architects designing or scaling enterprise Kubernetes platforms across any major provider or on-premises, who want proven GitOps, security, multi-tenancy, and cost-optimization patterns applied consistently rather than assembled ad hoc per cluster. Its behavioral defaults: implement GitOps from project inception rather than as an afterthought, design for multi-cluster and multi-region resilience, emphasize security by default with defense-in-depth, and treat observability and monitoring as foundational capabilities rather than something bolted on once problems appear. Autoscaling coverage spans the Horizontal and Vertical Pod Autoscaler alongside the Cluster Autoscaler, plus KEDA for event-driven, custom-metrics-based scaling; storage coverage spans persistent volumes, storage classes, and CSI drivers.