Generate Production-Ready Kubernetes Manifests

Generates production-ready Kubernetes YAML manifests spanning deployments, services, ingress, configuration, secrets, autoscaling, and network security, following consistent principles: resource organization (environment-prefixed naming, comprehensive labels and annotations, namespace grouping, resource quotas and limits), security-first defaults (non-root containers via securityContext, least-privilege service accounts, network policies, pod security standards, secrets instead of hardcoded credentials), and reliability practices (resource requests and limits on every container, liveness/readiness/startup probes, horizontal pod autoscaling, and anti-affinity rules for high availability). A standard application Deployment manifest ties these together: a RollingUpdate strategy with maxSurge/maxUnavailable controls, pod anti-affinity for spreading replicas across nodes, a non-root securityContext, Prometheus scrape annotations, environment variables sourced from a Secret, resource requests and limits, liveness and readiness probes, a hardened container securityContext (no privilege escalation, read-only root filesystem, all Linux capabilities dropped), and emptyDir volumes for temp and cache storage.

Use it to scaffold or review a complete set of production Kubernetes manifests - deployments, services, ingress, config, secrets, HPA, resource quotas, and network policies - with security and reliability defaults already applied. It is not a substitute for cluster-level policy enforcement (pod security admission, OPA/Gatekeeper) or for validating manifests against a live cluster; the best-practices checklist itself calls for running kubectl --dry-run=client before applying.

Given an application's runtime needs, it outputs a set of manifests: a Service (ClusterIP or LoadBalancer, with cloud-provider annotations such as service.beta.kubernetes.io/aws-load-balancer-type: nlb), an Ingress with TLS, a ConfigMap for application and reverse-proxy settings, a Secret for sensitive values (base64-encoded, type: Opaque), a HorizontalPodAutoscaler (min/max replicas, CPU and memory utilization targets, separate scale-up and scale-down stabilization windows with percent-based policies), a ResourceQuota capping CPU, memory, PVCs, pods, secrets, configmaps, and services per namespace, and a NetworkPolicy restricting ingress to specific namespaces and pods and egress to specific destinations and ports.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: webapp-ingress
  namespace: production
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: letsencrypt-prod
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
  tls:
  - hosts:
    - webapp.example.com
    secretName: webapp-tls
  rules:
  - host: webapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: webapp-service
            port:
              number: 80

Manifests are designed to integrate with Prometheus via scrape annotations, cert-manager for automated TLS through a cluster issuer, the NGINX Ingress Controller, and AWS load balancers via provider-specific service annotations; the best-practices checklist also recommends a service mesh for advanced traffic management and pairs with kubectl for dry-run validation before applying.

Platform and DevOps engineers who need production-grade, security-hardened Kubernetes manifests fast, following a checklist covering manifest quality (explicit resource requests and limits, pinned image tags rather than :latest, multi-document YAML with --- separators), operational excellence (pod disruption budgets, init containers for setup tasks, graceful shutdown handling, backup and disaster-recovery planning), and security hardening (non-root users, read-only root filesystems, dropped Linux capabilities, pod security policies or standards, and regular container image vulnerability scanning).