Skills deploying-cloud-k8s
📦
deploying-cloud-k8s
Content revision r2 High Risk 🌐 Network access📁 Filesystem access🔑 Env variables⚙️ External commands
Deploy Applications to Cloud Kubernetes
Production Kubernetes deployments often fail because images, variables, pipelines, and clusters use incompatible settings. This skill provides practical deployment, GitOps, security, observability, and troubleshooting guidance.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "deploying-cloud-k8s" from https://skillstore.io/skills/asmayaseen-deploying-cloud-k8s.md and its manifest at https://skillstore.io/api/skills/asmayaseen-deploying-cloud-k8s/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "deploying-cloud-k8s". The pod reports ImagePullBackOff after a new release.
Expected outcome:
- First compare the deployed image tag with the registry tag.
- Then verify registry credentials and the image repository path.
- Finally inspect events for architecture or manifest compatibility errors.
Using "deploying-cloud-k8s". Plan a Next.js deployment with separate browser and server configuration.
Expected outcome:
- Classify public browser variables as image build inputs.
- Keep database and authentication values in managed runtime secrets.
- Validate redirect URLs and internal service names after deployment.
Using "deploying-cloud-k8s". Review a production workload for resilience.
Expected outcome:
- Set realistic resource requests before configuring autoscaling.
- Add startup, readiness, and liveness probes with distinct purposes.
- Use multiple replicas and a disruption budget for planned maintenance.
Security Audit
High Riskv10 • 7/23/2026 Open versioned report
Most static detections are false positives caused by Markdown code formatting, placeholders, or standard Kubernetes configuration. Confirmed risks involve an unpinned remote manifest, command-line database secrets, and predictable temporary files. Additional concerns include mutable CI actions, disabled image provenance, and broad access to Kubernetes Secrets.
3
Files scanned
817
Lines analyzed
4
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Overbroad Kubernetes Secret RBAC
The sample Role grants get and list access to every Secret in the namespace. A compromised application could enumerate unrelated credentials.
The Role explicitly includes secrets with get and list verbs and no resourceNames restriction. This directly expands credential exposure.
Medium
Mutable GitHub Actions Dependencies
CI examples reference actions by mutable major tags. A moved or compromised tag could execute changed code with workflow credentials.
Each uses entry ends in a major-version tag instead of an immutable commit SHA. This is a recognized CI supply-chain risk.
Medium
Container Image Provenance Disabled
The guidance repeatedly disables Buildx provenance. This removes attestations that can support image origin and build verification.
The setting is explicitly recommended and added to the deployment checklist. Its documented purpose confirms intentional attestation removal.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Database connection strings
--set "secrets.databaseUrl=${{ secrets.DATABASE_URL }}" \
The workflow expands DATABASE_URL into a Helm command argument. Secret values can become visible to process inspection, shell tracing, or insufficiently masked CI logs.
Medium
Temp directory access
cat > /tmp/overrides.yaml << EOF
The example writes to a predictable shared temporary path without secure creation or cleanup. Symlink attacks or stale files could redirect or alter deployment input.
Medium
Temp directory access
helm upgrade --install app ./chart --values /tmp/overrides.yaml
Helm consumes a predictable file from the shared temporary directory without ownership or permission checks. Another local process could replace the deployment input.
Low
Hardcoded URL
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/insta
The command applies a remote Argo CD manifest from the mutable stable branch directly to the cluster. A compromised or changed upstream file could alter cluster resources.
Risk Factors
🌐 Network access (17)
references/production-patterns.md:9 references/production-patterns.md:26 references/production-patterns.md:30 references/production-patterns.md:51 references/production-patterns.md:54 references/production-patterns.md:108 references/production-patterns.md:130 SKILL.md:26 SKILL.md:29 SKILL.md:46 SKILL.md:103 SKILL.md:104 SKILL.md:190 SKILL.md:214 SKILL.md:273 SKILL.md:276 SKILL.md:208
📁 Filesystem access (3)
🔑 Env variables (6)
⚙️ External commands (50)
SKILL.md:13 SKILL.md:16 SKILL.md:22 SKILL.md:24-31 SKILL.md:31-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-45 SKILL.md:45-46 SKILL.md:46 SKILL.md:47-53 SKILL.md:53-56 SKILL.md:56-60 SKILL.md:60-66 SKILL.md:66-68 SKILL.md:68-74 SKILL.md:74-94 SKILL.md:94-98 SKILL.md:98-105 SKILL.md:105-109 SKILL.md:109-116 SKILL.md:116-122 SKILL.md:122-138 SKILL.md:138-142 SKILL.md:142-147 SKILL.md:147-163 SKILL.md:163-167 SKILL.md:167-173 SKILL.md:173-177 SKILL.md:177-179 SKILL.md:179-184 SKILL.md:184-193 SKILL.md:193-197 SKILL.md:197-200 SKILL.md:200-206 SKILL.md:206-210 SKILL.md:210-213 SKILL.md:213-216 SKILL.md:216-225 SKILL.md:225-226 SKILL.md:226-230 SKILL.md:230-231 SKILL.md:231-235 SKILL.md:235-243 SKILL.md:243-252 SKILL.md:252-258 SKILL.md:258-259 SKILL.md:259-261 SKILL.md:261-265 SKILL.md:265-282
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/asmayaseen-deploying-cloud-k8s/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/asmayaseen-deploying-cloud-k8s?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/asmayaseen-deploying-cloud-k8s?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/asmayaseen-deploying-cloud-k8s/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/asmayaseen-deploying-cloud-k8s.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
Asmayaseen. (2026). deploying-cloud-k8s security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/asmayaseen-deploying-cloud-k8s/audits/10BibTeX citation
@techreport{asmayaseen-asmayaseen-deploying-cloud-k8s-2026,
author = {Asmayaseen},
title = {deploying-cloud-k8s security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/asmayaseen-deploying-cloud-k8s/audits/10},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "deploying-cloud-k8s security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
- name: "Asmayaseen"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/asmayaseen-deploying-cloud-k8s/audits/10"
identifiers:
- type: other
value: "skillstore:asmayaseen-deploying-cloud-k8s:audit:10"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 64
Architecture
85
Maintainability
87
Content
71
Community
83
Spec Compliance
What You Can Build
Prepare a First Managed Deployment
Create a deployment checklist covering image architecture, build variables, Helm values, namespaces, and basic runtime validation.
Build a Selective Delivery Pipeline
Plan GitHub Actions jobs that build changed services, publish matching images, and deploy reviewed Helm releases.
Stabilize a Production Cluster
Review GitOps, observability, RBAC, pod security, autoscaling, probes, and disruption controls for an existing workload.
Try These Prompts
Create a Deployment Checklist
Create a deployment checklist for my application on [AKS, GKE, or DOKS]. Include architecture, variables, images, Helm, and validation steps.
Diagnose a Failed Pod
Diagnose this Kubernetes pod failure: [status and logs]. Rank likely causes, request missing evidence, and provide safe verification steps.
Design a CI/CD Workflow
Design a GitHub Actions and Helm workflow for [repository structure]. Include path filters, architecture matching, secret references, approvals, and rollback checks.
Review Production Kubernetes Controls
Review my deployment approach for GitOps, immutable dependencies, least-privilege RBAC, image provenance, observability, resilience, secret handling, and recovery. Prioritize risks.
Best Practices
- Confirm node architecture before selecting a Docker build platform.
- Pin remote manifests and CI actions to reviewed immutable versions.
- Reference managed secrets without placing secret values in command arguments.
Avoid
- Do not treat public build variables and runtime secrets as interchangeable.
- Do not deploy mutable tags or remote manifests without review and verification.
- Do not grant applications broad namespace access to Kubernetes Secrets.
Frequently Asked Questions
Which managed Kubernetes services does this skill cover?
It targets common deployment patterns for AKS, GKE, and DOKS. Most guidance also applies to other conformant Kubernetes services.
Can this skill create my cloud cluster?
No. It focuses on application delivery and operations after cluster access exists.
Does it generate a complete production pipeline?
It can help design one, but repository layout, credentials, approval rules, and provider settings still require project-specific decisions.
How does it handle Next.js public variables?
It treats NEXT_PUBLIC variables as build-time inputs because Next.js embeds them in browser bundles.
Can it troubleshoot failed deployments?
Yes. It covers image pulls, architecture mismatches, crash loops, pending pods, logs, events, Helm parsing, and redirect problems.
Is every included example production-ready?
No. Replace placeholders and harden dependency pinning, secret delivery, temporary files, RBAC, and provenance settings before production use.
Developer Details
Author
AsmayaseenLicense
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Ref
89edfdc710d0846129dcee6a929477b04f08052c
Maintenance freshness
7/24/2026
Usage
8 downloads · 295 views
File structure