---
name: k8s-manifest-reviewer
description: Explain, review, and audit Kubernetes YAML manifests — Deployments, StatefulSets, Services, ConfigMaps, RBAC, NetworkPolicies, and HPA — for correctness, security, and production readiness.
---

## Trigger Phrases
Use this skill when the request involves understanding or reviewing a Kubernetes manifest:

- "Explain what this Deployment manifest does."
- "Review this K8s YAML for misconfigurations."
- "Is this StatefulSet production-ready?"
- "What's wrong with this NetworkPolicy?"
- "Audit this RBAC configuration."
- "Why would this Deployment behave differently in production vs. local?"

Do not use this skill for generating new manifests from scratch — use `k8s-yaml-generator` for that.

## Deterministic Execution Flow

### Stage 0: Classify Request Mode

| Mode | User intent | Deliverable |
|------|-------------|-------------|
| `explain` | Understand what a manifest does | Section-by-section explanation, plain English |
| `audit` | Find misconfigurations or risks | Annotated findings by severity |
| `compare` | Two manifests, diff the implications | Side-by-side analysis with behavior difference |
| `production-check` | Is this ready for a real cluster? | Full production readiness checklist |

### Stage 1: Identify Manifest Type
Before reviewing, identify the resource kind(s). Multi-document YAML (separated by `---`) should be processed per-document.

Supported resource kinds:
- Workloads: `Deployment`, `StatefulSet`, `DaemonSet`, `Job`, `CronJob`
- Networking: `Service`, `Ingress`, `NetworkPolicy`
- Config: `ConfigMap`, `Secret`, `HorizontalPodAutoscaler`
- Access: `Role`, `ClusterRole`, `RoleBinding`, `ClusterRoleBinding`, `ServiceAccount`
- Storage: `PersistentVolumeClaim`, `StorageClass`

For unknown or custom resource definitions (CRDs): describe the CRD purpose, then review the structural fields.

### Stage 2: Audit Checklist
For `audit` and `production-check` modes, evaluate all applicable items:

**Resources:**
- [ ] `resources.requests` and `resources.limits` defined for every container
- [ ] Memory limit is not lower than memory request (inverted limits cause immediate OOMKill)
- [ ] CPU limit is set (unbounded CPU can starve other pods on the node)

**Health Probes:**
- [ ] `readinessProbe` defined — pods without it receive traffic immediately on startup
- [ ] `livenessProbe` defined — pods without it are never restarted on deadlock
- [ ] Probe `initialDelaySeconds` is appropriate for app startup time
- [ ] Probe failure thresholds are not too aggressive (single failure should not kill a pod)

**Security Context:**
- [ ] `runAsNonRoot: true` set at pod or container level
- [ ] `readOnlyRootFilesystem: true` where applicable
- [ ] `allowPrivilegeEscalation: false` set
- [ ] `seccompProfile` or `AppArmor` annotations present for sensitive workloads
- [ ] No `hostNetwork: true`, `hostPID: true`, or `hostIPC: true` unless explicitly required

**Image:**
- [ ] Image tag is not `:latest` (use pinned digest or semver tag)
- [ ] `imagePullPolicy` is `Always` for mutable tags, `IfNotPresent` for pinned ones

**Replicas and Availability:**
- [ ] `replicas` is ≥ 2 for production workloads
- [ ] `PodDisruptionBudget` exists for critical workloads
- [ ] `topologySpreadConstraints` or `podAntiAffinity` set to avoid co-scheduling replicas on the same node

**Networking:**
- [ ] `NetworkPolicy` exists to restrict ingress/egress if the workload handles sensitive data
- [ ] Service type is `ClusterIP` unless external access is needed (avoid unnecessary `NodePort`/`LoadBalancer`)

**Secrets and Config:**
- [ ] Secrets are not mounted as environment variables where file mount is safer
- [ ] No plaintext sensitive values in `ConfigMap`

**RBAC:**
- [ ] ServiceAccount follows least-privilege
- [ ] No `ClusterRole` when a namespaced `Role` is sufficient
- [ ] `automountServiceAccountToken: false` where the pod doesn't need API access

### Stage 3: Respond

For `explain` mode:
- Walk through the manifest top-to-bottom
- Call out any non-default or non-obvious settings explicitly
- End with a one-paragraph "What this does at runtime" summary

For `audit` and `production-check` mode, use this format per finding:

```
[CRITICAL] resources.limits.memory is 64Mi but resources.requests.memory is 128Mi — limits below requests cause immediate OOMKill on scheduling.

[WARNING] No readinessProbe defined — pod will receive live traffic before the application is ready.

[INFO] imagePullPolicy is not set — defaults to IfNotPresent for non-latest tags. Consider setting explicitly.
```

Close with:
```
## Production Readiness Summary
- Critical issues: N
- Warnings: N
- The manifest [is / is not] ready for production as-is.
```

## Done Criteria
- Resource kind(s) are identified before reviewing.
- All applicable checklist items are evaluated — no silent skips.
- Findings are severity-labeled: `CRITICAL`, `WARNING`, `INFO`.
- `explain` mode ends with a runtime summary paragraph.
- `audit`/`production-check` ends with a readiness summary.
- Corrected YAML is offered when CRITICAL issues are present.