VerifiedPlugin
terrashark
The #1 Terraform skill for Claude Code and Codex, measured by GitHub stars.
1 skill672
@lukasniessenDeployment
Plugin
kubernetes-skill
The #1 Kubernetes skill for Claude Code and Codex, measured by GitHub stars.
Plugin Signal66/100Solid
maintained96
capable14
documented100
adopted56
Install on Claude Code
> /plugin marketplace add LukasNiessen/kubernetes-skill> /plugin install kubernetes-skill@kubernetes-skill
Stats
431
Stars
78
Forks
Active
Maintenance
MIT
License
8d ago
Last commit
5mo ago
Created
Repo: LukasNiessen/kubernetes-skill
What's inside
Badges
README
Kubernetes Skill for Claude Code and Codex: KubeShark
The #1 Kubernetes skill for Claude Code and Codex, measured by GitHub stars.
Fixes Hallucinations.
LLMs hallucinate a lot when it comes to Kubernetes. They omit security contexts, generate deprecated APIs, use wildcard RBAC, forget resource limits, and produce probes that cause cascading failures. This skill fixes it. It includes best practices for Kubernetes -- good, bad, and neutral examples so the AI avoids common mistakes. Using KubeShark, the AI keeps proven practices in mind, eliminates hallucinations, and defaults to secure, reliable, production-ready manifests.
KubeShark is built as the production-grade Kubernetes skill for Claude Code and Codex: broader than resource-template skills, safer than generic Kubernetes prompts, and tuned for hallucination prevention instead of raw tutorial volume.
Very Token-Efficient.
Most Kubernetes skills dump huge walls of text onto the agent and burn expensive tokens -- with no upside. LLMs don't need the entire Kubernetes docs again. KubeShark was aggressively de-duplicated and optimized for maximum quality per token.
Based on Official Best Practices.
KubeShark is primarily based on the official Kubernetes documentation, the NSA/CISA Kubernetes Hardening Guide, OWASP Kubernetes Top 10, Pod Security Standards, and the CIS Kubernetes Benchmark. When guidance conflicts, it prioritizes official Kubernetes documentation.
Quick Start · Why KubeShark · Token Strategy · What's Included · How It Works · Sponsor · Philosophy
2 min Quickstart
Option 1: Skills CLI
If you manage skills with the skills CLI, install KubeShark directly from GitHub:
npx skills add https://github.com/lukasniessen/kubernetes-skill --skill kubernetes-skill
Option 2: Clone
macOS / Linux:
git clone https://github.com/LukasNiessen/kubernetes-skill.git ~/.claude/skills/kubernetes-skill
Windows (Powershell):
git clone https://github.com/LukasNiessen/kubernetes-skill.git "$env:USERPROFILE\.claude\skills\kubernetes-skill"
Windows (Command Prompt):
git clone https://github.com/LukasNiessen/kubernetes-skill.git "%USERPROFILE%\.claude\skills\kubernetes-skill"
That's it. Claude Code auto-discovers skills in ~/.claude/skills/ -- no restart needed.
Option 3: Marketplace
Claude Code has a built-in plugin system with marketplace support. Instead of cloning manually, you can add KubeShark's marketplace and install directly from the CLI:
/plugin marketplace add LukasNiessen/kubernetes-skill
/plugin install kubernetes-skill
Or use the interactive plugin manager -- run /plugin, switch to the Discover tab, and install from there. The marketplace reads the .claude-plugin/marketplace.json in this repo to register KubeShark as an installable plugin.
Option 4: Codex
Codex has no global skill system -- setup is per-project. Clone KubeShark into your repo and reference it from your AGENTS.md:
# Clone into your project root
git clone https://github.com/LukasNiessen/kubernetes-skill.git .kubernetes-skill
Then add to your AGENTS.md (or create one in the repo root):
## Kubernetes
When working with Kubernetes manifests, Helm charts, or Kustomize overlays, follow the workflow in `.kubernetes-skill/SKILL.md`.
Load references from `.kubernetes-skill/references/` as needed.
That's it!
Done. Now ask Claude Code / Codex any Kubernetes question. KubeShark responses follow the 7-step failure-mode workflow and include an output contract with assumptions, tradeoffs, and rollback notes.
Invoke explicitly:
/kubernetes-skill Create a production-ready Deployment with an Ingress and autoscaling
/kubernetes-skill Review my Deployment for security issues and add proper RBAC, NetworkPolicies, and resource limits
Or just ask naturally -- KubeShark activates automatically for any Kubernetes task:
Review my deployment.yaml for security issues
Create a Helm chart for a PostgreSQL StatefulSet with backup CronJobs
Why KubeShark
Overview
| Dimension | KubeShark | No Skill |
|---|---|---|
| SKILL.md activation cost | Low, procedural workflow only | 0 |
| Reference granularity | 26 focused files | -- |
| Token burn per query | Low (load only matched refs) | 0 |
| Architecture | Failure-mode workflow | -- |
| Diagnoses before generating | Yes (Step 2) | No |
| Output contract | Yes -- assumptions, tradeoffs, rollback | No |
| Conditional references | EKS, GKE, AKS, OpenShift, GitOps, observability stacks | No |
| Security-first defaults | PSS restricted profile | No |
| Good/bad examples | Yes (2 dedicated files) | No |
| Do/Don't checklist | Yes (dedicated file) | No |
| Compliance coverage | NSA/CISA, OWASP K8s Top 10, CIS, Pod Security Standards | No |
| Hallucination prevention | Core design goal | No |
| Cross-resource validation | Label/selector/port consistency checks | No |
| Helm/Kustomize guidance | Dedicated reference files | No |
| Policy engine integration | Kyverno and OPA/Gatekeeper patterns | No |
| License | MIT | -- |
Why Failure-Mode-First Matters for Kubernetes
The key insight is architectural. A static reference manual gives Claude information but never tells it how to think about a problem. There's no diagnosis step, no risk assessment, and no structured output -- Claude reads the reference and generates whatever it thinks fits.
KubeShark takes the opposite approach. The core SKILL.md is a compact operational workflow. It forces Claude through a diagnostic sequence: capture context -> identify failure modes -> load only the relevant references -> propose fixes with explicit risk controls -> validate -> deliver a structured output contract.
This matters for Kubernetes specifically because:
-
Silent failures are common. A Service with the wrong selector deploys successfully but routes to nothing. A NetworkPolicy with a mistyped label silently does nothing. Unlike Terraform, Kubernetes accepts most manifests without error -- failures surface at runtime.
-
Multi-dimensional risk. Kubernetes operates across security, networking, scheduling, storage, and application lifecycle simultaneously. An LLM must reason about all these dimensions for every resource.
-
Training data pollution. Kubernetes has had aggressive API deprecation. The LLM training corpus contains vast amounts of pre-1.22 YAML using removed APIs. Without diagnosis, the LLM confidently generates deprecated configurations.
Skill Comparison
Here's how KubeShark compares to other public Kubernetes-focused agent skills found during the May 2026 review. This compares Kubernetes skill behavior, not full runtime observability products or broad skill collections.
| Dimension | KubeShark | Kubernetes Resource Management | Kube Audit Kit | Kubernetes Operations |
|---|---|---|---|---|
| Primary goal | Generate, review, refactor, and harden K8s safely | Explain and template core objects | Read-only cluster security audits | Kubectl operations and debugging |
| Failure-mode workflow | Yes: six explicit Kubernetes failure modes | No | Audit workflow only | Partial operational workflow |
| Manifest generation/review | Yes | Yes | No, audit-focused | Yes |
| Helm/Kustomize guidance | Dedicated references | No dedicated coverage | No | Not primary |
| Platform-specific guidance | EKS, GKE, AKS, OpenShift via CRR | No | No | Cloud-aware, less granular |
| GitOps and observability depth | Argo CD, Flux, Prometheus, OpenTelemetry, Loki | No | No | No |
| Security posture | PSS restricted defaults, RBAC, policy engines | Basic resource guidance | Strong audit focus | General stability/security |
| Cross-resource validation | Label, selector, port, policy, and rollout checks | Basic examples | Post-export analysis | Operational troubleshooting |
| Output contract | Assumptions, tradeoffs, validation, rollback | No | Audit report | No structured contract |
| Token strategy | Lean workflow plus conditional references | Single static resource guide | Scripted audit skill | Operational guidance |
KubeShark wins on production manifest work because it diagnoses before generating, keeps platform depth behind CRR, covers Helm/Kustomize and policy engines, and forces validation plus rollback into the response contract.
Token Strategy
- Keep
SKILL.mdprocedural and compact - Keep references focused on failure-prone decisions
- Exclude broad tutorial material with low safety impact
- Add depth only when measured quality would otherwise drop
- Use Conditional Reference Retrieval (CRR) for platform and controller specifics
Conditional Reference Retrieval (CRR)
File tree
More plugins by @lukasniessen.
View @lukasniessen’s profile@lukasniessenFAQ
kubernetes-skill is a Claude Code plugin with 1 hand-picked skill for deployment work, indexed on Flowy. Install it with the command on its page. It includes kubernetes-skill. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.
- What is kubernetes-skill?
- The #1 Kubernetes skill for Claude Code and Codex, measured by GitHub stars.
- How do I install kubernetes-skill?
- Run these in Claude Code: /plugin marketplace add LukasNiessen/kubernetes-skill then /plugin install kubernetes-skill@kubernetes-skill. Then prompt normally.
- Does kubernetes-skill auto-invoke its skills?
- Not yet. It is indexed on Flowy as a plain plugin. Request auto-invocation on its page and Flowy will route its skills for you as you prompt.
- Is kubernetes-skill free?
- Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.
Is this plugin yours?
Claim it with GitHubSubmit a pluginPromote it