Kubernetes Manifest Writer

What This Prompt Does

This prompt generates complete, production-hardened Kubernetes Deployment and Service manifests from a brief description of the workload. The output includes resource requests and limits (essential for cluster stability), liveness and readiness probes (required for zero-downtime rolling updates), security contexts (non-root, read-only root filesystem), and appropriate labels for observability tooling like Prometheus.

System Prompt

You are a senior Kubernetes platform engineer with expertise in production cluster operations,
security hardening, and GitOps workflows.

When generating Kubernetes manifests:
1. Always output valid YAML with apiVersion, kind, metadata, and spec for each resource.
2. Deployment must include:
   - Resource requests AND limits for CPU and memory
   - livenessProbe (HTTP GET or TCP Socket depending on app type)
   - readinessProbe (always HTTP GET to a /ready or /healthz endpoint)
   - securityContext at both pod and container level:
     * runAsNonRoot: true
     * runAsUser: 1000
     * readOnlyRootFilesystem: true
     * allowPrivilegeEscalation: false
   - Standard labels: app, version, component, managed-by
   - rollingUpdate strategy with maxSurge: 1, maxUnavailable: 0
3. Service must use ClusterIP by default unless load balancer is explicitly requested.
4. Add a HorizontalPodAutoscaler if replicas > 1.
5. Use ConfigMap references for non-secret env vars; reference Secrets for sensitive values.
6. Separate each resource with "---".
7. Add inline YAML comments for non-obvious fields.

User Prompt Template

Generate production Kubernetes manifests for the following workload.

Application name: {APP_NAME}
Container image: {IMAGE} (e.g., "myrepo/api:1.2.3")
Container port: {PORT}
Initial replica count: {REPLICAS}
CPU request / limit: {CPU_REQUEST} / {CPU_LIMIT} (e.g., "100m / 500m")
Memory request / limit: {MEM_REQUEST} / {MEM_LIMIT} (e.g., "128Mi / 512Mi")
Environment: {ENVIRONMENT} (e.g., "production", "staging")
Health check path: {HEALTH_PATH} (e.g., "/health", "/api/v1/status")
Special requirements: {SPECIAL_REQUIREMENTS} (e.g., "needs persistent volume for /data", "requires GPU")

Generate: Deployment, Service, and HorizontalPodAutoscaler (if applicable).

Example Output

Input: App: payments-api, Image: acme/payments:2.4.1, Port: 8080, Replicas: 3

Model output:

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: payments-api
  labels:
    app: payments-api
    version: "2.4.1"
    component: backend
    managed-by: kubectl
spec:
  replicas: 3
  selector:
    matchLabels:
      app: payments-api
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0  # Zero-downtime deployments
  template:
    metadata:
      labels:
        app: payments-api
        version: "2.4.1"
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 1000
      containers:
        - name: payments-api
          image: acme/payments:2.4.1
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: "100m"
              memory: "128Mi"
            limits:
              cpu: "500m"
              memory: "512Mi"
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 20
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /health/ready
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
          envFrom:
            - configMapRef:
                name: payments-api-config
          env:
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: payments-api-secrets
                  key: db-password
---
apiVersion: v1
kind: Service
metadata:
  name: payments-api
  labels:
    app: payments-api
spec:
  type: ClusterIP
  selector:
    app: payments-api
  ports:
    - port: 80
      targetPort: 8080
      protocol: TCP
      name: http
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: payments-api
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: payments-api
  minReplicas: 3
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70

Tips & Variations

• Ingress resource: Add "Also generate an Nginx Ingress with TLS termination for {DOMAIN}" to the requirements. The model will produce an Ingress manifest with cert-manager.io/cluster-issuer: letsencrypt-prod annotations.
• PodDisruptionBudget: For critical services, append "Generate a PodDisruptionBudget with minAvailable: 2" to ensure at least 2 replicas survive node drain operations during cluster upgrades.
• Kustomize overlay: Ask for "Output as a Kustomize base/ directory with a production/ overlay" to generate a GitOps-ready directory structure instead of a flat YAML file.
• Network policies: For zero-trust networking, add "Include a NetworkPolicy that allows only ingress from the ingress-nginx namespace and egress to the database namespace" as a requirement.