@jetrabbits/agentic 0.0.1

package/areas/devops/kubernetes/AGENTS.md

@@ -0,0 +1,57 @@
+# Kubernetes — guidance index
+
+## What this area covers
+
+Self-hosted and managed Kubernetes cluster operations: cluster bootstrap, workload onboarding, RBAC design, network policies, resource governance, upgrade management, and pod-level debugging.
+
+## Guidance chain
+
+1. Project `.agent/` baseline (`AGENTS.md` + `.agent/*`)
+2. `kubernetes/rules/*` — load all
+3. `kubernetes/skills/*/SKILL.md` — load only the skill matching the current task
+4. `kubernetes/workflows/*` — load the workflow matching the triggered command
+
+## Inherited from devops area
+
+- Infrastructure-as-Code immutability principle — no manual kubectl edits in production.
+- Git-based change management — all manifests version-controlled.
+- Incident response severity classification from `sre/` area.
+
+## Kubernetes-specific constraints
+
+- All workloads require resource requests and limits before admission.
+- Network policies must be explicit — no implicit allow-all in non-development namespaces.
+- RBAC follows least-privilege; no cluster-admin bindings without documented justification.
+- Cluster upgrades follow the approved version-skew window; no skip-version upgrades.
+
+## Spec map
+
+```text
+kubernetes/
+├── rules/
+│   ├── cluster-standards.md      ← node sizing, OS, CRI, CNI constraints
+│   ├── workload-security.md      ← PSA levels, RBAC defaults, network policy baselines
+│   ├── resource-governance.md    ← requests/limits, LimitRange, QoS class targets
+│   └── upgrade-policy.md         ← version skew rules, upgrade cadence, pre-checks
+├── skills/
+│   ├── helm-charts/SKILL.md          ← chart authoring, values design, release management
+│   ├── rbac-design/SKILL.md          ← role/binding patterns, least-privilege recipes
+│   ├── network-policies/SKILL.md     ← ingress/egress policies, namespace isolation
+│   ├── resource-tuning/SKILL.md      ← VPA/HPA, right-sizing, QoS optimization
+│   ├── pod-troubleshooting/SKILL.md  ← crash loops, OOM, pending pods, exec debugging
+│   └── cluster-operations/SKILL.md  ← etcd, control plane, node drain/cordon
+├── workflows/
+│   ├── onboard-service.md     ← /onboard-service
+│   ├── upgrade-cluster.md     ← /upgrade-cluster
+│   ├── debug-workload.md      ← /debug-workload
+│   └── cluster-bootstrap.md  ← /cluster-bootstrap
+└── prompts/
+    └── *.md
+```
+
+## Discovery patterns
+
+- `rules/*.md`
+- `skills/*/SKILL.md`
+- `workflows/*.md`
+- `prompts/*.md`

package/areas/devops/kubernetes/PROMPTS.md

@@ -0,0 +1,9 @@
+# PROMPTS: kubernetes
+
+| Prompt | Use when |
+|:---|:---|
+| `/debug-workload` | Pod not Running, service unreachable, deployment stuck |
+| `/onboard-service` | Deploying new application to K8s for the first time |
+| `/upgrade-cluster` | Upgrading K8s control plane and worker nodes |
+| `/cluster-bootstrap` | Provisioning new bare-metal K8s cluster from scratch |
+| `/rbac-audit` | Auditing RBAC permissions before compliance review |

package/areas/devops/kubernetes/prompts/cluster-bootstrap.md

@@ -0,0 +1,67 @@
+---
+workflow: cluster-bootstrap
+---
+
+# Prompt: `/cluster-bootstrap`
+
+Use when: provisioning a new self-hosted Kubernetes cluster from bare-metal.
+
+---
+
+## Example 1 — Production HA cluster (kubeadm)
+
+**EN:**
+```
+/cluster-bootstrap
+
+Cluster: prod-cluster-eu
+Nodes: CP [cp-01/02/03: 192.168.10.10-12], Workers [w-01..06: 192.168.10.20-25]
+HA VIP: 192.168.10.5 (keepalived + haproxy)
+OS: Ubuntu 22.04 LTS / K8s: 1.31.x
+Pod CIDR: 10.244.0.0/16 / Service CIDR: 10.96.0.0/12
+CNI: Cilium + Hubble / Storage: Longhorn / LB: MetalLB (pool: .100-.150)
+Core add-ons: ArgoCD, cert-manager, External Secrets → Vault, kube-prometheus-stack, OPA Gatekeeper
+Security: etcd encryption at rest (AES-CBC), PSA restricted on production namespaces
+```
+
+**RU:**
+```
+/cluster-bootstrap
+
+Кластер: prod-cluster-eu
+Ноды: CP [cp-01/02/03: 192.168.10.10-12], Workers [w-01..06: 192.168.10.20-25]
+HA VIP: 192.168.10.5 (keepalived + haproxy)
+ОС: Ubuntu 22.04 LTS / K8s: 1.31.x
+Pod CIDR: 10.244.0.0/16 / Service CIDR: 10.96.0.0/12
+CNI: Cilium + Hubble / Хранилище: Longhorn / LB: MetalLB (pool: .100-.150)
+Основные компоненты: ArgoCD, cert-manager, External Secrets → Vault, kube-prometheus-stack, OPA Gatekeeper
+Безопасность: шифрование etcd at rest (AES-CBC), PSA restricted в production namespaces
+```
+
+---
+
+## Example 2 — Lightweight lab cluster (k3s)
+
+**EN:**
+```
+/cluster-bootstrap
+
+Cluster: lab-01 / Distribution: k3s
+Nodes: [lab-01: 192.168.1.10 server+agent, lab-02/03: 192.168.1.11-12 agents]
+OS: Rocky Linux 9 / K8s: latest k3s stable
+CNI: Flannel (default) / Storage: local-path / LB: none (port-forward)
+Required: kubeconfig on workstation, helm + kubectl configured
+Skip: HA, etcd encryption, OPA policies, PDB (lab environment)
+```
+
+**RU:**
+```
+/cluster-bootstrap
+
+Кластер: lab-01 / Дистрибутив: k3s
+Ноды: [lab-01: 192.168.1.10 server+agent, lab-02/03: 192.168.1.11-12 agents]
+ОС: Rocky Linux 9 / K8s: последний стабильный k3s
+CNI: Flannel (по умолчанию) / Хранилище: local-path / LB: нет (port-forward)
+Требуется: kubeconfig на рабочей станции, настроены helm + kubectl
+Пропустить: HA, шифрование etcd, OPA политики, PDB (lab окружение)
+```

package/areas/devops/kubernetes/prompts/debug-workload.md

@@ -0,0 +1,91 @@
+---
+workflow: debug-workload
+---
+
+# Prompt: `/debug-workload`
+
+Use when: a pod is not Running, a service is unreachable, or a deployment is stuck.
+
+---
+
+## Example 1 — CrashLoopBackOff diagnosis
+
+**EN:**
+```
+/debug-workload
+
+Service: payment-service
+Namespace: production
+Symptom: CrashLoopBackOff — pod restarts every 30s since v2.3.1 deploy at 14:22 UTC
+Last known good version: v2.3.0
+What to check: exit code from describe, previous logs, image digest diff, recent ConfigMap/Secret changes
+Output: root cause + fix as Helm values change (not kubectl edit)
+```
+
+**RU:**
+```
+/debug-workload
+
+Сервис: payment-service
+Namespace: production
+Симптом: CrashLoopBackOff — перезапуск каждые 30с с деплоя v2.3.1 в 14:22 UTC
+Последняя рабочая версия: v2.3.0
+Что проверить: код выхода через describe, логи --previous, diff image digest, изменения ConfigMap/Secret
+Результат: корневая причина + исправление как Helm values (не kubectl edit)
+```
+
+---
+
+## Example 2 — Service unreachable (empty endpoints)
+
+**EN:**
+```
+/debug-workload
+
+Service: order-service / Namespace: production
+Symptom: HTTP 503 from Ingress; endpoints empty despite 3/3 pods Running
+Investigate: pod labels vs Service selector, ReadinessProbe status, NetworkPolicy blocking kubelet health check
+Port mapping: container 8080, service 80 → targetPort 8080
+```
+
+**RU:**
+```
+/debug-workload
+
+Сервис: order-service / Namespace: production
+Симптом: HTTP 503 от Ingress; endpoints пустые хотя 3/3 поды Running
+Расследовать: labels подов vs selector сервиса, статус ReadinessProbe, NetworkPolicy блокирующий kubelet health check
+Маппинг портов: container 8080, service 80 → targetPort 8080
+```
+
+---
+
+## Example 3 — OOMKilled + right-size
+
+**EN:**
+```
+/debug-workload
+
+Service: ml-inference-worker / Namespace: ml-prod
+Symptom: OOMKilled (exit 137), 12 restarts in last hour; current limit: 512Mi
+Task:
+  1. Confirm OOMKill via describe + exit code
+  2. Query Prometheus p99 memory over 7 days
+  3. Calculate new limit = p99 × 1.3
+  4. Update Helm values; do NOT patch production directly
+  5. Check VPA recommendation if available
+```
+
+**RU:**
+```
+/debug-workload
+
+Сервис: ml-inference-worker / Namespace: ml-prod
+Симптом: OOMKilled (exit 137), 12 перезапусков за час; текущий лимит: 512Mi
+Задача:
+  1. Подтвердить OOMKill через describe + код выхода
+  2. Запросить Prometheus p99 памяти за 7 дней
+  3. Рассчитать новый лимит = p99 × 1.3
+  4. Обновить Helm values; НЕ патчить production напрямую
+  5. Проверить рекомендацию VPA если доступен
+```

package/areas/devops/kubernetes/prompts/onboard-service.md

@@ -0,0 +1,101 @@
+---
+workflow: onboard-service
+---
+
+# Prompt: `/onboard-service`
+
+Use when: deploying a new application to Kubernetes with namespace, workload, and least-privilege access defined together.
+
+---
+
+## Example 1 — Internal backend service
+
+**EN:**
+```
+/onboard-service
+
+Service: notification-service / Team: platform-team / Env: production
+Image: registry.internal/notification-service:v1.0.0 / Port: 8080
+Health: /health/ready, /health/live
+Resource profile: small (100m CPU / 128Mi memory requests)
+Calls: smtp-relay.infra:25, redis.cache:6379
+Called by: order-service (namespace: production)
+External: no
+Required: namespace, ServiceAccount, RBAC, NetworkPolicy, Helm chart, ArgoCD app, HPA (min 2 max 8), ServiceMonitor
+```
+
+**RU:**
+```
+/onboard-service
+
+Сервис: notification-service / Команда: platform-team / Окружение: production
+Image: registry.internal/notification-service:v1.0.0 / Порт: 8080
+Health: /health/ready, /health/live
+Профиль ресурсов: small (100m CPU / 128Mi memory requests)
+Вызывает: smtp-relay.infra:25, redis.cache:6379
+Вызывается: order-service (namespace: production)
+Внешний доступ: нет
+Требуется: namespace, ServiceAccount, RBAC, NetworkPolicy, Helm chart, ArgoCD app, HPA (min 2 max 8), ServiceMonitor
+```
+
+---
+
+## Example 2 — Externally exposed service with TLS
+
+**EN:**
+```
+/onboard-service
+
+Service: api-gateway / Team: backend-team / Env: staging
+Image: registry.internal/api-gateway:v0.9.0 / Port: 8080
+External: yes — NGINX Ingress at api.staging.example.com, TLS via cert-manager (Let's Encrypt)
+Resource profile: medium (250m CPU / 256Mi memory)
+Auth: mTLS between internal services
+PDB: minAvailable 1 (staging has >= 2 replicas)
+```
+
+**RU:**
+```
+/onboard-service
+
+Сервис: api-gateway / Команда: backend-team / Окружение: staging
+Image: registry.internal/api-gateway:v0.9.0 / Порт: 8080
+Внешний доступ: да — NGINX Ingress на api.staging.example.com, TLS через cert-manager (Let's Encrypt)
+Профиль ресурсов: medium (250m CPU / 256Mi memory)
+Auth: mTLS между внутренними сервисами
+PDB: minAvailable 1 (в staging минимум 2 реплики)
+```
+
+---
+
+## Example 3 — Pre-compliance namespace audit
+
+**EN:**
+```
+/onboard-service
+
+Target: namespace production
+Goal: identify overprivileged accounts before SOC 2 review
+Checks:
+  - ServiceAccounts with automountServiceAccountToken: true
+  - Bindings referencing cluster-admin or wildcard verbs/resources
+  - Orphaned ServiceAccounts (no workload)
+  - SA with cross-namespace ClusterRoleBindings
+  - CI/CD SA (github-actions-sa) permissions vs required minimum
+Output: findings table (SA / bound role / verdict: OK|REDUCE|REMOVE) + fix manifests
+```
+
+**RU:**
+```
+/onboard-service
+
+Цель: namespace production
+Задача: выявить привилегированные аккаунты перед SOC 2 ревью
+Проверки:
+  - ServiceAccount с automountServiceAccountToken: true
+  - Bindings ссылающиеся на cluster-admin или wildcard verbs/resources
+  - Orphaned ServiceAccount (без workload)
+  - SA с межnamespace ClusterRoleBinding
+  - Права CI/CD SA (github-actions-sa) vs необходимый минимум
+Результат: таблица находок (SA / роль / вердикт: OK|REDUCE|REMOVE) + fix манифесты
+```

package/areas/devops/kubernetes/prompts/upgrade-cluster.md

@@ -0,0 +1,63 @@
+---
+workflow: upgrade-cluster
+---
+
+# Prompt: `/upgrade-cluster`
+
+Use when: upgrading Kubernetes control plane and worker nodes to a new minor or patch version.
+
+---
+
+## Example 1 — Minor version upgrade (production, zero downtime)
+
+**EN:**
+```
+/upgrade-cluster
+
+Cluster: prod-cluster-01 / Current: 1.29.8 / Target: 1.30.4
+Nodes: 3 control plane (cp-01/02/03) + 6 workers (worker-01..06)
+Constraints: zero downtime, upgrade window Sat 02:00–06:00 UTC
+Staging: already on 1.30.4, healthy 72h
+Pre-checks: kubent deprecated API scan, ArgoCD/cert-manager/ingress-nginx compat check, etcd backup
+Rollback plan: required in upgrade PR before merge
+```
+
+**RU:**
+```
+/upgrade-cluster
+
+Кластер: prod-cluster-01 / Текущая: 1.29.8 / Целевая: 1.30.4
+Ноды: 3 control plane (cp-01/02/03) + 6 workers (worker-01..06)
+Ограничения: zero downtime, окно обновления сб 02:00–06:00 UTC
+Staging: уже на 1.30.4, стабильно 72ч
+Пред-проверки: сканирование deprecated API через kubent, проверка совместимости ArgoCD/cert-manager/ingress-nginx, бэкап etcd
+План отката: обязателен в PR до merge
+```
+
+---
+
+## Example 2 — Security patch (fast-track, staging)
+
+**EN:**
+```
+/upgrade-cluster
+
+Cluster: staging-cluster-01 / Current: 1.30.2 / Target: 1.30.4
+Reason: CVE-2024-XXXXX security patch — apply within 48h per policy
+Nodes: 1 control plane + 3 workers
+Staging: downtime < 5 min acceptable
+Required: etcd backup + verify, control plane upgrade, rolling node upgrade
+Skip: full 48h staging validation (this IS the staging cluster)
+```
+
+**RU:**
+```
+/upgrade-cluster
+
+Кластер: staging-cluster-01 / Текущая: 1.30.2 / Целевая: 1.30.4
+Причина: патч безопасности CVE-2024-XXXXX — применить в течение 48ч согласно политике
+Ноды: 1 control plane + 3 workers
+Staging: простой < 5 мин допустим
+Требуется: бэкап etcd + верификация, обновление control plane, rolling обновление нод
+Пропустить: полную 48ч валидацию staging (это и есть staging кластер)
+```

package/areas/devops/kubernetes/rules/cluster-standards.md

@@ -0,0 +1,51 @@
+# Rule: Cluster Standards
+
+**Priority**: P0 — Non-compliant clusters are blocked from receiving production workloads.
+
+## Control Plane
+
+1. **High availability required for production**
+   - Minimum 3 control plane nodes across 3 failure domains (separate physical hosts or AZs).
+   - Single-node control plane allowed only in dev/lab; explicitly labelled `env=dev`.
+   - etcd must run on dedicated nodes or co-located on control plane nodes — never on workers.
+
+2. **Supported distributions**
+   - Bare-metal: kubeadm, k3s (single-node / small clusters), RKE2, Talos Linux.
+   - Cloud: EKS, GKE, AKS — managed control plane only; node pools follow these same rules.
+   - Custom distros require architecture review sign-off before production use.
+
+3. **Kubernetes version policy**
+   - Production clusters must run a version within **2 minor releases** of the latest stable.
+   - No cluster older than N-3 in any environment.
+   - Patch updates applied within 30 days of release.
+
+## Node Standards
+
+4. **Operating system**
+   - Preferred: Ubuntu 22.04 LTS or Rocky Linux 9 (immutable image preferred).
+   - All nodes run the same OS and kernel version within a node group.
+   - `unattended-upgrades` / `dnf-automatic` enabled for security patches only (not kernel).
+
+5. **Container runtime**
+   - **containerd** is the standard CRI. Docker Engine as CRI is forbidden.
+   - `runc` is the default OCI runtime. `gVisor` / `kata-containers` for sensitive workloads.
+
+6. **Node labelling (mandatory)**
+   ```
+   node-role.kubernetes.io/worker=
+   topology.kubernetes.io/zone=<zone>
+   topology.kubernetes.io/region=<region>
+   node.kubernetes.io/instance-type=<type>
+   environment=<prod|staging|dev>
+   ```
+
+## Networking
+
+7. **CNI**
+   - Cilium is the standard for new clusters (eBPF, NetworkPolicy, Hubble observability).
+   - Calico accepted for existing clusters. Flannel only in dev/lab — no NetworkPolicy support.
+   - Pod CIDR and Service CIDR must not overlap and must not conflict with datacenter routing.
+
+8. **No NodePort in production**
+   - Services exposed via `LoadBalancer` (MetalLB for bare-metal) or `Ingress` only.
+   - `NodePort` allowed in dev/lab environments only.

package/areas/devops/kubernetes/rules/resource-governance.md

@@ -0,0 +1,80 @@
+# Rule: Resource Governance
+
+**Priority**: P1 — Missing resource contracts fail pre-deploy quality gate.
+
+## Mandatory Resource Contracts
+
+1. **Every container must specify requests AND limits**
+   ```yaml
+   resources:
+     requests:
+       cpu: 100m       # guaranteed CPU
+       memory: 128Mi   # guaranteed memory
+     limits:
+       cpu: 500m       # burst cap
+       memory: 512Mi   # OOM kill threshold
+   ```
+   - Containers without `resources` block are rejected by OPA/Gatekeeper policy.
+   - `limits.cpu` may be omitted only if the workload is explicitly classified as CPU-unbounded with team-lead approval.
+
+2. **QoS class targets**
+   - `Guaranteed` (requests == limits): required for stateful workloads and Tier 1 services.
+   - `Burstable` (requests < limits): acceptable for Tier 2 services.
+   - `BestEffort` (no resources): forbidden in production; allowed in dev/lab only.
+
+## Namespace LimitRange
+
+3. **Every production namespace has a LimitRange**
+   ```yaml
+   apiVersion: v1
+   kind: LimitRange
+   metadata:
+     name: default-limits
+   spec:
+     limits:
+       - type: Container
+         default:       { cpu: 200m, memory: 256Mi }    # applied when limits absent
+         defaultRequest:{ cpu: 50m,  memory: 64Mi  }    # applied when requests absent
+         max:           { cpu: 4,    memory: 4Gi   }    # hard ceiling per container
+   ```
+
+## Autoscaling
+
+4. **HPA required for all Tier 1 stateless workloads**
+   ```yaml
+   spec:
+     minReplicas: 2
+     maxReplicas: 20
+     metrics:
+       - type: Resource
+         resource:
+           name: cpu
+           target: { type: Utilization, averageUtilization: 70 }
+   ```
+
+5. **PodDisruptionBudget (PDB) required for Tier 1**
+   ```yaml
+   spec:
+     minAvailable: 1        # or maxUnavailable: 1 — choose one
+     selector:
+       matchLabels:
+         app: my-service
+   ```
+   - Tier 1 services must tolerate voluntary disruption (node drain) without outage.
+
+## Topology & Scheduling
+
+6. **TopologySpreadConstraints for Tier 1**
+   ```yaml
+   topologySpreadConstraints:
+     - maxSkew: 1
+       topologyKey: topology.kubernetes.io/zone
+       whenUnsatisfiable: DoNotSchedule
+       labelSelector:
+         matchLabels: { app: my-service }
+   ```
+   - Prevents all replicas landing on one zone during rolling update.
+
+7. **ResourceQuota on every production namespace**
+   - Prevents resource exhaustion from runaway deployments.
+   - Values set per team capacity plan; reviewed quarterly.

package/areas/devops/kubernetes/rules/upgrade-policy.md

@@ -0,0 +1,52 @@
+# Rule: Cluster Upgrade Policy
+
+**Priority**: P1 — Skipping upgrade gates puts the cluster out of support and blocks security patches.
+
+## Version Skew Policy
+
+1. **Supported version range**
+   - Production clusters must run within **2 minor versions** of the latest stable Kubernetes release.
+   - Example: if latest is 1.31 → minimum allowed in prod is 1.29.
+   - Clusters at N-3 or older are placed in mandatory upgrade sprint within 30 days.
+
+2. **Control plane ↔ node version skew**
+   - Nodes may run **at most 2 minor versions behind** the control plane.
+   - kube-apiserver must be upgraded **before** kubelet on any node.
+   - Never upgrade kubelet ahead of kube-apiserver.
+
+3. **Component version alignment**
+   - `kubectl` client: must be within ±1 minor of the server.
+   - Helm: latest stable; chart API version must match cluster API version.
+   - All Kubernetes-aware tooling (ArgoCD, Cert-Manager, Ingress controller) must list the target K8s version in their compatibility matrix before upgrade.
+
+## Upgrade Cadence
+
+4. **Patch updates**: applied within **30 days** of release on all clusters.
+5. **Minor version upgrades**:
+   - Dev/staging: upgrade within 30 days of release.
+   - Production: upgrade within 60 days of staging validation.
+   - One minor version at a time (1.29 → 1.30 → 1.31; never skip).
+
+## Upgrade Safety Gates
+
+6. **Pre-upgrade checklist (automated in upgrade workflow)**
+   - All nodes in `Ready` state; no `NotReady` or `SchedulingDisabled`.
+   - No active P0/P1 incidents.
+   - Full etcd backup completed and verified within 1 hour of upgrade start.
+   - PodDisruptionBudgets reviewed — no PDB that would block node drain.
+   - Deprecated API usage audit: `kubectl get --show-labels` + `kubent` (kube-no-trouble) run.
+
+7. **Control plane upgrade order**
+   ```
+   1. etcd backup
+   2. Upgrade kube-apiserver (one node at a time for HA)
+   3. Upgrade kube-controller-manager
+   4. Upgrade kube-scheduler
+   5. Validate control plane health
+   6. Upgrade worker nodes (cordon → drain → upgrade → uncordon)
+   ```
+
+8. **Rollback plan required before every upgrade**
+   - etcd snapshot = point-in-time rollback for control plane.
+   - Node rollback = reprovision from last known good OS image.
+   - Document rollback steps in upgrade PR before merge.

package/areas/devops/kubernetes/rules/workload-security.md

@@ -0,0 +1,64 @@
+# Rule: Workload Security
+
+**Priority**: P0 — Security violations block deployment to production namespaces.
+
+## Pod Security Admission (PSA)
+
+1. **Namespace-level enforcement**
+   - `production` namespaces: `pod-security.kubernetes.io/enforce: restricted`
+   - `staging` namespaces: `pod-security.kubernetes.io/enforce: baseline`
+   - `dev` / `system` namespaces: `pod-security.kubernetes.io/warn: baseline`
+   - Never use `privileged` profile in production without explicit exemption + runbook.
+
+2. **Restricted profile requirements (enforced)**
+   ```yaml
+   securityContext:
+     runAsNonRoot: true
+     runAsUser: 1000          # non-zero UID
+     readOnlyRootFilesystem: true
+     allowPrivilegeEscalation: false
+     capabilities:
+       drop: ["ALL"]
+     seccompProfile:
+       type: RuntimeDefault
+   ```
+
+## RBAC
+
+3. **Service account principle of least privilege**
+   - Every workload gets a dedicated `ServiceAccount` — never use `default`.
+   - `automountServiceAccountToken: false` unless the pod explicitly needs API access.
+   - `ClusterRole` only when cross-namespace access is architecturally justified.
+
+4. **Forbidden bindings**
+   - `cluster-admin` ClusterRoleBinding for non-system service accounts: **BLOCKED**.
+   - Binding `system:masters` group to application identities: **BLOCKED**.
+   - Wildcard verbs (`*`) in production Role/ClusterRole without documented exception.
+
+## Network Policy
+
+5. **Default-deny posture**
+   - Every namespace must have a default-deny-all NetworkPolicy at creation.
+   - Ingress and egress explicitly whitelisted per workload.
+
+   ```yaml
+   # Default deny-all (apply to every new namespace)
+   apiVersion: networking.k8s.io/v1
+   kind: NetworkPolicy
+   metadata:
+     name: default-deny-all
+   spec:
+     podSelector: {}
+     policyTypes: [Ingress, Egress]
+   ```
+
+6. **Inter-namespace traffic**
+   - Namespaces are isolated by default; cross-namespace communication requires explicit policy.
+   - System namespaces (`kube-system`, `monitoring`) may egress to all; ingress restricted to operators.
+
+## Secrets
+
+7. **Secret hygiene**
+   - Secrets never stored in ConfigMaps or environment variable literals in pod spec.
+   - Use External Secrets Operator (ESO) to sync from Vault / AWS Secrets Manager / etc.
+   - `etcd` encryption at rest mandatory (`EncryptionConfiguration` with `aescbc` or KMS provider).