Infrastructure Patterns

Safety: Dry-Run Before Apply

NEVER run state-changing commands (kubectl apply, terraform apply, helm upgrade --install) without first presenting the plan/diff to the user.

Always run the read-only equivalent first:

• terraform plan before terraform apply
• kubectl diff before kubectl apply
• helm upgrade --dry-run before helm upgrade

If the user explicitly asks to apply, confirm before executing.

When to Use What

Tool	Use For
Raw K8s YAML	Simple deployments, one-off resources
Kustomize	Environment variations, overlays without templating
Helm	Complex apps, third-party charts, heavy templating
Terraform	Cloud resources, infrastructure lifecycle
GitHub Actions	CI/CD, automated testing, releases
Makefile	Build automation, self-documenting targets
Dockerfile	Container builds, multi-stage, multi-arch

Quick Decisions

Kustomize when: Simple env differences, readable manifests, patching YAML Helm when: Complex templating, third-party charts, release management

K8s Security Defaults

Every workload: non-root user, read-only filesystem, no privilege escalation, dropped capabilities, network policies.

GitHub Actions Patterns

• CI workflow: Lint, test, compile on PRs (run on both x86 + ARM)
• Release workflow: Multi-arch Docker build on tags (native ARM runners)
• Pin actions by SHA, least-privilege permissions

References

• KUBERNETES.md - K8s resource patterns
• TERRAFORM.md - Terraform module patterns
• GITHUB-ACTIONS.md - CI/CD workflow patterns
• MAKEFILE.md - Build automation patterns
• DOCKERFILE.md - Container build patterns
• templates/ - Ready-to-use templates

Commands

kubectl apply -k ./              # Apply kustomize
helm upgrade --install NAME .    # Install/upgrade chart
terraform plan && terraform apply