Infrastructure Patterns

When to Use What

Tool	Use For
Raw K8s YAML	Simple deployments, one-off resources
Kustomize	Environment variations, overlays without templating
Helm	Complex apps, third-party charts, heavy templating
Terraform	Cloud resources, infrastructure lifecycle
GitHub Actions	CI/CD, automated testing, releases
Makefile	Build automation, self-documenting targets
Dockerfile	Container builds, multi-stage, multi-arch

Quick Decisions

Kustomize when: Simple env differences, readable manifests, patching YAML Helm when: Complex templating, third-party charts, release management

K8s Security Defaults

Every workload: non-root user, read-only filesystem, no privilege escalation, dropped capabilities, network policies.

GitHub Actions Patterns

CI workflow: Lint, test, compile on PRs (run on both x86 + ARM)
Release workflow: Multi-arch Docker build on tags (native ARM runners)
Pin actions by SHA, least-privilege permissions

References

KUBERNETES.md - K8s resource patterns
TERRAFORM.md - Terraform module patterns
GITHUB-ACTIONS.md - CI/CD workflow patterns
MAKEFILE.md - Build automation patterns
DOCKERFILE.md - Container build patterns
templates/ - Ready-to-use templates

Commands

kubectl apply -k ./              # Apply kustomize
helm upgrade --install NAME .    # Install/upgrade chart
terraform plan && terraform apply