new-k8s-service

Adds a new k3s workload role with inventory entry, secrets, and first deploy to a homelab cluster.

2|Updated Mar 3, 2026
One-click install
npx skills add https://github.com/DanielH2018/server --skill new-k8s-service-danielh2018
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: new-k8s-service
Source: https://github.com/DanielH2018/server/tree/main/.claude/skills/new-k8s-service
Command: npx skills add https://github.com/DanielH2018/server --skill new-k8s-service-danielh2018

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Adding a service to a k3s homelab involves many easy-to-miss steps: the Ansible role skeleton, the inventory entry, deploy ordering, secrets, and the GitOps auto-deploy declaration. This Skill walks through each step so a new workload actually deploys instead of silently doing nothing. ## Core Features & Use Cases - Role scaffolding guidance: Copy the right sibling role (freshrss for plain web apps, sonarr for media-volume apps) and follow enforced conventions like descriptive volume names and manifest-only templates directories. - Automatic deploy ordering: Explains how the k8s play derives Traefik and Authelia dependency edges from templates, and when to declare explicit depends_on entries. - Secrets and GitOps handling: Covers SOPS-encrypted secrets, stale Secret key cleanup, and the k8s_autodeploy declaration with the denylist re-render step for opted-out roles. - Use Case: You want to add a new self-hosted app to the cluster. Follow the Skill to create the role, register it in containers_list, add secrets, deploy with a tag, and verify the service behind Authelia rather than just the pod. ## Quick Start Use the new-k8s-service skill to add a service called 'linkding' to the k3s cluster and walk me through the role, inventory entry, secrets, and first deploy.

Frequently Asked Questions about new-k8s-service

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add a new service to a k3s cluster managed by Ansible?▼

Create a role under ansible/roles/k8s/<name>/ with tasks/main.yml and manifest templates, add the service to containers_list in host_vars with platform: k8s, add secrets to the SOPS-encrypted vars file, then deploy with ./scripts/deploy.sh --tags "<name>".

How is deploy ordering determined for k3s workloads in Ansible?▼

Ordering is derived automatically by a toposort filter: templates rendering a Traefik IngressRoute get an edge onto traefik, and entries with use_authelia: true get one onto authelia. Declare depends_on only for constraints no template carries.

When should a service run as a Docker container instead of a k3s workload?▼

Only services that must run on the LAN-only Raspberry Pi, such as WireGuard or LAN utilities, use a Docker Compose role. The other hosts have no Docker installed, so a Compose role there deploys nothing.

Why does kubectl apply leave stale Secret keys behind?▼

kubectl apply does not remove keys deleted from a Secret manifest; the old keys persist in the live object. You must patch the removed key out explicitly and verify the result.

Why does a dry-run deploy pass but the new service never starts?▼

Dry-run skips the volume-claim task and admission never verifies that a referenced PVC exists, so the Deployment validates while the volume is unproven. Scheduling, PVC binding, and probes require a real deploy verified with a health probe.

What happens if a role does not declare k8s_autodeploy?▼

The k8s_autodeploy filter plugin raises at template time when a role declares nothing, failing the gitops_deploy tag run. Every role must declare true or false with a reason so the auto-deploy denylist is reviewable.