Neb Standards K8s

Status Condition Reading

ALWAYS check status.conditions FIRST -- never poll high-level status fields.

# Ready condition
timeout 10s kubectl get <resource> <name> -n <ns> -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}'
# Synced condition (Crossplane)
timeout 10s kubectl get <resource> <name> -n <ns> -o jsonpath='{.status.conditions[?(@.type=="Synced")].status}'

Crossplane Provider Log Analysis

timeout 10s kubectl get pods -n crossplane-system -l pkg.crossplane.io/provider=provider-aws
timeout 30s kubectl logs -n crossplane-system -l pkg.crossplane.io/provider=provider-aws --tail=200 | \
  grep -iE "(error|fail|delete|cleanup|finalizer)" | tail -30

Common error patterns: CannotDeleteExternalResource, CannotCreateExternalResource, InvalidParameterException, AccessDeniedException, refuse to update (immutable field).

Stuck Resource Deletion

When a resource has deletionTimestamp but remains:

1. Check finalizers -- identify which controller owns the finalizer
2. Check provider pod logs -- look for deletion errors
3. Verify external resource state (AWS/GCP/Azure console or CLI)
4. Force delete (LAST RESORT ONLY) -- remove finalizers, then delete. Only when provider is permanently unavailable or external resource already cleaned up manually

No Validation Bypasses

NEVER use --force, --disable-openapi-validation, --skip-crds, or similar flags. If validation fails, investigate and fix the spec. Use kubectl apply --dry-run=server to validate before applying.

No Direct Cluster Writes

AI models MUST NOT write directly to clusters. All changes go through deployment processes:

• ArgoCD present: Commit to GitOps repo, let ArgoCD sync
• Helm without ArgoCD: helm template ... | kubectl apply -f -
• NEVER: kubectl apply -f resource.yaml, kubectl create, kubectl patch for changes

Exception -- Patch-First Debugging: When iterating on Helm chart changes for deployed resources, kubectl patch is permitted under strict conditions:

1. Disable ArgoCD auto-sync (prune + selfHeal) on the target app FIRST
2. Follow investigate -> patch -> verify cycle
3. Record all successful patches -- these become chart changes
4. After validation, update chart source in a single pass
5. Re-enable ArgoCD sync and verify it converges

This avoids burning CI cycles (minutes each) for changes testable in seconds.

Multi-Cloud Standards

Supported Providers

Tagging by Provider

AWS and Azure use dictionary tags. GCP uses list-format labels. On-prem uses K8s labels/annotations. Use the utils-common.tags.data helper with the appropriate tagsDataType (dict or list).

Resource Naming Conventions

• AWS: Kebab-case, include environment and region -- nebcore-vpc-prod-us-west-2
• GCP: Kebab-case, must start with lowercase -- nebcore-vpc-prod
• Azure: PascalCase with resource type identifiers -- NebcoreVnet-Prod

Provider Configuration Pattern