The Complete Production SOP: How to Deploy and Run Fairwinds Polaris Kubernetes Best Practices Auditing in Autonomous AI Agents
Production SOP to install and run Fairwinds Polaris Kubernetes Best Practices Auditing in Codex, Claude Code, and Cursor with automated compliance gates.
Technical Overview & Architectural Context
Autonomous coding agents frequently generate syntactically valid Kubernetes manifests that introduce critical security and reliability flaws in production. Left unguided, LLMs routinely omit resource limits, neglect liveness and readiness probes, configure permissive SecurityContext parameters (such as running containers as root or allowing privilege escalation), and unintentionally expose host namespaces through hostNetwork or hostPID. These subtle anti-patterns pass standard kubectl dry-run validations but trigger critical severity findings in security audits and destabilize cluster schedulers. The Fairwinds Polaris Kubernetes Best Practices Auditing skill establishes deterministic guardrails for AI agents by operationalizing the Fairwinds Polaris compliance engine. Instead of relying on open-ended prompt guidance, this skill forces the agent to validate manifests against strict Pod Security Standards (PSS), calculate quantitative workload health scores, and apply prescriptive remediations directly to container configurations. By bounding file writes to the workspace and mandating automated Polaris audit gates before committing changes, the skill prevents insecure workload deployments while conserving context tokens.
Prerequisites & Environment Requirements
Verified Search Intents & Long-Tail Queries Solved
This operational tutorial is engineered to provide deterministic solutions for these developer search queries:
Step-by-Step Execution Playbook
Local Environment Setup & SKILL.md Mounting
Mount the skill manifest into your agent runtime's global or workspace-level skill registry.
To make the Polaris auditing rules discoverable by autonomous agents, mount the SKILL.md specification into your project's `.agents/skills` or `.cursor/rules` directory. Runtime agents like Claude Code and Codex parse the YAML frontmatter on initialization to register execution boundaries, permissions, and natural language triggers.
mkdir -p .agents/skills/polaris-k8s-best-practices && curl -fsSL https://askills.dev/api/skills/polaris-k8s-best-practices/raw -o .agents/skills/polaris-k8s-best-practices/SKILL.md---
name: "polaris-k8s-best-practices"
description: "Validate Kubernetes workloads against security, efficiency, and reliability standards."
metadata:
author: "Fairwinds"
version: "1.0.0"
runtime_compatibility:
- "codex"
- "claude-code"
- "cursor"
- "windsurf"
triggers:
- "audit kubernetes with polaris"
- "check pod security polaris"
- "improve polaris cluster score"
permissions:
fs_read: true
fs_write: "workspace"
shell_exec: true
net_access: false
---
# Fairwinds Polaris Kubernetes Best Practices Auditing
## Execution SOP & Rules
1. Run `polaris audit --audit-path <path> --format json` to calculate baseline score.
2. Remediate all `danger` severity items: configure `readinessProbe`, `livenessProbe`, drop all capabilities, set `readOnlyRootFilesystem: true`, and define resource `limits`/`requests`.
3. Disallow `hostNetwork`, `hostPID`, and `hostIPC` across workload specifications.
4. Re-run audit to ensure score is >= 95% and no danger findings remain.Direct the agent to output Polaris results in JSON (`--format json`) rather than human-readable text to minimize token consumption when reading audit reports.
Ensure `fs_write` is limited to 'workspace' to prevent the agent from accidentally writing Polaris dashboard artifacts into protected host paths.
Polaris CLI Binary & Configuration Verification
Ensure the Polaris CLI binary is available within the agent's execution PATH and inject baseline configurations.
Autonomous agents require the underlying CLI binary to execute deterministic linting. Verify the Polaris binary installation and configure a `.polaris.yaml` config file in the repository root specifying custom thresholds and exemption lists.
polaris version || (curl -L https://github.com/FairwindsOps/polaris/releases/latest/download/polaris_linux_amd64.tar.gz | tar -xz polaris && sudo mv polaris /usr/local/bin/)Create a minimal `.polaris.yaml` file that disables checks that do not apply to your specific infrastructure (e.g., ingress checks if handling pure backend workloads) to avoid false-positive hallucinations.
Do not pass network-reliant flags like `--audit-hosts` when running in hermetic or air-gapped sandboxes; strictly point `--audit-path` to local manifest directories.
Intent Matching & Trigger Invocation
Trigger deterministic workload evaluation using matched natural language prompts in your IDE agent.
Invoke the skill by passing one of the registered trigger phrases in your agent prompt session. The agent runtime matches the intent against the frontmatter declarations and loads the execution SOP into context before touching manifest files.
Prefix prompts with explicit commands like 'audit kubernetes with polaris' to skip the intent disambiguation phase and guarantee immediate SOP execution.
Avoid vague instructions like 'make this deployment safer' which might cause agents to apply generic changes instead of adhering to the Polaris standard.
Verification, Linting & Output Quality Gate
Enforce the Polaris verification gate to ensure zero danger-level findings and score compliance.
Instruct the agent to validate its own edits by re-running the Polaris audit command. The agent must verify that the process exits with status code 0 and that the overall cluster compliance score meets the repository standard before finishing the task.
polaris audit --audit-path manifests/ --set-exit-code-below-score 95 --set-exit-code-on-dangerAdd `--set-exit-code-on-danger` to local CI loops so the agent's verification gate mirrors your GitHub Actions or GitLab CI pipeline exactly.
Inspect git diffs manually if the agent adds overly generous resource requests (e.g., 8 CPU cores) simply to clear Polaris efficiency warnings.
Real-World Scenario: Remediating an Insecure Microservice Deployment Manifest
“check pod security polaris on manifests/payment-service.yaml, fix all security context and probe vulnerabilities, and improve polaris cluster score above 95.”
Runtime Troubleshooting & Failure Modes
Root Cause: The agent workspace sandbox is missing the Polaris CLI binary, or the binary is installed in a path outside the agent shell's PATH variable.
export PATH="$PATH:/usr/local/bin:$HOME/bin" && which polaris || curl -s https://api.github.com/repos/FairwindsOps/polaris/releases/latest | grep browser_download_url | grep linux_amd64.tar.gz | cut -d '"' -f 4 | wget -qi - && tar -xzf polaris*.tar.gz && mv polaris /usr/local/bin/Root Cause: Workload manifests still contain critical security violations such as missing readOnlyRootFilesystem, root user UID, or empty securityContext.
yq eval '.spec.template.spec.containers[].securityContext.readOnlyRootFilesystem = true | .spec.template.spec.containers[].securityContext.runAsNonRoot = true' -i manifests/*.yamlFrequently Asked Questions (Fairwinds Polaris Kubernetes Best Practices Auditing SOP)
Q:Can I use Fairwinds Polaris Kubernetes Best Practices Auditing across Codex, Claude Code, and Cursor simultaneously?
Yes. The skill conforms to the universal SKILL.md specification. You can place the file in the shared `.agents/skills/` directory or symlink it into runtime-specific directories such as `.cursor/rules/polaris.mdc` or Claude Code settings.
Q:How does Fairwinds Polaris Kubernetes Best Practices Auditing prevent context window overflow during long agent sessions?
The skill enforces structured JSON output and targeted audit paths (`--audit-path manifests/`), ensuring the agent receives structured telemetry instead of sprawling terminal dumps. This prevents context saturation across multi-turn refactorings.
Q:Does this skill require escalated root or container permissions?
No. The skill is audited with a security score of 98/100. It performs static analysis on Kubernetes manifests using filesystem read and workspace-scoped write permissions without requiring direct cluster admin access or host socket mounts.
Ready to equip your autonomous agent with Fairwinds Polaris Kubernetes Best Practices Auditing?
Copy the complete audited SKILL.md specification or download the 1-click zip bundle directly from our verified registry.