@jetrabbits/agentic 0.0.1

package/areas/devops/networking/skills/dns-management/SKILL.md

@@ -0,0 +1,169 @@
+---
+name: dns-management
+type: skill
+description: DNS management for Kubernetes — CoreDNS tuning, external-dns automation, split-horizon DNS, and bare-metal DNS design.
+related-rules:
+  - network-segmentation.md
+allowed-tools: Read, Write, Edit, Bash
+---
+
+# Skill: DNS Management
+
+> **Expertise:** CoreDNS configuration, external-dns operator, split-horizon DNS, DNS debugging, bare-metal DNS topology.
+
+## When to load
+
+When services can't resolve DNS, setting up external-dns automation, configuring split-horizon, or designing DNS for a new cluster.
+
+## CoreDNS: Cluster DNS Configuration
+
+```yaml
+# ConfigMap: coredns (kube-system)
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: coredns
+  namespace: kube-system
+data:
+  Corefile: |
+    .:53 {
+      errors
+      health { lameduck 5s }
+      ready
+      
+      # Kubernetes in-cluster DNS
+      kubernetes cluster.local in-addr.arpa ip6.arpa {
+        pods insecure
+        fallthrough in-addr.arpa ip6.arpa
+        ttl 30
+      }
+      
+      # Forward internal domain to internal DNS server
+      internal.example.com {
+        forward . 192.168.10.53
+      }
+      
+      # Forward everything else to upstream resolvers
+      forward . 1.1.1.1 8.8.8.8 {
+        max_concurrent 1000
+        prefer_udp
+      }
+      
+      cache 300           # 5-minute DNS cache
+      loop                # detect forwarding loops
+      reload              # hot-reload ConfigMap changes
+      loadbalance         # round-robin DNS responses
+      
+      # Log DNS errors (not all queries — too noisy)
+      log . {
+        class error
+      }
+    }
+```
+
+## external-dns (Automated DNS Record Management)
+
+```yaml
+# external-dns reads Ingress/Service annotations and creates DNS records
+# Install:
+helm upgrade --install external-dns external-dns/external-dns \
+  -n kube-system \
+  -f external-dns-values.yaml
+
+# external-dns-values.yaml
+provider: cloudflare          # cloudflare, route53, hetzner, etc.
+env:
+  - name: CF_API_TOKEN
+    valueFrom:
+      secretKeyRef:
+        name: cloudflare-token
+        key: token
+
+sources:
+  - ingress
+  - service
+domainFilters:
+  - example.com
+policy: upsert-only           # never delete records (safer); use 'sync' to delete orphans
+txtOwnerId: prod-cluster      # unique per cluster — prevents multi-cluster conflicts
+interval: 1m
+```
+
+```yaml
+# Ingress: external-dns annotation (auto-creates DNS record)
+metadata:
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: api.example.com
+    external-dns.alpha.kubernetes.io/ttl: "300"
+```
+
+```yaml
+# Service (LoadBalancer): automatic DNS for MetalLB IP
+apiVersion: v1
+kind: Service
+metadata:
+  name: api-gateway
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: api.example.com
+spec:
+  type: LoadBalancer
+  # MetalLB assigns external IP → external-dns creates A record pointing to it
+```
+
+## Split-Horizon DNS (internal vs external)
+
+```
+External DNS (Cloudflare/Route53):
+  api.example.com → 203.0.113.10  (public load balancer IP)
+
+Internal DNS (CoreDNS custom zone):
+  api.example.com → 10.10.16.100  (internal load balancer, bypasses public internet)
+
+CoreDNS config for split-horizon:
+  api.example.com {
+    hosts {
+      10.10.16.100  api.example.com
+      fallthrough
+    }
+  }
+```
+
+## DNS Debugging
+
+```bash
+# Test DNS resolution from within cluster
+kubectl run -it --rm dns-debug \
+  --image=infoblox/dnstools \
+  --restart=Never -- /bin/sh
+
+# Inside the pod:
+dig api.example.com                           # external DNS
+dig payment-service.production.svc.cluster.local  # in-cluster DNS
+nslookup kubernetes.default.svc.cluster.local     # API server
+dig @10.96.0.10 payment-service.production        # query CoreDNS directly
+
+# Check CoreDNS is healthy
+kubectl get pods -n kube-system -l k8s-app=kube-dns
+kubectl logs -n kube-system -l k8s-app=kube-dns --tail=50
+
+# Debug DNS on a running pod (without kubectl exec)
+kubectl debug -it <pod> -n <ns> --image=infoblox/dnstools -- dig <hostname>
+
+# Enable DNS query logging temporarily (for debugging, then revert)
+# Add to Corefile: log . (logs ALL queries — high volume, use briefly)
+
+# Check /etc/resolv.conf in a pod
+kubectl exec -it <pod> -n <ns> -- cat /etc/resolv.conf
+# Expected: nameserver 10.96.0.10 (CoreDNS cluster IP)
+#           search <namespace>.svc.cluster.local svc.cluster.local cluster.local
+```
+
+## Common DNS Issues
+
+| Symptom | Cause | Fix |
+|:---|:---|:---|
+| `NXDOMAIN` for internal service | Wrong namespace in FQDN | Use `svc.namespace.svc.cluster.local` |
+| DNS timeout intermittent | CoreDNS overloaded | Increase replicas; add cache; check ndots |
+| Slow external DNS (> 2s) | ndots=5 causing unnecessary queries | Append `.` to FQDNs or set ndots=1 |
+| `connection refused` to external | Egress NetworkPolicy blocks port 53 | Add allow-dns-egress NetworkPolicy |
+| external-dns not creating records | txtOwnerId conflict with another cluster | Use unique txtOwnerId per cluster |

package/areas/devops/networking/skills/ingress-patterns/SKILL.md

@@ -0,0 +1,165 @@
+---
+name: ingress-patterns
+type: skill
+description: NGINX Ingress Controller patterns — TLS, rate limiting, CORS, rewrites, path-based routing, and MetalLB for bare-metal.
+related-rules:
+  - ingress-standards.md
+  - tls-policy.md
+allowed-tools: Read, Write, Edit
+---
+
+# Skill: Ingress Patterns
+
+> **Expertise:** NGINX Ingress Controller, MetalLB, cert-manager TLS, rate limiting, CORS, canary routing.
+
+## When to load
+
+When creating or reviewing Kubernetes Ingress resources, setting up TLS, configuring rate limits, or debugging 502/504 responses.
+
+## Standard Production Ingress
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: api-service
+  namespace: production
+  annotations:
+    # TLS + redirect
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+
+    # Rate limiting
+    nginx.ingress.kubernetes.io/limit-rps: "100"
+    nginx.ingress.kubernetes.io/limit-connections: "20"
+
+    # Timeouts (seconds)
+    nginx.ingress.kubernetes.io/proxy-connect-timeout: "10"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "60"
+
+    # TLS cert via cert-manager
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+
+    # Security headers
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+      add_header X-Frame-Options DENY always;
+      add_header X-Content-Type-Options nosniff always;
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts: [api.example.com]
+      secretName: api-example-com-tls
+  rules:
+    - host: api.example.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: api-service
+                port: { number: 80 }
+```
+
+## Path-Based Routing (API + Frontend)
+
+```yaml
+spec:
+  rules:
+    - host: example.com
+      http:
+        paths:
+          - path: /api
+            pathType: Prefix
+            backend:
+              service: { name: api-service, port: { number: 80 } }
+          - path: /
+            pathType: Prefix
+            backend:
+              service: { name: frontend, port: { number: 80 } }
+```
+
+## CORS Configuration
+
+```yaml
+annotations:
+  nginx.ingress.kubernetes.io/enable-cors: "true"
+  nginx.ingress.kubernetes.io/cors-allow-origin: "https://app.example.com"  # NOT *
+  nginx.ingress.kubernetes.io/cors-allow-methods: "GET, POST, PUT, DELETE, OPTIONS"
+  nginx.ingress.kubernetes.io/cors-allow-headers: "Authorization, Content-Type"
+  nginx.ingress.kubernetes.io/cors-allow-credentials: "true"
+```
+
+## Canary Routing (A/B / blue-green)
+
+```yaml
+# Primary ingress (stable)
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: api-stable
+  annotations:
+    nginx.ingress.kubernetes.io/canary: "false"
+spec: { ... }
+
+# Canary ingress (10% traffic)
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: api-canary
+  annotations:
+    nginx.ingress.kubernetes.io/canary: "true"
+    nginx.ingress.kubernetes.io/canary-weight: "10"   # 10% of traffic
+    # OR by header:
+    nginx.ingress.kubernetes.io/canary-by-header: "X-Canary"
+    nginx.ingress.kubernetes.io/canary-by-header-value: "true"
+spec: { ... }  # points to canary service
+```
+
+## MetalLB (Bare-Metal Load Balancer)
+
+```yaml
+# IPAddressPool — assign bare-metal IPs to LoadBalancer services
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: prod-pool
+  namespace: metallb-system
+spec:
+  addresses:
+    - 192.168.10.100-192.168.10.150
+
+---
+# L2Advertisement — announce IPs via ARP/NDP
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: l2-advert
+  namespace: metallb-system
+spec:
+  ipAddressPools: [prod-pool]
+```
+
+## Debugging Ingress Issues
+
+```bash
+# Check ingress controller logs
+kubectl logs -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx --tail=100
+
+# Verify ingress is configured correctly
+kubectl describe ingress <name> -n <ns>
+
+# Check endpoints (service selecting the right pods?)
+kubectl get endpoints <svc> -n <ns>
+
+# Test TLS
+curl -v https://api.example.com/health 2>&1 | grep "SSL\|TLS\|certificate"
+
+# Check cert-manager certificate status
+kubectl get certificate -n <ns>
+kubectl describe certificate <name> -n <ns>
+```

package/areas/devops/networking/skills/service-mesh/SKILL.md

@@ -0,0 +1,206 @@
+---
+name: service-mesh
+type: skill
+description: Implement service mesh for mTLS, traffic management, and observability — Istio and Linkerd patterns for Kubernetes.
+related-rules:
+  - network-segmentation.md
+  - tls-policy.md
+allowed-tools: Read, Write, Edit, Bash
+---
+
+# Skill: Service Mesh
+
+> **Expertise:** Istio and Linkerd installation, mTLS enforcement, traffic shifting, circuit breakers, retry policies, observability.
+
+## When to load
+
+When implementing service-to-service mTLS, traffic shifting for canary deploys, circuit breakers, or setting up mesh-level observability.
+
+## Linkerd (lightweight — recommended for bare-metal K8s)
+
+```bash
+# Install Linkerd CLI
+curl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/install | sh
+
+# Pre-flight check
+linkerd check --pre
+
+# Install Linkerd (cert-manager manages control plane certs)
+linkerd install --crds | kubectl apply -f -
+linkerd install \
+  --set identity.externalCA=true \
+  --set identity.issuer.scheme=kubernetes.io/tls \
+  | kubectl apply -f -
+
+# Install observability extension (Prometheus + Grafana)
+linkerd viz install | kubectl apply -f -
+
+# Verify
+linkerd check
+```
+
+## Linkerd: Inject Sidecar
+
+```yaml
+# Namespace-level injection (all pods in namespace get sidecar)
+metadata:
+  annotations:
+    linkerd.io/inject: enabled
+
+# Per-deployment injection
+spec:
+  template:
+    metadata:
+      annotations:
+        linkerd.io/inject: enabled
+
+# Skip injection for a specific pod (e.g., database, cronjob)
+metadata:
+  annotations:
+    linkerd.io/inject: disabled
+```
+
+## Linkerd: Traffic Policies
+
+```yaml
+# Retry policy (retry on 5xx up to 3 times)
+apiVersion: policy.linkerd.io/v1beta3
+kind: HTTPRoute
+metadata:
+  name: order-service-retries
+  namespace: production
+spec:
+  parentRefs:
+    - name: order-service
+      kind: Service
+      group: core
+      port: 8080
+  rules:
+    - filters:
+        - type: RequestRedirect   # or RequestMirror, URLRewrite
+      backendRefs:
+        - name: order-service
+          port: 8080
+
+---
+# Timeout policy
+apiVersion: policy.linkerd.io/v1alpha1
+kind: ServiceProfile
+metadata:
+  name: order-service.production.svc.cluster.local
+  namespace: production
+spec:
+  routes:
+    - name: POST /orders
+      condition:
+        method: POST
+        pathRegex: /orders
+      timeout: 5s
+      retryBudget:
+        retryRatio: 0.2       # retry up to 20% of requests
+        minRetriesPerSecond: 10
+        ttl: 10s
+```
+
+## Istio (full-featured — more complex)
+
+```bash
+# Install Istio with minimal profile (no telemetry addons)
+istioctl install --set profile=minimal -y
+
+# Verify
+istioctl verify-install
+kubectl get pods -n istio-system
+```
+
+```yaml
+# Enable sidecar injection for namespace
+kubectl label namespace production istio-injection=enabled
+
+# Strict mTLS (reject plaintext between injected services)
+apiVersion: security.istio.io/v1beta1
+kind: PeerAuthentication
+metadata:
+  name: default
+  namespace: production
+spec:
+  mtls:
+    mode: STRICT       # STRICT | PERMISSIVE | DISABLE
+
+---
+# AuthorizationPolicy: only allow order-service → payment-service
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  name: payment-service-authz
+  namespace: production
+spec:
+  selector:
+    matchLabels: { app: payment-service }
+  action: ALLOW
+  rules:
+    - from:
+        - source:
+            principals: ["cluster.local/ns/production/sa/order-service"]
+      to:
+        - operation:
+            methods: ["POST"]
+            paths: ["/charge"]
+```
+
+```yaml
+# Istio: traffic shifting (canary)
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: order-service
+  namespace: production
+spec:
+  hosts: [order-service]
+  http:
+    - route:
+        - destination:
+            host: order-service
+            subset: stable
+          weight: 90
+        - destination:
+            host: order-service
+            subset: canary
+          weight: 10
+---
+apiVersion: networking.istio.io/v1beta1
+kind: DestinationRule
+metadata:
+  name: order-service
+  namespace: production
+spec:
+  host: order-service
+  subsets:
+    - name: stable
+      labels: { version: stable }
+    - name: canary
+      labels: { version: canary }
+    trafficPolicy:
+      connectionPool:
+        tcp: { maxConnections: 100 }
+      outlierDetection:
+        consecutiveGatewayErrors: 5
+        interval: 10s
+        baseEjectionTime: 30s    # circuit breaker: eject after 5 errors
+```
+
+## Mesh Observability
+
+```bash
+# Linkerd: live traffic stats
+linkerd viz stat deploy -n production
+linkerd viz top deploy/order-service -n production
+linkerd viz tap deploy/order-service -n production
+
+# Linkerd: service topology
+linkerd viz edges deployment -n production
+
+# Istio: traffic analysis
+istioctl analyze -n production
+kubectl exec -it <pod> -c istio-proxy -n production -- pilot-agent request GET stats | grep upstream_cx
+```