@stella-studio/ck 1.0.0

package/.claude/skills/devops/references/kubernetes-helm-advanced.md

@@ -0,0 +1,75 @@
+# Helm Advanced - Templates & Hooks
+
+## Template Variables
+```yaml
+# templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "mychart.fullname" . }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  template:
+    spec:
+      containers:
+      - name: {{ .Chart.Name }}
+        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+        {{- if .Values.resources }}
+        resources:
+          {{- toYaml .Values.resources | nindent 10 }}
+        {{- end }}
+```
+
+## Helper Templates
+```yaml
+# templates/_helpers.tpl
+{{- define "mychart.fullname" -}}
+{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "mychart.labels" -}}
+app.kubernetes.io/name: {{ .Chart.Name }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+```
+
+## Hooks
+```yaml
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "{{ .Release.Name }}-post-install"
+  annotations:
+    "helm.sh/hook": post-install
+    "helm.sh/hook-delete-policy": hook-succeeded
+spec:
+  template:
+    spec:
+      containers:
+      - name: post-install
+        command: ["/bin/sh", "-c", "echo 'Done'"]
+      restartPolicy: Never
+```
+
+Hook types: `pre-install`, `post-install`, `pre-upgrade`, `post-upgrade`
+
+## Packaging
+```bash
+helm package mychart
+helm repo index . --url https://charts.example.com
+helm push mychart-1.0.0.tgz oci://registry.example.com/helm
+helm repo add myrepo https://charts.example.com
+helm install myapp myrepo/mychart
+```
+
+## Commands
+
+| Command | Purpose |
+|---------|---------|
+| `helm create` | Create |
+| `helm lint` | Validate |
+| `helm template` | Render |
+| `helm install` | Deploy |
+| `helm upgrade` | Update |
+| `helm rollback` | Revert |
+| `helm uninstall` | Remove |

package/.claude/skills/devops/references/kubernetes-helm.md

@@ -0,0 +1,81 @@
+# Helm Package Management
+
+## Core Concepts
+
+- **Chart:** Helm package with K8s resource definitions
+- **Repository:** Collection of charts
+- **Release:** Deployed instance of a chart
+- **Values:** Configuration that parameterizes charts
+
+## Chart Structure
+
+```
+mychart/
+├── Chart.yaml              # Metadata
+├── values.yaml             # Default values
+├── charts/                 # Dependencies
+├── templates/
+│   ├── deployment.yaml
+│   ├── service.yaml
+│   ├── _helpers.tpl       # Template helpers
+│   └── NOTES.txt
+└── values.schema.json     # Validation (optional)
+```
+
+## Essential Commands
+
+```bash
+helm create mychart           # Create chart
+helm lint mychart             # Validate
+helm template myrelease ./mychart  # Render locally
+helm install myrelease ./mychart --dry-run --debug  # Preview
+
+helm install myrelease ./mychart
+helm install myrelease ./mychart -f values-prod.yaml
+helm install myrelease ./mychart --set replicaCount=3
+
+helm upgrade myrelease ./mychart
+helm rollback myrelease 1
+helm list
+helm uninstall myrelease
+```
+
+## Multi-Environment
+
+```bash
+# Files: values.yaml, values-dev.yaml, values-prod.yaml
+helm install myapp ./mychart -f values.yaml -f values-prod.yaml
+helm install myapp ./mychart --set replicaCount=3 --set image.tag=v1.2.3
+```
+
+## values.yaml Example
+
+```yaml
+replicaCount: 2
+image:
+  repository: myapp
+  tag: "1.0.0"
+  pullPolicy: IfNotPresent
+service:
+  type: ClusterIP
+  port: 8080
+resources:
+  limits: { cpu: 500m, memory: 512Mi }
+  requests: { cpu: 250m, memory: 256Mi }
+```
+
+## Dependencies
+
+```yaml
+# Chart.yaml
+dependencies:
+  - name: postgresql
+    version: "12.1.0"
+    repository: "https://charts.bitnami.com/bitnami"
+```
+
+```bash
+helm dependency update mychart
+```
+
+See `kubernetes-helm-advanced.md` for templates, hooks, and packaging.

package/.claude/skills/devops/references/kubernetes-kubectl.md

@@ -0,0 +1,74 @@
+# kubectl Essential Commands
+
+## Cluster & Node
+```bash
+kubectl cluster-info
+kubectl get nodes
+kubectl describe node <node-name>
+kubectl top nodes
+kubectl drain <node-name> --ignore-daemonsets
+kubectl uncordon <node-name>
+```
+
+## Pod Operations
+```bash
+kubectl get pods -A                     # All namespaces
+kubectl get pods -o wide                # Extended info
+kubectl describe pod <pod-name>
+kubectl logs <pod-name>
+kubectl logs -f <pod-name>              # Follow
+kubectl logs --previous <pod-name>      # Previous crash
+kubectl exec -it <pod-name> -- /bin/bash
+```
+
+## Deployment
+```bash
+kubectl apply -f manifest.yaml
+kubectl apply -f ./manifests/
+kubectl apply -f manifest.yaml --dry-run=client -o yaml  # Preview
+kubectl set image deployment/myapp app=myapp:v2
+kubectl delete -f manifest.yaml
+```
+
+## Service & Network
+```bash
+kubectl port-forward service/myapp 8080:8080
+kubectl get svc
+kubectl exec -it <pod-name> -- curl http://service:8080
+kubectl exec -it <pod-name> -- nslookup kubernetes.default
+```
+
+## Debugging (Get → Describe → Logs)
+```bash
+kubectl get pods -o wide
+kubectl get events -n <ns> --sort-by='.lastTimestamp'
+kubectl describe pod <pod-name>
+kubectl logs <pod-name> -c <container>
+```
+
+## Output & Filtering
+```bash
+kubectl get pods -o json
+kubectl get pods -o yaml
+kubectl get pods -l app=myapp,tier=frontend
+kubectl get pods --field-selector=status.phase=Running
+kubectl get pods -w                     # Watch
+```
+
+## Flags
+
+| Flag | Purpose |
+|------|---------|
+| `-n` | Namespace |
+| `-A` | All namespaces |
+| `-o` | Output format |
+| `-l` | Label selector |
+| `-w` | Watch |
+
+## Aliases
+```bash
+alias k='kubectl'
+alias kgp='kubectl get pods'
+alias kd='kubectl describe'
+alias kl='kubectl logs'
+```

package/.claude/skills/devops/references/kubernetes-security-advanced.md

@@ -0,0 +1,98 @@
+# Kubernetes Security Advanced
+
+## ClusterRole (cluster-wide)
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: secret-reader
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get"]
+  resourceNames: ["app-credentials"]  # Restrict to specific
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: admin-binding
+subjects:
+- kind: User
+  name: admin@example.com
+  apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: ClusterRole
+  name: cluster-admin
+  apiGroup: rbac.authorization.k8s.io
+```
+
+## Secrets Management
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: db-credentials
+type: Opaque
+stringData:
+  username: admin
+  password: secretpassword
+```
+
+### Mount as env
+```yaml
+env:
+- name: DB_PASSWORD
+  valueFrom:
+    secretKeyRef:
+      name: db-credentials
+      key: password
+```
+
+### Mount as volume
+```yaml
+volumeMounts:
+- name: secret-volume
+  mountPath: /etc/secrets
+  readOnly: true
+volumes:
+- name: secret-volume
+  secret:
+    secretName: db-credentials
+```
+
+## Allow DNS (Required for most apps)
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-dns
+spec:
+  podSelector: {}
+  policyTypes: [Egress]
+  egress:
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          name: kube-system
+    ports:
+    - { protocol: UDP, port: 53 }
+```
+
+## Security Checklist
+
+- [ ] RBAC with least-privilege roles
+- [ ] Pod Security Standards (restricted)
+- [ ] Network policies (default-deny + explicit allow)
+- [ ] Run containers as non-root
+- [ ] Read-only root filesystem
+- [ ] Drop all capabilities
+- [ ] Secrets for sensitive data
+- [ ] Image scanning enabled
+- [ ] Private container registry
+- [ ] Resource quotas and limits
+- [ ] Audit logging enabled
+- [ ] Regular credential rotation

package/.claude/skills/devops/references/kubernetes-security.md

@@ -0,0 +1,95 @@
+# Kubernetes Security
+
+## RBAC (Role-Based Access Control)
+
+### Role (namespace-scoped)
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: default
+  name: pod-reader
+rules:
+- apiGroups: [""]
+  resources: ["pods", "pods/log"]
+  verbs: ["get", "list", "watch"]
+```
+
+### RoleBinding
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: read-pods
+  namespace: default
+subjects:
+- kind: ServiceAccount
+  name: my-app-sa
+  namespace: default
+roleRef:
+  kind: Role
+  name: pod-reader
+  apiGroup: rbac.authorization.k8s.io
+```
+
+### Verify Permissions
+```bash
+kubectl auth can-i get pods --as=system:serviceaccount:default:my-sa
+kubectl get roles,rolebindings -n default
+```
+
+## Pod Security (Restricted)
+
+```yaml
+spec:
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 1000
+    seccompProfile:
+      type: RuntimeDefault
+  containers:
+  - name: app
+    securityContext:
+      allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
+      capabilities:
+        drop: ["ALL"]
+```
+
+Enable on namespace:
+```bash
+kubectl label namespace default \
+  pod-security.kubernetes.io/enforce=restricted
+```
+
+## Network Policies
+
+### Default Deny
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny-all
+spec:
+  podSelector: {}
+  policyTypes: [Ingress, Egress]
+```
+
+### Allow Specific
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-frontend-to-backend
+spec:
+  podSelector:
+    matchLabels: { app: backend }
+  ingress:
+  - from:
+    - podSelector:
+        matchLabels: { app: frontend }
+    ports:
+    - { protocol: TCP, port: 8080 }
+```
+
+See `kubernetes-security-advanced.md` for secrets, ClusterRoles, and checklist.

package/.claude/skills/devops/references/kubernetes-troubleshooting-advanced.md

@@ -0,0 +1,74 @@
+# Kubernetes Troubleshooting Advanced
+
+## Node Issues
+```bash
+kubectl describe node <node-name> | grep -A 5 "Conditions:"
+kubectl top node <node-name>
+kubectl top pods -A --sort-by=memory
+kubectl drain <node-name> --ignore-daemonsets
+kubectl uncordon <node-name>
+```
+
+## CrashLoopBackOff
+```bash
+kubectl logs <pod-name> --previous
+kubectl describe pod <pod-name>
+kubectl get pod <pod-name> -o yaml | grep -A 5 resources:
+```
+
+## HPA
+```yaml
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: myapp
+  minReplicas: 2
+  maxReplicas: 10
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      target:
+        type: Utilization
+        averageUtilization: 70
+```
+
+## Anti-Patterns
+
+**Using `latest` tag:**
+```yaml
+# ❌ image: myapp:latest
+# ✅ image: myapp:v1.2.3
+```
+
+**Missing resources:**
+```yaml
+# ✅ Always set
+resources:
+  requests: { memory: "256Mi", cpu: "250m" }
+  limits: { memory: "512Mi", cpu: "500m" }
+```
+
+**Missing health checks:**
+```yaml
+livenessProbe:
+  httpGet: { path: /health, port: 8080 }
+readinessProbe:
+  httpGet: { path: /ready, port: 8080 }
+```
+
+**Running as root:**
+```yaml
+securityContext:
+  runAsNonRoot: true
+  runAsUser: 1000
+```
+
+## Monitoring
+```bash
+helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
+helm install prometheus prometheus-community/kube-prometheus-stack -n monitoring
+```

package/.claude/skills/devops/references/kubernetes-troubleshooting.md

@@ -0,0 +1,49 @@
+# Kubernetes Troubleshooting
+
+## Debugging Workflow
+
+```bash
+# 1. Overview
+kubectl get pods -o wide
+kubectl get events -n <namespace> --sort-by='.lastTimestamp'
+
+# 2. Details
+kubectl describe pod <pod-name>
+
+# 3. Logs
+kubectl logs <pod-name>
+kubectl logs <pod-name> --previous  # Crashed instance
+kubectl logs <pod-name> -c <container>
+```
+
+## Common Pod States
+
+| State | Cause | Solution |
+|-------|-------|----------|
+| Pending | No node resources | Check node capacity |
+| ContainerCreating | Image pulling | Check image URI |
+| CrashLoopBackOff | Container exits | Check logs, health checks |
+| ImagePullBackOff | Failed image pull | Verify credentials |
+| OOMKilled (137) | Out of memory | Increase memory limit |
+
+## Service & Network
+
+```bash
+kubectl exec -it <pod-name> -- nslookup kubernetes.default
+kubectl exec -it <pod-name> -- curl http://myservice:8080
+kubectl get endpoints <service-name>
+kubectl port-forward service/myservice 8080:8080
+kubectl get networkpolicies -A
+```
+
+## Quick Fixes
+
+| Problem | Command |
+|---------|---------|
+| Pod stuck | `kubectl delete pod <name> --grace-period=0 --force` |
+| High CPU | `kubectl top pods -A --sort-by=cpu` |
+| High memory | `kubectl top pods -A --sort-by=memory` |
+| Restart | `kubectl rollout restart deployment/<name>` |
+| Rollback | `kubectl rollout undo deployment/<name>` |
+
+See `kubernetes-troubleshooting-advanced.md` for node issues, HPA, anti-patterns.

package/.claude/skills/devops/references/kubernetes-workflows-advanced.md

@@ -0,0 +1,75 @@
+# Kubernetes Workflows Advanced
+
+## CI/CD Pipeline
+```yaml
+# GitHub Actions
+name: Build and Deploy
+on:
+  push:
+    branches: [main]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - run: docker build . -t $REGISTRY/$IMAGE:${{ github.sha }}
+    - run: docker push $REGISTRY/$IMAGE:${{ github.sha }}
+
+  deploy:
+    needs: build
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        repository: myorg/gitops-repo
+        token: ${{ secrets.GITOPS_TOKEN }}
+    - run: |
+        sed -i 's|image:.*|image: $REGISTRY/$IMAGE:${{ github.sha }}|' k8s/deployment.yaml
+        git commit -am "Update image" && git push
+```
+
+## Kustomize
+
+```
+kustomize/
+├── base/
+│   ├── kustomization.yaml
+│   └── deployment.yaml
+└── overlays/
+    └── prod/
+        └── kustomization.yaml
+```
+
+### Base
+```yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- deployment.yaml
+commonLabels:
+  app: myapp
+```
+
+### Prod Overlay
+```yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+bases:
+- ../../base
+replicas:
+- name: myapp
+  count: 5
+```
+
+```bash
+kubectl apply -k overlays/prod/
+```
+
+## Flux CD
+```bash
+flux bootstrap github \
+  --owner=myorg \
+  --repository=fleet-infra \
+  --branch=main \
+  --path=clusters/my-cluster
+```

package/.claude/skills/devops/references/kubernetes-workflows.md

@@ -0,0 +1,78 @@
+# Kubernetes Workflows
+
+## GitOps Architecture
+
+```
+Git Repository (desired state)
+         │ Watches
+         ▼
+GitOps Agent (Argo CD / Flux)
+         │ Syncs
+         ▼
+Kubernetes Cluster (actual state)
+```
+
+**Benefits:** Single source of truth, auditable, automated, easy rollback
+
+## Argo CD Setup
+
+```bash
+kubectl create namespace argocd
+kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
+kubectl port-forward svc/argocd-server -n argocd 8080:443
+kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d
+```
+
+### Application Manifest
+```yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: myapp
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/myorg/myapp
+    targetRevision: HEAD
+    path: k8s/manifests
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: default
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+```
+
+## Deployment Patterns
+
+### Rolling Update
+```yaml
+spec:
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+```
+
+### Blue-Green
+```yaml
+# Two deployments: myapp-blue, myapp-green
+# Service selector switches between versions
+selector:
+  app: myapp
+  version: blue  # Change to 'green' to switch
+```
+
+### Canary (with Istio)
+```yaml
+route:
+- destination: { host: myapp, subset: v1 }
+  weight: 90
+- destination: { host: myapp, subset: v2 }
+  weight: 10  # 10% canary
+```
+
+See `kubernetes-workflows-advanced.md` for CI/CD, Kustomize patterns.