aigroup-workflow 2.1.2 → 2.2.0

package/skills/infra/kubernetes-specialist/SKILL.md

@@ -0,0 +1,241 @@
+---
+name: kubernetes-specialist
+description: Use when deploying or managing Kubernetes workloads. Invoke to create deployment manifests, configure pod security policies, set up service accounts, define network isolation rules, debug pod crashes, analyze resource limits, inspect container logs, or right-size workloads. Use for Helm charts, RBAC policies, NetworkPolicies, storage configuration, performance optimization, GitOps pipelines, and multi-cluster management.
+license: MIT
+metadata:
+  author: https://github.com/Jeffallan
+  version: "1.1.1"
+  domain: infrastructure
+  triggers: Kubernetes, K8s, kubectl, Helm, container orchestration, pod deployment, RBAC, NetworkPolicy, Ingress, StatefulSet, Operator, CRD, CustomResourceDefinition, ArgoCD, Flux, GitOps, Istio, Linkerd, service mesh, multi-cluster, cost optimization, VPA, spot instances
+  role: specialist
+  scope: infrastructure
+  output-format: manifests
+  related-skills: devops-engineer, cloud-architect, sre-engineer, terraform-engineer, security-reviewer, chaos-engineer
+---
+
+# Kubernetes Specialist
+
+## When to Use This Skill
+
+- Deploying workloads (Deployments, StatefulSets, DaemonSets, Jobs)
+- Configuring networking (Services, Ingress, NetworkPolicies)
+- Managing configuration (ConfigMaps, Secrets, environment variables)
+- Setting up persistent storage (PV, PVC, StorageClasses)
+- Creating Helm charts for application packaging
+- Troubleshooting cluster and workload issues
+- Implementing security best practices
+
+## Core Workflow
+
+1. **Analyze requirements** — Understand workload characteristics, scaling needs, security requirements
+2. **Design architecture** — Choose workload types, networking patterns, storage solutions
+3. **Implement manifests** — Create declarative YAML with proper resource limits, health checks
+4. **Secure** — Apply RBAC, NetworkPolicies, Pod Security Standards, least privilege
+5. **Validate** — Run `kubectl rollout status`, `kubectl get pods -w`, and `kubectl describe pod <name>` to confirm health; roll back with `kubectl rollout undo` if needed
+
+## Reference Guide
+
+Load detailed guidance based on context:
+
+| Topic | Reference | Load When |
+|-------|-----------|-----------|
+| Workloads | `references/workloads.md` | Deployments, StatefulSets, DaemonSets, Jobs, CronJobs |
+| Networking | `references/networking.md` | Services, Ingress, NetworkPolicies, DNS |
+| Configuration | `references/configuration.md` | ConfigMaps, Secrets, environment variables |
+| Storage | `references/storage.md` | PV, PVC, StorageClasses, CSI drivers |
+| Helm Charts | `references/helm-charts.md` | Chart structure, values, templates, hooks, testing, repositories |
+| Troubleshooting | `references/troubleshooting.md` | kubectl debug, logs, events, common issues |
+| Custom Operators | `references/custom-operators.md` | CRD, Operator SDK, controller-runtime, reconciliation |
+| Service Mesh | `references/service-mesh.md` | Istio, Linkerd, traffic management, mTLS, canary |
+| GitOps | `references/gitops.md` | ArgoCD, Flux, progressive delivery, sealed secrets |
+| Cost Optimization | `references/cost-optimization.md` | VPA, HPA tuning, spot instances, quotas, right-sizing |
+| Multi-Cluster | `references/multi-cluster.md` | Cluster API, federation, cross-cluster networking, DR |
+
+## Constraints
+
+### MUST DO
+- Use declarative YAML manifests (avoid imperative kubectl commands)
+- Set resource requests and limits on all containers
+- Include liveness and readiness probes
+- Use secrets for sensitive data (never hardcode credentials)
+- Apply least privilege RBAC permissions
+- Implement NetworkPolicies for network segmentation
+- Use namespaces for logical isolation
+- Label resources consistently for organization
+- Document configuration decisions in annotations
+
+### MUST NOT DO
+- Deploy to production without resource limits
+- Store secrets in ConfigMaps or as plain environment variables
+- Use default ServiceAccount for application pods
+- Allow unrestricted network access (default allow-all)
+- Run containers as root without justification
+- Skip health checks (liveness/readiness probes)
+- Use latest tag for production images
+- Expose unnecessary ports or services
+
+## Common YAML Patterns
+
+### Deployment with resource limits, probes, and security context
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-app
+  namespace: my-namespace
+  labels:
+    app: my-app
+    version: "1.2.3"
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+        version: "1.2.3"
+    spec:
+      serviceAccountName: my-app-sa   # never use default SA
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 2000
+      containers:
+        - name: my-app
+          image: my-registry/my-app:1.2.3   # never use latest
+          ports:
+            - containerPort: 8080
+          resources:
+            requests:
+              cpu: "100m"
+              memory: "128Mi"
+            limits:
+              cpu: "500m"
+              memory: "512Mi"
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          envFrom:
+            - secretRef:
+                name: my-app-secret   # pull credentials from Secret, not ConfigMap
+```
+
+### Minimal RBAC (least privilege)
+
+```yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: my-app-sa
+  namespace: my-namespace
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: my-app-role
+  namespace: my-namespace
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list"]   # grant only what is needed
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: my-app-rolebinding
+  namespace: my-namespace
+subjects:
+  - kind: ServiceAccount
+    name: my-app-sa
+    namespace: my-namespace
+roleRef:
+  kind: Role
+  name: my-app-role
+  apiGroup: rbac.authorization.k8s.io
+```
+
+### NetworkPolicy (default-deny + explicit allow)
+
+```yaml
+# Deny all ingress and egress by default
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny-all
+  namespace: my-namespace
+spec:
+  podSelector: {}
+  policyTypes: ["Ingress", "Egress"]
+---
+# Allow only specific traffic
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-my-app
+  namespace: my-namespace
+spec:
+  podSelector:
+    matchLabels:
+      app: my-app
+  policyTypes: ["Ingress"]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: frontend
+      ports:
+        - protocol: TCP
+          port: 8080
+```
+
+## Validation Commands
+
+After deploying, verify health and security posture:
+
+```bash
+# Watch rollout complete
+kubectl rollout status deployment/my-app -n my-namespace
+
+# Stream pod events to catch crash loops or image pull errors
+kubectl get pods -n my-namespace -w
+
+# Inspect a specific pod for failures
+kubectl describe pod <pod-name> -n my-namespace
+
+# Check container logs
+kubectl logs <pod-name> -n my-namespace --previous   # use --previous for crashed containers
+
+# Verify resource usage vs. limits
+kubectl top pods -n my-namespace
+
+# Audit RBAC permissions for a service account
+kubectl auth can-i --list --as=system:serviceaccount:my-namespace:my-app-sa
+
+# Roll back a failed deployment
+kubectl rollout undo deployment/my-app -n my-namespace
+```
+
+## Output Templates
+
+When implementing Kubernetes resources, provide:
+1. Complete YAML manifests with proper structure
+2. RBAC configuration if needed (ServiceAccount, Role, RoleBinding)
+3. NetworkPolicy for network isolation
+4. Brief explanation of design decisions and security considerations

package/skills/infra/kubernetes-specialist/references/configuration.md

@@ -0,0 +1,452 @@
+# Kubernetes Configuration Management
+
+## ConfigMap Patterns
+
+### Basic ConfigMap
+
+```yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: app-config
+  namespace: production
+data:
+  # Simple key-value pairs
+  database.host: "postgres-service.database.svc.cluster.local"
+  database.port: "5432"
+  database.name: "appdb"
+
+  # Multi-line configuration
+  app.properties: |
+    server.port=8080
+    logging.level=INFO
+    cache.enabled=true
+    cache.ttl=3600
+
+  # JSON configuration
+  features.json: |
+    {
+      "featureA": true,
+      "featureB": false,
+      "maxConnections": 100
+    }
+
+  # YAML configuration
+  config.yaml: |
+    server:
+      port: 8080
+      timeout: 30s
+    database:
+      pool_size: 20
+      max_connections: 100
+```
+
+### ConfigMap from Files
+
+```bash
+# Create from literal values
+kubectl create configmap app-config \
+  --from-literal=database.host=postgres \
+  --from-literal=database.port=5432
+
+# Create from file
+kubectl create configmap nginx-config \
+  --from-file=nginx.conf
+
+# Create from directory
+kubectl create configmap app-configs \
+  --from-file=configs/
+```
+
+## Secret Patterns
+
+### Opaque Secret (Generic)
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: app-secrets
+  namespace: production
+type: Opaque
+stringData:
+  # Plain text (will be base64 encoded)
+  db-password: "MySecurePassword123!"
+  api-key: "sk-1234567890abcdef"
+  jwt-secret: "super-secret-jwt-key"
+data:
+  # Already base64 encoded
+  tls.crt: LS0tLS1CRUdJTi...
+  tls.key: LS0tLS1CRUdJTi...
+```
+
+### TLS Secret
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: example-tls
+  namespace: production
+type: kubernetes.io/tls
+stringData:
+  tls.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIDXTCCAkWgAwIBAgIJAKZ...
+    -----END CERTIFICATE-----
+  tls.key: |
+    -----BEGIN PRIVATE KEY-----
+    MIIEvQIBADANBgkqhkiG9w0B...
+    -----END PRIVATE KEY-----
+```
+
+### Docker Registry Secret
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: registry-credentials
+  namespace: production
+type: kubernetes.io/dockerconfigjson
+stringData:
+  .dockerconfigjson: |
+    {
+      "auths": {
+        "myregistry.io": {
+          "username": "myuser",
+          "password": "mypassword",
+          "email": "user@example.com",
+          "auth": "bXl1c2VyOm15cGFzc3dvcmQ="
+        }
+      }
+    }
+```
+
+### Basic Auth Secret
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: basic-auth
+  namespace: production
+type: kubernetes.io/basic-auth
+stringData:
+  username: admin
+  password: super-secret-password
+```
+
+### SSH Auth Secret
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ssh-key
+  namespace: production
+type: kubernetes.io/ssh-auth
+stringData:
+  ssh-privatekey: |
+    -----BEGIN OPENSSH PRIVATE KEY-----
+    b3BlbnNzaC1rZXktdjEAAAAABG5vbmUA...
+    -----END OPENSSH PRIVATE KEY-----
+```
+
+## Using ConfigMaps and Secrets
+
+### Environment Variables
+
+```yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: app-pod
+spec:
+  containers:
+  - name: app
+    image: myapp:latest
+    env:
+    # Single value from ConfigMap
+    - name: DATABASE_HOST
+      valueFrom:
+        configMapKeyRef:
+          name: app-config
+          key: database.host
+
+    # Single value from Secret
+    - name: DATABASE_PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: app-secrets
+          key: db-password
+
+    # All keys from ConfigMap as env vars
+    envFrom:
+    - configMapRef:
+        name: app-config
+      prefix: CONFIG_
+
+    # All keys from Secret as env vars
+    - secretRef:
+        name: app-secrets
+      prefix: SECRET_
+```
+
+### Volume Mounts
+
+```yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: app-pod
+spec:
+  containers:
+  - name: app
+    image: myapp:latest
+    volumeMounts:
+    # Mount entire ConfigMap as directory
+    - name: config-volume
+      mountPath: /etc/config
+      readOnly: true
+
+    # Mount specific key as file
+    - name: app-properties
+      mountPath: /etc/app/app.properties
+      subPath: app.properties
+      readOnly: true
+
+    # Mount Secret as files
+    - name: secrets-volume
+      mountPath: /etc/secrets
+      readOnly: true
+
+    # Mount TLS certificates
+    - name: tls-certs
+      mountPath: /etc/tls
+      readOnly: true
+
+  volumes:
+  - name: config-volume
+    configMap:
+      name: app-config
+
+  - name: app-properties
+    configMap:
+      name: app-config
+      items:
+      - key: app.properties
+        path: app.properties
+
+  - name: secrets-volume
+    secret:
+      secretName: app-secrets
+      defaultMode: 0400  # Read-only for owner
+
+  - name: tls-certs
+    secret:
+      secretName: example-tls
+```
+
+## Immutable ConfigMaps and Secrets
+
+```yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: immutable-config
+  namespace: production
+immutable: true
+data:
+  key: value
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: immutable-secret
+  namespace: production
+type: Opaque
+immutable: true
+stringData:
+  password: "MyPassword123"
+```
+
+## External Secrets Operator
+
+```yaml
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: app-secrets
+  namespace: production
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: aws-secrets-manager
+    kind: SecretStore
+  target:
+    name: app-secrets
+    creationPolicy: Owner
+  data:
+  - secretKey: db-password
+    remoteRef:
+      key: prod/database/password
+  - secretKey: api-key
+    remoteRef:
+      key: prod/api/key
+---
+apiVersion: external-secrets.io/v1beta1
+kind: SecretStore
+metadata:
+  name: aws-secrets-manager
+  namespace: production
+spec:
+  provider:
+    aws:
+      service: SecretsManager
+      region: us-east-1
+      auth:
+        jwt:
+          serviceAccountRef:
+            name: external-secrets-sa
+```
+
+## Sealed Secrets (GitOps)
+
+```yaml
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: app-secrets
+  namespace: production
+spec:
+  encryptedData:
+    db-password: AgBj8xK5...encrypted...base64
+    api-key: AgCY9mL2...encrypted...base64
+  template:
+    metadata:
+      name: app-secrets
+      namespace: production
+    type: Opaque
+```
+
+## Environment Variable Best Practices
+
+### Structured Environment Variables
+
+```yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: app
+spec:
+  containers:
+  - name: app
+    image: myapp:latest
+    env:
+    # Application settings
+    - name: APP_NAME
+      value: "my-application"
+    - name: APP_ENV
+      value: "production"
+    - name: APP_VERSION
+      value: "v1.2.0"
+
+    # Database configuration
+    - name: DB_HOST
+      valueFrom:
+        configMapKeyRef:
+          name: app-config
+          key: database.host
+    - name: DB_PORT
+      valueFrom:
+        configMapKeyRef:
+          name: app-config
+          key: database.port
+    - name: DB_NAME
+      valueFrom:
+        configMapKeyRef:
+          name: app-config
+          key: database.name
+    - name: DB_USER
+      valueFrom:
+        secretKeyRef:
+          name: app-secrets
+          key: db-username
+    - name: DB_PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: app-secrets
+          key: db-password
+
+    # Kubernetes metadata
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+    - name: POD_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.podIP
+    - name: NODE_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+
+    # Resource limits
+    - name: MEMORY_LIMIT
+      valueFrom:
+        resourceFieldRef:
+          containerName: app
+          resource: limits.memory
+    - name: CPU_REQUEST
+      valueFrom:
+        resourceFieldRef:
+          containerName: app
+          resource: requests.cpu
+```
+
+## Dynamic Configuration Updates
+
+```yaml
+apiVersion: v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    metadata:
+      annotations:
+        # Force pod restart on config change
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+    spec:
+      containers:
+      - name: app
+        image: myapp:latest
+        volumeMounts:
+        - name: config
+          mountPath: /etc/config
+          readOnly: true
+      volumes:
+      - name: config
+        configMap:
+          name: app-config
+```
+
+## Best Practices
+
+1. **Separation**: Use ConfigMaps for non-sensitive data, Secrets for credentials
+2. **Immutability**: Mark production configs as immutable for safety
+3. **Versioning**: Include version in ConfigMap/Secret names for updates
+4. **Least Privilege**: Mount secrets as files with restrictive permissions (0400)
+5. **External Secrets**: Use External Secrets Operator for cloud secret managers
+6. **No Hardcoding**: Never hardcode secrets in container images
+7. **Encryption**: Enable encryption at rest for Secrets in etcd
+8. **GitOps**: Use Sealed Secrets for safe GitOps workflows
+9. **Rotation**: Implement secret rotation strategies
+10. **Validation**: Validate configuration before deployment