code-ai-installer 1.2.0 → 1.3.0

package/locales/en/.agents/docker_kubernetes_architecture/SKILL.md

@@ -1,144 +1,480 @@
 ---
 name: docker_kubernetes_architecture
-description: Containerization and Kubernetes architecture: Dockerfile best practices, k8s manifests, security, scaling, rollout, observability, CI/CD.
+description: Containerization and Kubernetes architecture — Dockerfile best practices, k8s manifests, security, scaling, rollout, observability, CI/CD.
 ---
 
 #Skill: Docker & Kubernetes Architecture
 
-## Goal
-Design and document containerization and deployment in Kubernetes so that:
-- the builds were reproducible and safe,
-- environments (dev/staging/prod) were consistent,
-- the application was scaled and updated without downtime (according to the chosen strategy),
-- there were clear runbooks, rollback and observability.
-
-## When to use
-- The project is deployed in Docker / Kubernetes (self-hosted, cloud k8s, on-prem).
-- There are microservices/multiple components.
-- Need horizontal scaling, HPA, blue-green/canary.
-- Strict security/compliance measures required.
-
-If the deployment will be without containers (Vercel-only, etc.), the skill is not required.
-
-## Inputs
-- Architecture Doc + ADR
-- Deployment/CI Plan
-- Non-functional requirements (SLA, perf, security, cost)
-- Tech stack (FE/BE/DB/queues)
-
-## Outputs (artifacts)
-- Containerization plan:
-  - basic Dockerfile rules and standards
-  - build/run strategy (multi-stage, non-root)
-- Kubernetes plan:
-  - namespaces, ingress, service, deployment/statefulset
-  - config/secrets strategy
-  - health probes, resources, autoscaling
-  - rollout/rollback strategy
-- Ops plan:
-  - logging/metrics/tracing
-  - backups/DR
-  - runbooks (deploy, rollback, incident)
-
-## Checklist: Docker (must)
-###Build
-- Multi-stage build (builder → runtime)
-- Reproducibility: lockfile + fixed versions
-- Minimum runtime image (alpine/distroless - as appropriate)
-- Cache-friendly layers (dependencies before sources)
-- SBOM/scan (if there is a pipeline)
-
-### Runtime security
-- Non-root user (USER), minimal rights
-- Read-only filesystem where possible
-- Do not copy secrets to image
-- Healthcheck (if applicable)
-- Clear separation of build args vs runtime env
-
-### Logging
-- Logs to stdout/stderr (12-factor)
-- No secrets/PII
-
-## Checklist: Kubernetes (must)
-### Workloads
-- Deployment for stateless services
-- StatefulSet for stateful (if it is impossible to place state in managed DB)
-- Separation by namespaces (dev/staging/prod)
-- Service (ClusterIP), Ingress/Gateway for external traffic
-
-### Health & Resilience
-- readinessProbe / livenessProbe are correct
-- startupProbe for a hard start
-- PodDisruptionBudget (if critical)
-- graceful shutdown (terminationGracePeriodSeconds)
-- retries/timeouts on clients
-
-### Resources & Scaling
-- requests/limits are defined
-- HPA by CPU/Memory and/or custom metrics (if necessary)
-- anti-affinity/topology spread (if HA)
-
-### Config & Secrets
-- ConfigMap for configs
-- Secrets only through k8s secrets / external secret managers (preferably)
-- Rotation strategy (especially for DB/3rd-party keys)
-- Do not log secrets
-- Split per-env values
-
-### Network & Access
-- NetworkPolicy (if the cluster supports it)
-- RBAC least privilege (service accounts)
-- Restrict access to metadata endpoints (if relevant)
-
-###Security posture
-- Pod Security Standards / admission policies (baseline/restricted)
-- Drop capabilities, seccompProfile, runAsNonRoot
-- ImagePullPolicy by release strategy
-- Image scanning (in CI) if possible
-
-### Rollout/Rollback
-- Strategy: RollingUpdate / Blue-Green / Canary (fix ADR)
-- MaxUnavailable/MaxSurge configured- Rollback plan is documented and realistically executable
-
-## Checklist: Observability (must)
-- Correlation id (request_id/trace_id)
-- Metrics (latency, errors, saturation)
-- Tracing (if provided)
-- Alerts (errors/latency/degradation)
-- Log retention (if required)
-
-## Checklist: Data & DR (if there is a DB/data)
-- Backups + retention
-- PITR (if necessary)
-- Recovery test (periodically)
-- RPO/RTO (if specified)
-
-## ADRs (must be recorded)
-Create ADR if selected/changed:
-- cluster/provider
-- rollout strategy (canary/blue-green)
-- ingress (nginx/traefik/gateway)
-- secrets manager
-- security policies (PSS/restricted)
-- scaling (HPA/metrics)
-
-## Red flags (P0/P1)
-🔴P0:
-- containers are launched by root
-- secrets got into image/repo
-- no readiness/liveness on critical services
-- no rollback plan for production deployment
-- there are no resource restrictions (requests/limits) and the service is critical
-
-🟠P1:
-- no HPA at expected load
-- no network policy/RBAC restrictions (if required)
-
-## Response format
-### Containerization Plan
-### Kubernetes Topology
-###Security Posture
-### Rollout/Rollback
+Containerization and orchestration: from Dockerfile to production K8s.
+
+**Sections:**
+1. [When apply](#1-when)
+2. [Docker: Containerization](#2-docker)
+3. [Kubernetes: Orchestration](#3-kubernetes)
+4. [Security Posture](#4-security)
+5. [Observability](#5-observability)
+6. [Data & DR](#6-data--dr)
+7. [Red Flags](#7-red-flags)
+8. [Output Template](#8-output)
+
+---
+
+## 1. When apply
+
+| Scenario | Apply? |
+|---------|:---------:|
+| Docker Compose (dev + small prod) | ✅ Docker section |
+| Kubernetes (cloud, self-hosted) | ✅ Full skill |
+| Vercel/Netlify/serverless only | ⬜ Not needed |
+| Microservices / several components | ✅ Full skill |
+| Horizontal scaling | ✅ K8s section |
+
+---
+
+## 2. Docker: Containerization
+
+### Checklist
+
+| # | Check | Status |
+|---|-------|--------|
+| 2.1 | Multi-stage build (builder → runtime) | ☐ |
+| 2.2 | Lockfile + deterministic installs (`npm ci`) | ☐ |
+| 2.3 | Minimal runtime image (alpine / distroless) | ☐ |
+| 2.4 | Cache-friendly layers (deps before source) | ☐ |
+| 2.5 | Non-root user (`USER appuser`) | ☐ |
+| 2.6 | No secrets in image (use env_file / secrets) | ☐ |
+| 2.7 | HEALTHCHECK defined | ☐ |
+| 2.8 | `.dockerignore` configured | ☐ |
+| 2.9 | Logs to stdout/stderr (12-factor) | ☐ |
+
+### Dockerfile template (Node.js API)
+
+```dockerfile
+# ── Build ──
+FROM node:20-alpine AS builder
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci --ignore-scripts
+COPY . .
+RUN npm run build
+
+# ── Runtime ──
+FROM node:20-alpine AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+
+# Non-root user
+RUN addgroup -g 1001 appgroup && \
+    adduser -u 1001 -G appgroup -s /bin/sh -D appuser
+
+# Copy only production artifacts
+COPY --from=builder --chown=appuser:appgroup /app/dist ./dist
+COPY --from=builder --chown=appuser:appgroup /app/node_modules ./node_modules
+COPY --from=builder --chown=appuser:appgroup /app/package.json ./
+
+USER appuser
+EXPOSE 3000
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s \
+  CMD wget -qO- http://localhost:3000/health/live || exit 1
+
+CMD ["node", "dist/server.js"]
+```
+
+### Dockerfile template (React SPA / Vite)
+
+```dockerfile
+# ── Build ──
+FROM node:20-alpine AS builder
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+# ── Serve ──
+FROM caddy:2-alpine AS runtime
+COPY --from=builder /app/dist /srv
+COPY Caddyfile /etc/caddy/Caddyfile
+EXPOSE 3001
+```
+
+### .dockerignore
+
+```
+node_modules
+.git
+.env
+*.log
+dist
+.DS_Store
+coverage
+```
+
+---
+
+## 3. Kubernetes: Orchestration
+
+### 3.1 Workloads
+
+| Workload | Type | When |
+|----------|------|------|
+| Stateless API | Deployment | Default for services |
+| Stateful DB | StatefulSet | Only if self-hosting DB (prefer managed) |
+| One-off tasks | Job | Migrations, backfill |
+| Scheduled tasks | CronJob | Cleanup, reports |
+
+### 3.2 Deployment manifest
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: api
+  namespace: smart-cart
+  labels:
+    app.kubernetes.io/name: api
+    app.kubernetes.io/part-of: smart-cart-rescue
+    app.kubernetes.io/component: backend
+    app.kubernetes.io/version: "1.0.0"
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: api
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: api
+        app.kubernetes.io/part-of: smart-cart-rescue
+    spec:
+      serviceAccountName: api-sa
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1001
+        runAsGroup: 1001
+        fsGroup: 1001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: api
+          image: registry.example.com/smart-cart/api:1.0.0
+          ports:
+            - containerPort: 3000
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: api-config
+            - secretRef:
+                name: api-secrets
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          readinessProbe:
+            httpGet:
+              path: /health/ready
+              port: 3000
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health/live
+              port: 3000
+            initialDelaySeconds: 15
+            periodSeconds: 20
+            failureThreshold: 3
+          startupProbe:
+            httpGet:
+              path: /health/live
+              port: 3000
+            failureThreshold: 10
+            periodSeconds: 5
+      terminationGracePeriodSeconds: 30
+```
+
+### 3.3 Service & Ingress
+
+```yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: api
+  namespace: smart-cart
+spec:
+  selector:
+    app.kubernetes.io/name: api
+  ports:
+    - port: 80
+      targetPort: 3000
+  type: ClusterIP
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: api-ingress
+  namespace: smart-cart
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts: [api.example.com]
+      secretName: api-tls
+  rules:
+    - host: api.example.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: api
+                port:
+                  number: 80
+```
+
+### 3.4 HPA (Horizontal Pod Autoscaler)
+
+```yaml
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: api-hpa
+  namespace: smart-cart
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: api
+  minReplicas: 2
+  maxReplicas: 10
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 70
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          type: Utilization
+          averageUtilization: 80
+  behavior:
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      policies:
+        - type: Pods
+          value: 1
+          periodSeconds: 60
+```
+
+### 3.5 PodDisruptionBudget
+
+```yaml
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: api-pdb
+  namespace: smart-cart
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: api
+```
+
+---
+
+## 4. Security Posture
+
+### Container security checklist
+
+| # | Check | How | Status |
+|---|-------|-----|--------|
+| 4.1 | Non-root | `runAsNonRoot: true`, `runAsUser: 1001` | ☐ |
+| 4.2 | Drop capabilities | `drop: [ALL]` | ☐ |
+| 4.3 | Read-only root FS | `readOnlyRootFilesystem: true` (+ tmpdir emptyDir) | ☐ |
+| 4.4 | Seccomp profile | `seccompProfile: RuntimeDefault` | ☐ |
+| 4.5 | No privilege escalation | `allowPrivilegeEscalation: false` | ☐ |
+| 4.6 | Image from trusted registry | Private registry with scanning | ☐ |
+| 4.7 | No secrets in image | Env vars / mounted secrets only | ☐ |
+| 4.8 | RBAC least privilege | Dedicated ServiceAccount per app | ☐ |
+| 4.9 | NetworkPolicy | Restrict ingress/egress | ☐ |
+
+### Security context snippet
+
+```yaml
+securityContext:
+  runAsNonRoot: true
+  runAsUser: 1001
+  runAsGroup: 1001
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: true
+  capabilities:
+    drop: [ALL]
+  seccompProfile:
+    type: RuntimeDefault
+```
+
+### NetworkPolicy example
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: api-network-policy
+  namespace: smart-cart
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: api
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: gateway
+      ports:
+        - port: 3000
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: mongo
+      ports:
+        - port: 27017
+    - to:  # Wix API
+        - ipBlock:
+            cidr: 0.0.0.0/0
+      ports:
+        - port: 443
+```
+
+---
+
+## 5. Observability
+
+### K8s-level checklist
+
+| # | What | How | Status |
+|---|------|-----|--------|
+| 5.1 | Structured logs to stdout | pino JSON → collected by K8s | ☐ |
+| 5.2 | Request correlation | `requestId` in all log entries | ☐ |
+| 5.3 | Metrics (Prometheus) | `/metrics` endpoint or sidecar | ☐ |
+| 5.4 | Key metrics | latency, error rate, throughput, saturation | ☐ |
+| 5.5 | Alerts | Error rate > 5%, p95 > 2x target, pod restarts | ☐ |
+| 5.6 | Log retention | Define days/storage limit | ☐ |
+| 5.7 | Health endpoints | `/health/live`, `/health/ready` | ☐ |
+
+---
+
+## 6. Data & DR
+
+### Backup checklist
+
+| # | What | How | Status |
+|---|------|-----|--------|
+| 6.1 | DB backups scheduled | `mongodump` CronJob or managed backup | ☐ |
+| 6.2 | Backup retention | N days (e.g. 30 days) | ☐ |
+| 6.3 | Restore tested | Restore from backup to test DB | ☐ |
+| 6.4 | RPO defined | Max data loss acceptable (e.g. 1 hour) | ☐ |
+| 6.5 | RTO defined | Max downtime acceptable (e.g. 30 min) | ☐ |
+| 6.6 | PITR (if needed) | Oplog-based point-in-time recovery | ☐ |
+
 ### Observability
-### Required ADRs
-### Risks (P0/P1/P2)
+
+| Strategy | How | When |
+|----------|-----|------|
+| **RollingUpdate** (default) | `maxUnavailable: 0, maxSurge: 1` | Normal releases |
+| **Blue-Green** | Two deployments, switch service selector | Critical releases |
+| **Canary** | Progressive rollout (10% → 50% → 100%) | High-risk features |
+| **Rollback** | `kubectl rollout undo deployment/api` | On failure |
+
+---
+
+## 7. Red Flags
+
+### 🔴 P0 (must fix before production)
+
+| Flag | Description |
+|------|------------|
+| Containers run as root | `runAsNonRoot: true` missing |
+| Secrets in image/repo | Secrets in Dockerfile, values.yaml, git |
+| No readiness/liveness probes | Traffic sent to unhealthy pods |
+| No rollback plan | Can't revert failed deployment |
+| No resource limits | Pod can consume all node resources |
+
+### 🟠 P1 (fix in current iteration)
+
+| Flag | Description |
+|------|------------|
+| No HPA | Can't scale under load |
+| No NetworkPolicy/RBAC | Lateral movement possible |
+| No CI validation on manifests | Invalid YAML deployed |
+| No backup tested | Backup exists but restore never verified |
+
+---
+
+## 8. Output Template
+
+```markdown
+# Docker & Kubernetes Architecture: <project-name>
+
+**Date:** YYYY-MM-DD
+
+## Containerization Plan
+- Dockerfile strategy (multi-stage, non-root)
+- Base images used
+- .dockerignore
+
+## Kubernetes Topology
+- Namespaces, workloads, services, ingress
+- Deployment manifests
+
+## Resources & Scaling
+- requests/limits per service
+- HPA config
+
+## Security Posture
+- Security context (non-root, seccomp, capabilities)
+- NetworkPolicy
+- RBAC
+
+## Rollout/Rollback
+- Strategy (RollingUpdate/Blue-Green/Canary)
+- Rollback command + procedure
+
+## Observability
+- Logging, metrics, alerts in K8s context
+
+## Data & DR
+- Backup strategy, RPO/RTO
+
+## Required ADRs
+- [ ] ADR-xxx: K8s vs Docker Compose
+- [ ] ADR-xxx: Ingress controller choice
+- [ ] ADR-xxx: Rollout strategy
+
+## Risks (P0/P1/P2)
+<red flags table>
+```
+
+---
+
+## See also
+- `$deployment_ci_plan` — CI pipeline, environments, migrations
+- `$k8s_manifests_conventions` — manifest naming, labels, repo structure
+- `$observability_plan` — detailed logging/metrics plan
+- `$threat_model_baseline` — security requirements

package/locales/en/.agents/docker_kubernetes_architecture/agents/claude.json

@@ -1,12 +1,13 @@
 {
   "name": "docker_kubernetes_architecture",
-  "display_name": "Containerization and Kubernetes architecture",
-  "description": "Containerization and Kubernetes architecture: Dockerfile best practices, k8s manifests, security, scaling, rollout, observability, CI/CD.",
-  "default_prompt": "Use $docker_kubernetes_architecture when the task matches the \"Containerization and Kubernetes architecture\" skill.",
+  "display_name": "── Build ──",
+  "description": "Containerization and Kubernetes architecture — Dockerfile best practices, k8s manifests, security, scaling, rollout, observability, CI/CD.",
+  "default_prompt": "Use $docker_kubernetes_architecture when the task matches the \"── Build ──\" skill.",
   "triggers": [
     "docker_kubernetes_architecture",
     "docker kubernetes architecture",
-    "Containerization and Kubernetes architecture"
+    "── Build ──",
+    "Containerization and Kubernetes architecture — Dockerfile best practices, k8s manifests, security, scaling, rollout, observability, CI/CD"
   ],
   "capabilities": [
     "docker",

package/locales/en/.agents/docker_kubernetes_architecture/agents/copilot.json

@@ -1,12 +1,13 @@
 {
   "name": "docker_kubernetes_architecture",
-  "display_name": "Containerization and Kubernetes architecture",
-  "description": "Containerization and Kubernetes architecture: Dockerfile best practices, k8s manifests, security, scaling, rollout, observability, CI/CD.",
-  "default_prompt": "Use $docker_kubernetes_architecture when the task matches the \"Containerization and Kubernetes architecture\" skill.",
+  "display_name": "── Build ──",
+  "description": "Containerization and Kubernetes architecture — Dockerfile best practices, k8s manifests, security, scaling, rollout, observability, CI/CD.",
+  "default_prompt": "Use $docker_kubernetes_architecture when the task matches the \"── Build ──\" skill.",
   "triggers": [
     "docker_kubernetes_architecture",
     "docker kubernetes architecture",
-    "Containerization and Kubernetes architecture"
+    "── Build ──",
+    "Containerization and Kubernetes architecture — Dockerfile best practices, k8s manifests, security, scaling, rollout, observability, CI/CD"
   ],
   "capabilities": [
     "docker",

package/locales/en/.agents/docker_kubernetes_architecture/agents/gemini.json

@@ -1,12 +1,13 @@
 {
   "name": "docker_kubernetes_architecture",
-  "display_name": "Containerization and Kubernetes architecture",
-  "description": "Containerization and Kubernetes architecture: Dockerfile best practices, k8s manifests, security, scaling, rollout, observability, CI/CD.",
-  "default_prompt": "Use $docker_kubernetes_architecture when the task matches the \"Containerization and Kubernetes architecture\" skill.",
+  "display_name": "── Build ──",
+  "description": "Containerization and Kubernetes architecture — Dockerfile best practices, k8s manifests, security, scaling, rollout, observability, CI/CD.",
+  "default_prompt": "Use $docker_kubernetes_architecture when the task matches the \"── Build ──\" skill.",
   "triggers": [
     "docker_kubernetes_architecture",
     "docker kubernetes architecture",
-    "Containerization and Kubernetes architecture"
+    "── Build ──",
+    "Containerization and Kubernetes architecture — Dockerfile best practices, k8s manifests, security, scaling, rollout, observability, CI/CD"
   ],
   "capabilities": [
     "docker",