cokit-cli 1.0.9 → 1.2.0

package/skills/devops/references/gcloud-services.md

@@ -0,0 +1,304 @@
+# Google Cloud Services
+
+## Compute Engine (VMs)
+
+```bash
+# List instances
+gcloud compute instances list
+
+# Create instance
+gcloud compute instances create my-instance \
+  --zone=us-central1-a \
+  --machine-type=e2-medium \
+  --image-family=debian-11 \
+  --image-project=debian-cloud \
+  --boot-disk-size=10GB
+
+# SSH into instance
+gcloud compute ssh my-instance --zone=us-central1-a
+
+# Copy files
+gcloud compute scp local-file.txt my-instance:~/remote-file.txt \
+  --zone=us-central1-a
+
+# Stop instance
+gcloud compute instances stop my-instance --zone=us-central1-a
+
+# Delete instance
+gcloud compute instances delete my-instance --zone=us-central1-a
+```
+
+## Google Kubernetes Engine (GKE)
+
+```bash
+# Create cluster
+gcloud container clusters create my-cluster \
+  --zone=us-central1-a \
+  --num-nodes=3 \
+  --machine-type=e2-medium
+
+# Get credentials
+gcloud container clusters get-credentials my-cluster --zone=us-central1-a
+
+# List clusters
+gcloud container clusters list
+
+# Resize cluster
+gcloud container clusters resize my-cluster \
+  --num-nodes=5 \
+  --zone=us-central1-a
+
+# Delete cluster
+gcloud container clusters delete my-cluster --zone=us-central1-a
+```
+
+## Cloud Run (Serverless Containers)
+
+```bash
+# Deploy container
+gcloud run deploy my-service \
+  --image=gcr.io/PROJECT_ID/my-image:tag \
+  --platform=managed \
+  --region=us-central1 \
+  --allow-unauthenticated
+
+# List services
+gcloud run services list
+
+# Describe service
+gcloud run services describe my-service --region=us-central1
+
+# Delete service
+gcloud run services delete my-service --region=us-central1
+```
+
+## App Engine
+
+```bash
+# Deploy application
+gcloud app deploy app.yaml
+
+# View application
+gcloud app browse
+
+# View logs
+gcloud app logs tail
+
+# List versions
+gcloud app versions list
+
+# Delete version
+gcloud app versions delete VERSION_ID
+
+# Set traffic split
+gcloud app services set-traffic SERVICE \
+  --splits v1=0.5,v2=0.5
+```
+
+## Cloud Storage
+
+```bash
+# Create bucket
+gsutil mb gs://my-bucket-name
+
+# Upload file
+gsutil cp local-file.txt gs://my-bucket-name/
+
+# Download file
+gsutil cp gs://my-bucket-name/file.txt ./
+
+# List contents
+gsutil ls gs://my-bucket-name/
+
+# Sync directory
+gsutil rsync -r ./local-dir gs://my-bucket-name/remote-dir
+
+# Set permissions
+gsutil iam ch user:user@example.com:objectViewer gs://my-bucket-name
+
+# Delete bucket
+gsutil rm -r gs://my-bucket-name
+```
+
+## Cloud SQL
+
+```bash
+# Create instance
+gcloud sql instances create my-instance \
+  --database-version=POSTGRES_14 \
+  --tier=db-f1-micro \
+  --region=us-central1
+
+# Create database
+gcloud sql databases create my-database \
+  --instance=my-instance
+
+# Create user
+gcloud sql users create my-user \
+  --instance=my-instance \
+  --password=PASSWORD
+
+# Connect
+gcloud sql connect my-instance --user=my-user
+
+# Delete instance
+gcloud sql instances delete my-instance
+```
+
+## Cloud Functions
+
+```bash
+# Deploy function
+gcloud functions deploy my-function \
+  --runtime=python39 \
+  --trigger-http \
+  --allow-unauthenticated \
+  --entry-point=main
+
+# List functions
+gcloud functions list
+
+# Describe function
+gcloud functions describe my-function
+
+# Call function
+gcloud functions call my-function
+
+# Delete function
+gcloud functions delete my-function
+```
+
+## BigQuery
+
+```bash
+# List datasets
+bq ls
+
+# Create dataset
+bq mk my_dataset
+
+# Load data
+bq load --source_format=CSV my_dataset.my_table \
+  gs://my-bucket/data.csv \
+  schema.json
+
+# Query
+bq query --use_legacy_sql=false \
+  'SELECT * FROM `my_dataset.my_table` LIMIT 10'
+
+# Delete dataset
+bq rm -r -f my_dataset
+```
+
+## Cloud Build
+
+```bash
+# Submit build
+gcloud builds submit --tag=gcr.io/PROJECT_ID/my-image
+
+# List builds
+gcloud builds list
+
+# Describe build
+gcloud builds describe BUILD_ID
+
+# Cancel build
+gcloud builds cancel BUILD_ID
+```
+
+## Artifact Registry
+
+```bash
+# Create repository
+gcloud artifacts repositories create my-repo \
+  --repository-format=docker \
+  --location=us-central1
+
+# Configure Docker
+gcloud auth configure-docker us-central1-docker.pkg.dev
+
+# Push image
+docker tag my-image us-central1-docker.pkg.dev/PROJECT_ID/my-repo/my-image
+docker push us-central1-docker.pkg.dev/PROJECT_ID/my-repo/my-image
+
+# List repositories
+gcloud artifacts repositories list
+```
+
+## Networking
+
+```bash
+# Create VPC network
+gcloud compute networks create my-network \
+  --subnet-mode=auto
+
+# Create firewall rule
+gcloud compute firewall-rules create allow-http \
+  --network=my-network \
+  --allow=tcp:80
+
+# List networks
+gcloud compute networks list
+
+# List firewall rules
+gcloud compute firewall-rules list
+```
+
+## IAM
+
+```bash
+# List IAM policy
+gcloud projects get-iam-policy PROJECT_ID
+
+# Add IAM binding
+gcloud projects add-iam-policy-binding PROJECT_ID \
+  --member="user:user@example.com" \
+  --role="roles/viewer"
+
+# Remove IAM binding
+gcloud projects remove-iam-policy-binding PROJECT_ID \
+  --member="user:user@example.com" \
+  --role="roles/viewer"
+
+# List service accounts
+gcloud iam service-accounts list
+```
+
+## Monitoring & Logging
+
+```bash
+# View logs
+gcloud logging read "resource.type=gce_instance" \
+  --limit=10 \
+  --format=json
+
+# Create log sink
+gcloud logging sinks create my-sink \
+  storage.googleapis.com/my-bucket \
+  --log-filter="resource.type=gce_instance"
+
+# List metrics
+gcloud monitoring metrics-descriptors list
+```
+
+## Quick Reference
+
+| Service | Command Prefix |
+|---------|----------------|
+| Compute Engine | `gcloud compute` |
+| GKE | `gcloud container` |
+| Cloud Run | `gcloud run` |
+| App Engine | `gcloud app` |
+| Cloud Storage | `gsutil` |
+| BigQuery | `bq` |
+| Cloud SQL | `gcloud sql` |
+| Cloud Functions | `gcloud functions` |
+| IAM | `gcloud iam` |
+
+## Resources
+
+- Compute Engine: https://cloud.google.com/compute/docs
+- GKE: https://cloud.google.com/kubernetes-engine/docs
+- Cloud Run: https://cloud.google.com/run/docs
+- App Engine: https://cloud.google.com/appengine/docs
+- Cloud Storage: https://cloud.google.com/storage/docs

package/skills/devops/references/kubernetes-basics.md

@@ -0,0 +1,99 @@
+# Kubernetes Core Concepts
+
+## Cluster Architecture
+
+```
+CONTROL PLANE                    WORKER NODES
+├── API Server (kubectl)         ├── Kubelet (node agent)
+├── Scheduler (pod placement)    ├── Kube-proxy (networking)
+├── Controller Manager           └── Container Runtime
+└── etcd (cluster state)
+```
+
+## Pod
+```yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: myapp-pod
+spec:
+  containers:
+  - name: myapp
+    image: myapp:1.0
+    ports:
+    - containerPort: 8080
+    resources:
+      requests: { memory: "256Mi", cpu: "250m" }
+      limits: { memory: "512Mi", cpu: "500m" }
+```
+
+## Deployment
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myapp
+spec:
+  replicas: 3
+  strategy:
+    type: RollingUpdate
+    rollingUpdate: { maxSurge: 1, maxUnavailable: 0 }
+  selector:
+    matchLabels: { app: myapp }
+  template:
+    metadata:
+      labels: { app: myapp }
+    spec:
+      containers:
+      - name: myapp
+        image: myapp:1.0
+```
+
+## Service
+```yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: myapp-service
+spec:
+  type: ClusterIP  # ClusterIP, NodePort, LoadBalancer
+  selector: { app: myapp }
+  ports:
+  - port: 8080
+    targetPort: 8080
+```
+
+## ConfigMap & Secret
+```yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: app-config
+data:
+  DATABASE_HOST: "postgres.svc.cluster.local"
+---
+apiVersion: v1
+kind: Secret
+type: Opaque
+stringData:
+  password: secretpassword
+```
+
+## Workload Types
+
+| Type | Use Case |
+|------|----------|
+| Deployment | Stateless apps |
+| StatefulSet | Databases |
+| DaemonSet | One per node |
+| Job | Batch tasks |
+| CronJob | Scheduled |
+
+## Labels
+```yaml
+labels:
+  app: myapp
+  version: v1.0.0
+  tier: frontend
+  environment: prod
+```

package/skills/devops/references/kubernetes-helm-advanced.md

@@ -0,0 +1,75 @@
+# Helm Advanced - Templates & Hooks
+
+## Template Variables
+```yaml
+# templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "mychart.fullname" . }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  template:
+    spec:
+      containers:
+      - name: {{ .Chart.Name }}
+        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+        {{- if .Values.resources }}
+        resources:
+          {{- toYaml .Values.resources | nindent 10 }}
+        {{- end }}
+```
+
+## Helper Templates
+```yaml
+# templates/_helpers.tpl
+{{- define "mychart.fullname" -}}
+{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "mychart.labels" -}}
+app.kubernetes.io/name: {{ .Chart.Name }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+```
+
+## Hooks
+```yaml
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "{{ .Release.Name }}-post-install"
+  annotations:
+    "helm.sh/hook": post-install
+    "helm.sh/hook-delete-policy": hook-succeeded
+spec:
+  template:
+    spec:
+      containers:
+      - name: post-install
+        command: ["/bin/sh", "-c", "echo 'Done'"]
+      restartPolicy: Never
+```
+
+Hook types: `pre-install`, `post-install`, `pre-upgrade`, `post-upgrade`
+
+## Packaging
+```bash
+helm package mychart
+helm repo index . --url https://charts.example.com
+helm push mychart-1.0.0.tgz oci://registry.example.com/helm
+helm repo add myrepo https://charts.example.com
+helm install myapp myrepo/mychart
+```
+
+## Commands
+
+| Command | Purpose |
+|---------|---------|
+| `helm create` | Create |
+| `helm lint` | Validate |
+| `helm template` | Render |
+| `helm install` | Deploy |
+| `helm upgrade` | Update |
+| `helm rollback` | Revert |
+| `helm uninstall` | Remove |

package/skills/devops/references/kubernetes-helm.md

@@ -0,0 +1,81 @@
+# Helm Package Management
+
+## Core Concepts
+
+- **Chart:** Helm package with K8s resource definitions
+- **Repository:** Collection of charts
+- **Release:** Deployed instance of a chart
+- **Values:** Configuration that parameterizes charts
+
+## Chart Structure
+
+```
+mychart/
+├── Chart.yaml              # Metadata
+├── values.yaml             # Default values
+├── charts/                 # Dependencies
+├── templates/
+│   ├── deployment.yaml
+│   ├── service.yaml
+│   ├── _helpers.tpl       # Template helpers
+│   └── NOTES.txt
+└── values.schema.json     # Validation (optional)
+```
+
+## Essential Commands
+
+```bash
+helm create mychart           # Create chart
+helm lint mychart             # Validate
+helm template myrelease ./mychart  # Render locally
+helm install myrelease ./mychart --dry-run --debug  # Preview
+
+helm install myrelease ./mychart
+helm install myrelease ./mychart -f values-prod.yaml
+helm install myrelease ./mychart --set replicaCount=3
+
+helm upgrade myrelease ./mychart
+helm rollback myrelease 1
+helm list
+helm uninstall myrelease
+```
+
+## Multi-Environment
+
+```bash
+# Files: values.yaml, values-dev.yaml, values-prod.yaml
+helm install myapp ./mychart -f values.yaml -f values-prod.yaml
+helm install myapp ./mychart --set replicaCount=3 --set image.tag=v1.2.3
+```
+
+## values.yaml Example
+
+```yaml
+replicaCount: 2
+image:
+  repository: myapp
+  tag: "1.0.0"
+  pullPolicy: IfNotPresent
+service:
+  type: ClusterIP
+  port: 8080
+resources:
+  limits: { cpu: 500m, memory: 512Mi }
+  requests: { cpu: 250m, memory: 256Mi }
+```
+
+## Dependencies
+
+```yaml
+# Chart.yaml
+dependencies:
+  - name: postgresql
+    version: "12.1.0"
+    repository: "https://charts.bitnami.com/bitnami"
+```
+
+```bash
+helm dependency update mychart
+```
+
+See `kubernetes-helm-advanced.md` for templates, hooks, and packaging.

package/skills/devops/references/kubernetes-kubectl.md

@@ -0,0 +1,74 @@
+# kubectl Essential Commands
+
+## Cluster & Node
+```bash
+kubectl cluster-info
+kubectl get nodes
+kubectl describe node <node-name>
+kubectl top nodes
+kubectl drain <node-name> --ignore-daemonsets
+kubectl uncordon <node-name>
+```
+
+## Pod Operations
+```bash
+kubectl get pods -A                     # All namespaces
+kubectl get pods -o wide                # Extended info
+kubectl describe pod <pod-name>
+kubectl logs <pod-name>
+kubectl logs -f <pod-name>              # Follow
+kubectl logs --previous <pod-name>      # Previous crash
+kubectl exec -it <pod-name> -- /bin/bash
+```
+
+## Deployment
+```bash
+kubectl apply -f manifest.yaml
+kubectl apply -f ./manifests/
+kubectl apply -f manifest.yaml --dry-run=client -o yaml  # Preview
+kubectl set image deployment/myapp app=myapp:v2
+kubectl delete -f manifest.yaml
+```
+
+## Service & Network
+```bash
+kubectl port-forward service/myapp 8080:8080
+kubectl get svc
+kubectl exec -it <pod-name> -- curl http://service:8080
+kubectl exec -it <pod-name> -- nslookup kubernetes.default
+```
+
+## Debugging (Get → Describe → Logs)
+```bash
+kubectl get pods -o wide
+kubectl get events -n <ns> --sort-by='.lastTimestamp'
+kubectl describe pod <pod-name>
+kubectl logs <pod-name> -c <container>
+```
+
+## Output & Filtering
+```bash
+kubectl get pods -o json
+kubectl get pods -o yaml
+kubectl get pods -l app=myapp,tier=frontend
+kubectl get pods --field-selector=status.phase=Running
+kubectl get pods -w                     # Watch
+```
+
+## Flags
+
+| Flag | Purpose |
+|------|---------|
+| `-n` | Namespace |
+| `-A` | All namespaces |
+| `-o` | Output format |
+| `-l` | Label selector |
+| `-w` | Watch |
+
+## Aliases
+```bash
+alias k='kubectl'
+alias kgp='kubectl get pods'
+alias kd='kubectl describe'
+alias kl='kubectl logs'
+```

package/skills/devops/references/kubernetes-security-advanced.md

@@ -0,0 +1,98 @@
+# Kubernetes Security Advanced
+
+## ClusterRole (cluster-wide)
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: secret-reader
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get"]
+  resourceNames: ["app-credentials"]  # Restrict to specific
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: admin-binding
+subjects:
+- kind: User
+  name: admin@example.com
+  apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: ClusterRole
+  name: cluster-admin
+  apiGroup: rbac.authorization.k8s.io
+```
+
+## Secrets Management
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: db-credentials
+type: Opaque
+stringData:
+  username: admin
+  password: secretpassword
+```
+
+### Mount as env
+```yaml
+env:
+- name: DB_PASSWORD
+  valueFrom:
+    secretKeyRef:
+      name: db-credentials
+      key: password
+```
+
+### Mount as volume
+```yaml
+volumeMounts:
+- name: secret-volume
+  mountPath: /etc/secrets
+  readOnly: true
+volumes:
+- name: secret-volume
+  secret:
+    secretName: db-credentials
+```
+
+## Allow DNS (Required for most apps)
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-dns
+spec:
+  podSelector: {}
+  policyTypes: [Egress]
+  egress:
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          name: kube-system
+    ports:
+    - { protocol: UDP, port: 53 }
+```
+
+## Security Checklist
+
+- [ ] RBAC with least-privilege roles
+- [ ] Pod Security Standards (restricted)
+- [ ] Network policies (default-deny + explicit allow)
+- [ ] Run containers as non-root
+- [ ] Read-only root filesystem
+- [ ] Drop all capabilities
+- [ ] Secrets for sensitive data
+- [ ] Image scanning enabled
+- [ ] Private container registry
+- [ ] Resource quotas and limits
+- [ ] Audit logging enabled
+- [ ] Regular credential rotation