cokit-cli 1.0.9 → 1.2.2

package/skills/devops/references/kubernetes-security.md

@@ -0,0 +1,95 @@
+# Kubernetes Security
+
+## RBAC (Role-Based Access Control)
+
+### Role (namespace-scoped)
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: default
+  name: pod-reader
+rules:
+- apiGroups: [""]
+  resources: ["pods", "pods/log"]
+  verbs: ["get", "list", "watch"]
+```
+
+### RoleBinding
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: read-pods
+  namespace: default
+subjects:
+- kind: ServiceAccount
+  name: my-app-sa
+  namespace: default
+roleRef:
+  kind: Role
+  name: pod-reader
+  apiGroup: rbac.authorization.k8s.io
+```
+
+### Verify Permissions
+```bash
+kubectl auth can-i get pods --as=system:serviceaccount:default:my-sa
+kubectl get roles,rolebindings -n default
+```
+
+## Pod Security (Restricted)
+
+```yaml
+spec:
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 1000
+    seccompProfile:
+      type: RuntimeDefault
+  containers:
+  - name: app
+    securityContext:
+      allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
+      capabilities:
+        drop: ["ALL"]
+```
+
+Enable on namespace:
+```bash
+kubectl label namespace default \
+  pod-security.kubernetes.io/enforce=restricted
+```
+
+## Network Policies
+
+### Default Deny
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny-all
+spec:
+  podSelector: {}
+  policyTypes: [Ingress, Egress]
+```
+
+### Allow Specific
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-frontend-to-backend
+spec:
+  podSelector:
+    matchLabels: { app: backend }
+  ingress:
+  - from:
+    - podSelector:
+        matchLabels: { app: frontend }
+    ports:
+    - { protocol: TCP, port: 8080 }
+```
+
+See `kubernetes-security-advanced.md` for secrets, ClusterRoles, and checklist.

package/skills/devops/references/kubernetes-troubleshooting-advanced.md

@@ -0,0 +1,74 @@
+# Kubernetes Troubleshooting Advanced
+
+## Node Issues
+```bash
+kubectl describe node <node-name> | grep -A 5 "Conditions:"
+kubectl top node <node-name>
+kubectl top pods -A --sort-by=memory
+kubectl drain <node-name> --ignore-daemonsets
+kubectl uncordon <node-name>
+```
+
+## CrashLoopBackOff
+```bash
+kubectl logs <pod-name> --previous
+kubectl describe pod <pod-name>
+kubectl get pod <pod-name> -o yaml | grep -A 5 resources:
+```
+
+## HPA
+```yaml
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: myapp
+  minReplicas: 2
+  maxReplicas: 10
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      target:
+        type: Utilization
+        averageUtilization: 70
+```
+
+## Anti-Patterns
+
+**Using `latest` tag:**
+```yaml
+# ❌ image: myapp:latest
+# ✅ image: myapp:v1.2.3
+```
+
+**Missing resources:**
+```yaml
+# ✅ Always set
+resources:
+  requests: { memory: "256Mi", cpu: "250m" }
+  limits: { memory: "512Mi", cpu: "500m" }
+```
+
+**Missing health checks:**
+```yaml
+livenessProbe:
+  httpGet: { path: /health, port: 8080 }
+readinessProbe:
+  httpGet: { path: /ready, port: 8080 }
+```
+
+**Running as root:**
+```yaml
+securityContext:
+  runAsNonRoot: true
+  runAsUser: 1000
+```
+
+## Monitoring
+```bash
+helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
+helm install prometheus prometheus-community/kube-prometheus-stack -n monitoring
+```

package/skills/devops/references/kubernetes-troubleshooting.md

@@ -0,0 +1,49 @@
+# Kubernetes Troubleshooting
+
+## Debugging Workflow
+
+```bash
+# 1. Overview
+kubectl get pods -o wide
+kubectl get events -n <namespace> --sort-by='.lastTimestamp'
+
+# 2. Details
+kubectl describe pod <pod-name>
+
+# 3. Logs
+kubectl logs <pod-name>
+kubectl logs <pod-name> --previous  # Crashed instance
+kubectl logs <pod-name> -c <container>
+```
+
+## Common Pod States
+
+| State | Cause | Solution |
+|-------|-------|----------|
+| Pending | No node resources | Check node capacity |
+| ContainerCreating | Image pulling | Check image URI |
+| CrashLoopBackOff | Container exits | Check logs, health checks |
+| ImagePullBackOff | Failed image pull | Verify credentials |
+| OOMKilled (137) | Out of memory | Increase memory limit |
+
+## Service & Network
+
+```bash
+kubectl exec -it <pod-name> -- nslookup kubernetes.default
+kubectl exec -it <pod-name> -- curl http://myservice:8080
+kubectl get endpoints <service-name>
+kubectl port-forward service/myservice 8080:8080
+kubectl get networkpolicies -A
+```
+
+## Quick Fixes
+
+| Problem | Command |
+|---------|---------|
+| Pod stuck | `kubectl delete pod <name> --grace-period=0 --force` |
+| High CPU | `kubectl top pods -A --sort-by=cpu` |
+| High memory | `kubectl top pods -A --sort-by=memory` |
+| Restart | `kubectl rollout restart deployment/<name>` |
+| Rollback | `kubectl rollout undo deployment/<name>` |
+
+See `kubernetes-troubleshooting-advanced.md` for node issues, HPA, anti-patterns.

package/skills/devops/references/kubernetes-workflows-advanced.md

@@ -0,0 +1,75 @@
+# Kubernetes Workflows Advanced
+
+## CI/CD Pipeline
+```yaml
+# GitHub Actions
+name: Build and Deploy
+on:
+  push:
+    branches: [main]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - run: docker build . -t $REGISTRY/$IMAGE:${{ github.sha }}
+    - run: docker push $REGISTRY/$IMAGE:${{ github.sha }}
+
+  deploy:
+    needs: build
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        repository: myorg/gitops-repo
+        token: ${{ secrets.GITOPS_TOKEN }}
+    - run: |
+        sed -i 's|image:.*|image: $REGISTRY/$IMAGE:${{ github.sha }}|' k8s/deployment.yaml
+        git commit -am "Update image" && git push
+```
+
+## Kustomize
+
+```
+kustomize/
+├── base/
+│   ├── kustomization.yaml
+│   └── deployment.yaml
+└── overlays/
+    └── prod/
+        └── kustomization.yaml
+```
+
+### Base
+```yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- deployment.yaml
+commonLabels:
+  app: myapp
+```
+
+### Prod Overlay
+```yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+bases:
+- ../../base
+replicas:
+- name: myapp
+  count: 5
+```
+
+```bash
+kubectl apply -k overlays/prod/
+```
+
+## Flux CD
+```bash
+flux bootstrap github \
+  --owner=myorg \
+  --repository=fleet-infra \
+  --branch=main \
+  --path=clusters/my-cluster
+```

package/skills/devops/references/kubernetes-workflows.md

@@ -0,0 +1,78 @@
+# Kubernetes Workflows
+
+## GitOps Architecture
+
+```
+Git Repository (desired state)
+         │ Watches
+         ▼
+GitOps Agent (Argo CD / Flux)
+         │ Syncs
+         ▼
+Kubernetes Cluster (actual state)
+```
+
+**Benefits:** Single source of truth, auditable, automated, easy rollback
+
+## Argo CD Setup
+
+```bash
+kubectl create namespace argocd
+kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
+kubectl port-forward svc/argocd-server -n argocd 8080:443
+kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d
+```
+
+### Application Manifest
+```yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: myapp
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/myorg/myapp
+    targetRevision: HEAD
+    path: k8s/manifests
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: default
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+```
+
+## Deployment Patterns
+
+### Rolling Update
+```yaml
+spec:
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+```
+
+### Blue-Green
+```yaml
+# Two deployments: myapp-blue, myapp-green
+# Service selector switches between versions
+selector:
+  app: myapp
+  version: blue  # Change to 'green' to switch
+```
+
+### Canary (with Istio)
+```yaml
+route:
+- destination: { host: myapp, subset: v1 }
+  weight: 90
+- destination: { host: myapp, subset: v2 }
+  weight: 10  # 10% canary
+```
+
+See `kubernetes-workflows-advanced.md` for CI/CD, Kustomize patterns.

package/skills/devops/scripts/cloudflare_deploy.py

@@ -0,0 +1,269 @@
+#!/usr/bin/env python3
+"""
+Cloudflare Worker Deployment Utility
+
+Automates Cloudflare Worker deployments with wrangler.toml configuration handling,
+multi-environment support, and comprehensive error handling.
+
+Usage:
+    python cloudflare-deploy.py --env production --dry-run
+    python cloudflare-deploy.py --project ./my-worker --env staging
+"""
+
+import argparse
+import json
+import subprocess
+import sys
+from pathlib import Path
+from typing import Dict, List, Optional, Tuple
+
+
+class CloudflareDeployError(Exception):
+    """Custom exception for Cloudflare deployment errors."""
+    pass
+
+
+class CloudflareDeploy:
+    """Handle Cloudflare Worker deployments with wrangler CLI."""
+
+    def __init__(self, project_dir: Path, env: Optional[str] = None,
+                 dry_run: bool = False, verbose: bool = False):
+        """
+        Initialize CloudflareDeploy.
+
+        Args:
+            project_dir: Path to Worker project directory
+            env: Environment name (production, staging, dev)
+            dry_run: Preview deployment without actually deploying
+            verbose: Enable verbose output
+        """
+        self.project_dir = Path(project_dir).resolve()
+        self.env = env
+        self.dry_run = dry_run
+        self.verbose = verbose
+        self.wrangler_toml = self.project_dir / "wrangler.toml"
+
+    def validate_project(self) -> bool:
+        """
+        Validate project directory and wrangler.toml existence.
+
+        Returns:
+            True if valid, False otherwise
+
+        Raises:
+            CloudflareDeployError: If validation fails
+        """
+        if not self.project_dir.exists():
+            raise CloudflareDeployError(
+                f"Project directory does not exist: {self.project_dir}"
+            )
+
+        if not self.wrangler_toml.exists():
+            raise CloudflareDeployError(
+                f"wrangler.toml not found in: {self.project_dir}"
+            )
+
+        return True
+
+    def check_wrangler_installed(self) -> bool:
+        """
+        Check if wrangler CLI is installed.
+
+        Returns:
+            True if installed, False otherwise
+        """
+        try:
+            result = subprocess.run(
+                ["wrangler", "--version"],
+                capture_output=True,
+                text=True,
+                check=True
+            )
+            if self.verbose:
+                print(f"Wrangler version: {result.stdout.strip()}")
+            return True
+        except (subprocess.CalledProcessError, FileNotFoundError):
+            return False
+
+    def run_command(self, cmd: List[str], check: bool = True) -> Tuple[int, str, str]:
+        """
+        Run shell command and capture output.
+
+        Args:
+            cmd: Command and arguments as list
+            check: Raise exception on non-zero exit code
+
+        Returns:
+            Tuple of (exit_code, stdout, stderr)
+
+        Raises:
+            CloudflareDeployError: If command fails and check=True
+        """
+        if self.verbose:
+            print(f"Running: {' '.join(cmd)}")
+
+        try:
+            result = subprocess.run(
+                cmd,
+                capture_output=True,
+                text=True,
+                cwd=self.project_dir,
+                check=check
+            )
+            return result.returncode, result.stdout, result.stderr
+        except subprocess.CalledProcessError as e:
+            if check:
+                raise CloudflareDeployError(
+                    f"Command failed: {' '.join(cmd)}\n{e.stderr}"
+                )
+            return e.returncode, e.stdout, e.stderr
+
+    def get_worker_name(self) -> str:
+        """
+        Extract worker name from wrangler.toml.
+
+        Returns:
+            Worker name
+
+        Raises:
+            CloudflareDeployError: If name cannot be extracted
+        """
+        try:
+            with open(self.wrangler_toml, 'r') as f:
+                for line in f:
+                    if line.strip().startswith('name'):
+                        # Parse: name = "worker-name"
+                        return line.split('=')[1].strip().strip('"\'')
+        except Exception as e:
+            raise CloudflareDeployError(f"Failed to read worker name: {e}")
+
+        raise CloudflareDeployError("Worker name not found in wrangler.toml")
+
+    def build_deploy_command(self) -> List[str]:
+        """
+        Build wrangler deploy command with appropriate flags.
+
+        Returns:
+            Command as list of strings
+        """
+        cmd = ["wrangler", "deploy"]
+
+        if self.env:
+            cmd.extend(["--env", self.env])
+
+        if self.dry_run:
+            cmd.append("--dry-run")
+
+        return cmd
+
+    def deploy(self) -> bool:
+        """
+        Execute deployment.
+
+        Returns:
+            True if successful
+
+        Raises:
+            CloudflareDeployError: If deployment fails
+        """
+        # Validate
+        self.validate_project()
+
+        if not self.check_wrangler_installed():
+            raise CloudflareDeployError(
+                "wrangler CLI not installed. Install: npm install -g wrangler"
+            )
+
+        worker_name = self.get_worker_name()
+        env_suffix = f" ({self.env})" if self.env else ""
+        mode = "DRY RUN" if self.dry_run else "DEPLOY"
+
+        print(f"\n{mode}: {worker_name}{env_suffix}")
+        print(f"Project: {self.project_dir}\n")
+
+        # Build and run command
+        cmd = self.build_deploy_command()
+        exit_code, stdout, stderr = self.run_command(cmd)
+
+        # Output results
+        if stdout:
+            print(stdout)
+        if stderr:
+            print(stderr, file=sys.stderr)
+
+        if exit_code == 0:
+            status = "would be deployed" if self.dry_run else "deployed successfully"
+            print(f"\n✓ Worker {status}")
+            return True
+        else:
+            raise CloudflareDeployError("Deployment failed")
+
+
+def main():
+    """CLI entry point."""
+    parser = argparse.ArgumentParser(
+        description="Deploy Cloudflare Worker with wrangler",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog="""
+Examples:
+  python cloudflare-deploy.py
+  python cloudflare-deploy.py --env production
+  python cloudflare-deploy.py --project ./my-worker --env staging
+  python cloudflare-deploy.py --dry-run
+  python cloudflare-deploy.py --env prod --verbose
+        """
+    )
+
+    parser.add_argument(
+        "--project",
+        type=str,
+        default=".",
+        help="Path to Worker project directory (default: current directory)"
+    )
+
+    parser.add_argument(
+        "--env",
+        type=str,
+        choices=["production", "staging", "dev"],
+        help="Environment to deploy to (production, staging, dev)"
+    )
+
+    parser.add_argument(
+        "--dry-run",
+        action="store_true",
+        help="Preview deployment without actually deploying"
+    )
+
+    parser.add_argument(
+        "--verbose",
+        "-v",
+        action="store_true",
+        help="Enable verbose output"
+    )
+
+    args = parser.parse_args()
+
+    try:
+        deployer = CloudflareDeploy(
+            project_dir=args.project,
+            env=args.env,
+            dry_run=args.dry_run,
+            verbose=args.verbose
+        )
+
+        success = deployer.deploy()
+        sys.exit(0 if success else 1)
+
+    except CloudflareDeployError as e:
+        print(f"Error: {e}", file=sys.stderr)
+        sys.exit(1)
+    except KeyboardInterrupt:
+        print("\nDeployment cancelled by user", file=sys.stderr)
+        sys.exit(130)
+    except Exception as e:
+        print(f"Unexpected error: {e}", file=sys.stderr)
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()