mumucc 0.4.4 → 0.4.10

package/defaults/plugin-seed/marketplaces/claude-code-workflows/plugins/cloud-infrastructure/skills/hybrid-cloud-networking/SKILL.md

@@ -0,0 +1,256 @@
+---
+name: hybrid-cloud-networking
+description: Configure secure, high-performance connectivity between on-premises infrastructure and cloud platforms using VPN and dedicated connections. Use when building hybrid cloud architectures, connecting data centers to cloud, or implementing secure cross-premises networking.
+---
+
+# Hybrid Cloud Networking
+
+Configure secure, high-performance connectivity between on-premises and cloud environments using VPN, Direct Connect, ExpressRoute, Interconnect, and FastConnect.
+
+## Purpose
+
+Establish secure, reliable network connectivity between on-premises data centers and cloud providers (AWS, Azure, GCP, OCI).
+
+## When to Use
+
+- Connect on-premises to cloud
+- Extend datacenter to cloud
+- Implement hybrid active-active setups
+- Meet compliance requirements
+- Migrate to cloud gradually
+
+## Connection Options
+
+### AWS Connectivity
+
+#### 1. Site-to-Site VPN
+
+- IPSec VPN over internet
+- Up to 1.25 Gbps per tunnel
+- Cost-effective for moderate bandwidth
+- Higher latency, internet-dependent
+
+```hcl
+resource "aws_vpn_gateway" "main" {
+  vpc_id = aws_vpc.main.id
+  tags = {
+    Name = "main-vpn-gateway"
+  }
+}
+
+resource "aws_customer_gateway" "main" {
+  bgp_asn    = 65000
+  ip_address = "203.0.113.1"
+  type       = "ipsec.1"
+}
+
+resource "aws_vpn_connection" "main" {
+  vpn_gateway_id      = aws_vpn_gateway.main.id
+  customer_gateway_id = aws_customer_gateway.main.id
+  type                = "ipsec.1"
+  static_routes_only  = false
+}
+```
+
+#### 2. AWS Direct Connect
+
+- Dedicated network connection
+- 1 Gbps to 100 Gbps
+- Lower latency, consistent bandwidth
+- More expensive, setup time required
+
+**Reference:** See `references/direct-connect.md`
+
+### Azure Connectivity
+
+#### 1. Site-to-Site VPN
+
+```hcl
+resource "azurerm_virtual_network_gateway" "vpn" {
+  name                = "vpn-gateway"
+  location            = azurerm_resource_group.main.location
+  resource_group_name = azurerm_resource_group.main.name
+
+  type     = "Vpn"
+  vpn_type = "RouteBased"
+  sku      = "VpnGw1"
+
+  ip_configuration {
+    name                          = "vnetGatewayConfig"
+    public_ip_address_id          = azurerm_public_ip.vpn.id
+    private_ip_address_allocation = "Dynamic"
+    subnet_id                     = azurerm_subnet.gateway.id
+  }
+}
+```
+
+#### 2. Azure ExpressRoute
+
+- Private connection via connectivity provider
+- Up to 100 Gbps
+- Low latency, high reliability
+- Premium for global connectivity
+
+### GCP Connectivity
+
+#### 1. Cloud VPN
+
+- IPSec VPN (Classic or HA VPN)
+- HA VPN: 99.99% SLA
+- Up to 3 Gbps per tunnel
+
+#### 2. Cloud Interconnect
+
+- Dedicated (10 Gbps, 100 Gbps)
+- Partner (50 Mbps to 50 Gbps)
+- Lower latency than VPN
+
+### OCI Connectivity
+
+#### 1. IPSec VPN Connect
+
+- IPSec VPN with redundant tunnels
+- Dynamic routing through DRG
+- Good fit for branch offices and migration phases
+
+#### 2. OCI FastConnect
+
+- Private dedicated connectivity through Oracle or partner edge
+- Suitable for predictable throughput and lower-latency hybrid traffic
+- Commonly paired with DRG for hub-and-spoke designs
+
+## Hybrid Network Patterns
+
+### Pattern 1: Hub-and-Spoke
+
+```
+On-Premises Datacenter
+         ↓
+    VPN/Direct Connect
+         ↓
+    Transit Gateway (AWS) / vWAN (Azure)
+         ↓
+    ├─ Production VPC/VNet
+    ├─ Staging VPC/VNet
+    └─ Development VPC/VNet
+```
+
+### Pattern 2: Multi-Region Hybrid
+
+```
+On-Premises
+    ├─ Direct Connect → us-east-1
+    └─ Direct Connect → us-west-2
+            ↓
+        Cross-Region Peering
+```
+
+### Pattern 3: Multi-Cloud Hybrid
+
+```
+On-Premises Datacenter
+    ├─ Direct Connect → AWS
+    ├─ ExpressRoute → Azure
+    ├─ Interconnect → GCP
+    └─ FastConnect → OCI
+```
+
+## Routing Configuration
+
+### BGP Configuration
+
+```
+On-Premises Router:
+- AS Number: 65000
+- Advertise: 10.0.0.0/8
+
+Cloud Router:
+- AS Number: 64512 (AWS), 65515 (Azure), provider-assigned for GCP/OCI
+- Advertise: Cloud VPC/VNet CIDRs
+```
+
+### Route Propagation
+
+- Enable route propagation on route tables
+- Use BGP for dynamic routing
+- Implement route filtering
+- Monitor route advertisements
+
+## Security Best Practices
+
+1. **Use private connectivity** (Direct Connect/ExpressRoute/Interconnect/FastConnect)
+2. **Implement encryption** for VPN tunnels
+3. **Use VPC endpoints** to avoid internet routing
+4. **Configure network ACLs** and security groups
+5. **Enable VPC Flow Logs** for monitoring
+6. **Implement DDoS protection**
+7. **Use PrivateLink/Private Endpoints**
+8. **Monitor connections** with CloudWatch/Azure Monitor/Cloud Monitoring/OCI Monitoring
+9. **Implement redundancy** (dual tunnels)
+10. **Regular security audits**
+
+## High Availability
+
+### Dual VPN Tunnels
+
+```hcl
+resource "aws_vpn_connection" "primary" {
+  vpn_gateway_id      = aws_vpn_gateway.main.id
+  customer_gateway_id = aws_customer_gateway.primary.id
+  type                = "ipsec.1"
+}
+
+resource "aws_vpn_connection" "secondary" {
+  vpn_gateway_id      = aws_vpn_gateway.main.id
+  customer_gateway_id = aws_customer_gateway.secondary.id
+  type                = "ipsec.1"
+}
+```
+
+### Active-Active Configuration
+
+- Multiple connections from different locations
+- BGP for automatic failover
+- Equal-cost multi-path (ECMP) routing
+- Monitor health of all connections
+
+## Monitoring and Troubleshooting
+
+### Key Metrics
+
+- Tunnel status (up/down)
+- Bytes in/out
+- Packet loss
+- Latency
+- BGP session status
+
+### Troubleshooting
+
+```bash
+# AWS VPN
+aws ec2 describe-vpn-connections
+aws ec2 get-vpn-connection-telemetry
+
+# Azure VPN
+az network vpn-connection show
+az network vpn-connection show-device-config-script
+
+# OCI IPSec VPN
+oci network ip-sec-connection list
+oci network cpe list
+```
+
+## Cost Optimization
+
+1. **Right-size connections** based on traffic
+2. **Use VPN for low-bandwidth** workloads
+3. **Consolidate traffic** through fewer connections
+4. **Minimize data transfer** costs
+5. **Use dedicated private links** for high bandwidth
+6. **Implement caching** to reduce traffic
+
+
+## Related Skills
+
+- `multi-cloud-architecture` - For architecture decisions
+- `terraform-module-library` - For IaC implementation

package/defaults/plugin-seed/marketplaces/claude-code-workflows/plugins/cloud-infrastructure/skills/hybrid-cloud-networking/references/direct-connect.md

@@ -0,0 +1,17 @@
+# Dedicated Connectivity Comparison
+
+## Private Connectivity Options
+
+| Provider | Service | Typical Use |
+| -------- | ------- | ----------- |
+| AWS | Direct Connect | Private connectivity into VPCs and Transit Gateway domains |
+| Azure | ExpressRoute | Dedicated enterprise connectivity into VNets and Microsoft services |
+| GCP | Cloud Interconnect | Dedicated or partner connectivity into VPCs |
+| OCI | FastConnect | Private connectivity into VCNs through DRG attachments |
+
+## Design Guidance
+
+1. Prefer redundant circuits in separate facilities for production workloads.
+2. Terminate private links into central transit or hub networking layers.
+3. Use VPN as backup even when dedicated links are primary.
+4. Validate BGP advertisements, failover behavior, and MTU assumptions during testing.

package/defaults/plugin-seed/marketplaces/claude-code-workflows/plugins/cloud-infrastructure/skills/istio-traffic-management/SKILL.md

@@ -0,0 +1,321 @@
+---
+name: istio-traffic-management
+description: Configure Istio traffic management including routing, load balancing, circuit breakers, and canary deployments. Use when implementing service mesh traffic policies, progressive delivery, or resilience patterns.
+---
+
+# Istio Traffic Management
+
+Comprehensive guide to Istio traffic management for production service mesh deployments.
+
+## When to Use This Skill
+
+- Configuring service-to-service routing
+- Implementing canary or blue-green deployments
+- Setting up circuit breakers and retries
+- Load balancing configuration
+- Traffic mirroring for testing
+- Fault injection for chaos engineering
+
+## Core Concepts
+
+### 1. Traffic Management Resources
+
+| Resource            | Purpose                       | Scope         |
+| ------------------- | ----------------------------- | ------------- |
+| **VirtualService**  | Route traffic to destinations | Host-based    |
+| **DestinationRule** | Define policies after routing | Service-based |
+| **Gateway**         | Configure ingress/egress      | Cluster edge  |
+| **ServiceEntry**    | Add external services         | Mesh-wide     |
+
+### 2. Traffic Flow
+
+```
+Client → Gateway → VirtualService → DestinationRule → Service
+                   (routing)        (policies)        (pods)
+```
+
+## Templates
+
+### Template 1: Basic Routing
+
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: reviews-route
+  namespace: bookinfo
+spec:
+  hosts:
+    - reviews
+  http:
+    - match:
+        - headers:
+            end-user:
+              exact: jason
+      route:
+        - destination:
+            host: reviews
+            subset: v2
+    - route:
+        - destination:
+            host: reviews
+            subset: v1
+---
+apiVersion: networking.istio.io/v1beta1
+kind: DestinationRule
+metadata:
+  name: reviews-destination
+  namespace: bookinfo
+spec:
+  host: reviews
+  subsets:
+    - name: v1
+      labels:
+        version: v1
+    - name: v2
+      labels:
+        version: v2
+    - name: v3
+      labels:
+        version: v3
+```
+
+### Template 2: Canary Deployment
+
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: my-service-canary
+spec:
+  hosts:
+    - my-service
+  http:
+    - route:
+        - destination:
+            host: my-service
+            subset: stable
+          weight: 90
+        - destination:
+            host: my-service
+            subset: canary
+          weight: 10
+---
+apiVersion: networking.istio.io/v1beta1
+kind: DestinationRule
+metadata:
+  name: my-service-dr
+spec:
+  host: my-service
+  trafficPolicy:
+    connectionPool:
+      tcp:
+        maxConnections: 100
+      http:
+        h2UpgradePolicy: UPGRADE
+        http1MaxPendingRequests: 100
+        http2MaxRequests: 1000
+  subsets:
+    - name: stable
+      labels:
+        version: stable
+    - name: canary
+      labels:
+        version: canary
+```
+
+### Template 3: Circuit Breaker
+
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: DestinationRule
+metadata:
+  name: circuit-breaker
+spec:
+  host: my-service
+  trafficPolicy:
+    connectionPool:
+      tcp:
+        maxConnections: 100
+      http:
+        http1MaxPendingRequests: 100
+        http2MaxRequests: 1000
+        maxRequestsPerConnection: 10
+        maxRetries: 3
+    outlierDetection:
+      consecutive5xxErrors: 5
+      interval: 30s
+      baseEjectionTime: 30s
+      maxEjectionPercent: 50
+      minHealthPercent: 30
+```
+
+### Template 4: Retry and Timeout
+
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: ratings-retry
+spec:
+  hosts:
+    - ratings
+  http:
+    - route:
+        - destination:
+            host: ratings
+      timeout: 10s
+      retries:
+        attempts: 3
+        perTryTimeout: 3s
+        retryOn: connect-failure,refused-stream,unavailable,cancelled,retriable-4xx,503
+        retryRemoteLocalities: true
+```
+
+### Template 5: Traffic Mirroring
+
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: mirror-traffic
+spec:
+  hosts:
+    - my-service
+  http:
+    - route:
+        - destination:
+            host: my-service
+            subset: v1
+      mirror:
+        host: my-service
+        subset: v2
+      mirrorPercentage:
+        value: 100.0
+```
+
+### Template 6: Fault Injection
+
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: fault-injection
+spec:
+  hosts:
+    - ratings
+  http:
+    - fault:
+        delay:
+          percentage:
+            value: 10
+          fixedDelay: 5s
+        abort:
+          percentage:
+            value: 5
+          httpStatus: 503
+      route:
+        - destination:
+            host: ratings
+```
+
+### Template 7: Ingress Gateway
+
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: Gateway
+metadata:
+  name: my-gateway
+spec:
+  selector:
+    istio: ingressgateway
+  servers:
+    - port:
+        number: 443
+        name: https
+        protocol: HTTPS
+      tls:
+        mode: SIMPLE
+        credentialName: my-tls-secret
+      hosts:
+        - "*.example.com"
+---
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: my-vs
+spec:
+  hosts:
+    - "api.example.com"
+  gateways:
+    - my-gateway
+  http:
+    - match:
+        - uri:
+            prefix: /api/v1
+      route:
+        - destination:
+            host: api-service
+            port:
+              number: 8080
+```
+
+## Load Balancing Strategies
+
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: DestinationRule
+metadata:
+  name: load-balancing
+spec:
+  host: my-service
+  trafficPolicy:
+    loadBalancer:
+      simple: ROUND_ROBIN # or LEAST_CONN, RANDOM, PASSTHROUGH
+---
+# Consistent hashing for sticky sessions
+apiVersion: networking.istio.io/v1beta1
+kind: DestinationRule
+metadata:
+  name: sticky-sessions
+spec:
+  host: my-service
+  trafficPolicy:
+    loadBalancer:
+      consistentHash:
+        httpHeaderName: x-user-id
+        # or: httpCookie, useSourceIp, httpQueryParameterName
+```
+
+## Best Practices
+
+### Do's
+
+- **Start simple** - Add complexity incrementally
+- **Use subsets** - Version your services clearly
+- **Set timeouts** - Always configure reasonable timeouts
+- **Enable retries** - But with backoff and limits
+- **Monitor** - Use Kiali and Jaeger for visibility
+
+### Don'ts
+
+- **Don't over-retry** - Can cause cascading failures
+- **Don't ignore outlier detection** - Enable circuit breakers
+- **Don't mirror to production** - Mirror to test environments
+- **Don't skip canary** - Test with small traffic percentage first
+
+## Debugging Commands
+
+```bash
+# Check VirtualService configuration
+istioctl analyze
+
+# View effective routes
+istioctl proxy-config routes deploy/my-app -o json
+
+# Check endpoint discovery
+istioctl proxy-config endpoints deploy/my-app
+
+# Debug traffic
+istioctl proxy-config log deploy/my-app --level debug
+```