opencode-skills-collection 4.0.67 → 4.0.69

package/bundled-skills/gcp-compute/SKILL.md

@@ -0,0 +1,319 @@
+---
+name: gcp-compute
+description: Manage Compute Engine instances and instance templates. Configure managed
+  instance groups and preemptible VMs. Use when deploying compute resources on GCP.
+category: devops
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant OS/platform tooling and privileged access where
+  noted. Docs-only; helper scripts and templates not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# GCP Compute Engine
+
+Deploy, manage, and scale Compute Engine virtual machines on Google Cloud Platform.
+
+## When to Use
+
+- Deploying web servers, application backends, or batch-processing workloads on GCP
+- Running workloads that need full OS-level control (unlike Cloud Run or App Engine)
+- Creating managed instance groups for auto-healing and auto-scaling behind a load balancer
+- Provisioning GPU-attached VMs for ML training or rendering pipelines
+- Cost-optimizing non-critical workloads with preemptible or spot VMs
+
+## Prerequisites
+
+- Google Cloud SDK (`gcloud`) installed and authenticated
+- A GCP project with the Compute Engine API enabled
+- IAM role `roles/compute.admin` or scoped roles for instance management
+
+```bash
+gcloud auth list
+gcloud config set project $PROJECT_ID
+gcloud services enable compute.googleapis.com
+```
+
+## Machine Types Reference
+
+| Family | Example | vCPUs | Memory | Use Case |
+|--------|---------|-------|--------|----------|
+| E2 | e2-micro | 0.25 | 1 GB | Dev/test, microservices |
+| E2 | e2-medium | 1 | 4 GB | Light web servers |
+| N2 | n2-standard-4 | 4 | 16 GB | General-purpose production |
+| N2 | n2-highmem-8 | 8 | 64 GB | In-memory caches, databases |
+| C2 | c2-standard-16 | 16 | 64 GB | Compute-intensive, HPC |
+
+```bash
+# List machine types available in a zone
+gcloud compute machine-types list --zones=us-central1-a --filter="name~'e2-'"
+
+# Create a custom machine type (6 vCPUs, 24 GB RAM)
+gcloud compute instances create custom-vm \
+  --custom-cpu=6 --custom-memory=24GB \
+  --zone=us-central1-a \
+  --image-family=debian-12 --image-project=debian-cloud
+```
+
+## Create an Instance
+
+```bash
+# Production instance with shielded VM and startup script
+gcloud compute instances create web-server \
+  --machine-type=e2-medium \
+  --zone=us-central1-a \
+  --image-family=debian-12 \
+  --image-project=debian-cloud \
+  --boot-disk-size=20GB \
+  --boot-disk-type=pd-balanced \
+  --tags=http-server,https-server \
+  --labels=env=production,team=backend \
+  --metadata=enable-oslogin=TRUE \
+  --shielded-secure-boot \
+  --shielded-vtpm \
+  --shielded-integrity-monitoring
+
+# Instance with a startup script and service account
+gcloud compute instances create app-server \
+  --machine-type=e2-standard-2 \
+  --zone=us-central1-a \
+  --image-family=ubuntu-2204-lts \
+  --image-project=ubuntu-os-cloud \
+  --boot-disk-size=50GB \
+  --metadata-from-file=startup-script=startup.sh \
+  --service-account=app-sa@${PROJECT_ID}.iam.gserviceaccount.com \
+  --scopes=cloud-platform
+
+# Instance with an additional data disk
+gcloud compute instances create db-server \
+  --machine-type=n2-highmem-4 \
+  --zone=us-central1-a \
+  --image-family=debian-12 --image-project=debian-cloud \
+  --boot-disk-size=20GB \
+  --create-disk=name=data-disk,size=200GB,type=pd-ssd,auto-delete=no
+```
+
+## Startup Script Example
+
+```bash
+#!/bin/bash
+# startup.sh - runs on first boot and every reboot
+set -euo pipefail
+apt-get update && apt-get install -y nginx
+systemctl enable nginx && systemctl start nginx
+curl -X PUT -H "Metadata-Flavor: Google" \
+  "http://metadata.google.internal/computeMetadata/v1/instance/guest-attributes/startup/status" \
+  -d "complete"
+```
+
+## Instance Templates and Managed Instance Groups
+
+```bash
+# Create an instance template
+gcloud compute instance-templates create web-template \
+  --machine-type=e2-medium \
+  --image-family=debian-12 --image-project=debian-cloud \
+  --boot-disk-size=20GB --tags=http-server \
+  --metadata-from-file=startup-script=startup.sh
+
+# Create a regional managed instance group (MIG) with health check
+gcloud compute health-checks create http http-health-check \
+  --port=80 --request-path=/healthz \
+  --check-interval=10s --timeout=5s \
+  --healthy-threshold=2 --unhealthy-threshold=3
+
+gcloud compute instance-groups managed create web-mig \
+  --template=web-template --size=3 \
+  --region=us-central1 \
+  --health-check=http-health-check --initial-delay=120
+
+# Configure autoscaling
+gcloud compute instance-groups managed set-autoscaling web-mig \
+  --region=us-central1 \
+  --min-num-replicas=2 --max-num-replicas=10 \
+  --target-cpu-utilization=0.65 --cool-down-period=90
+
+# Rolling update to a new template
+gcloud compute instance-groups managed rolling-action start-update web-mig \
+  --version=template=web-template-v2 \
+  --region=us-central1 --max-surge=3 --max-unavailable=0
+```
+
+## Preemptible and Spot VMs
+
+```bash
+# Spot VM (recommended over legacy preemptible)
+gcloud compute instances create spot-worker \
+  --machine-type=n2-standard-8 \
+  --zone=us-central1-a \
+  --image-family=debian-12 --image-project=debian-cloud \
+  --provisioning-model=SPOT \
+  --instance-termination-action=STOP
+
+# Spot instance template for batch MIG
+gcloud compute instance-templates create batch-template \
+  --machine-type=n2-standard-4 \
+  --image-family=debian-12 --image-project=debian-cloud \
+  --provisioning-model=SPOT \
+  --instance-termination-action=DELETE
+```
+
+## Snapshots and Images
+
+```bash
+# Create a snapshot
+gcloud compute disks snapshot web-server \
+  --zone=us-central1-a \
+  --snapshot-names=web-server-snap-$(date +%Y%m%d)
+
+# Scheduled snapshot policy
+gcloud compute resource-policies create snapshot-schedule daily-backup \
+  --region=us-central1 --max-retention-days=14 \
+  --daily-schedule --start-time=03:00
+
+gcloud compute disks add-resource-policies web-server \
+  --zone=us-central1-a --resource-policies=daily-backup
+
+# Create a custom image from an instance
+gcloud compute instances stop web-server --zone=us-central1-a
+gcloud compute images create web-golden-image \
+  --source-disk=web-server --source-disk-zone=us-central1-a \
+  --family=web-server --labels=version=v1
+```
+
+## Terraform Configuration
+
+```hcl
+resource "google_compute_instance" "web" {
+  name         = "web-server"
+  machine_type = "e2-medium"
+  zone         = "us-central1-a"
+  tags         = ["http-server", "https-server"]
+
+  boot_disk {
+    initialize_params {
+      image = "debian-cloud/debian-12"
+      size  = 20
+      type  = "pd-balanced"
+    }
+  }
+
+  network_interface {
+    subnetwork = google_compute_subnetwork.main.id
+    access_config {}
+  }
+
+  metadata_startup_script = file("${path.module}/startup.sh")
+
+  service_account {
+    email  = google_service_account.app.email
+    scopes = ["cloud-platform"]
+  }
+
+  shielded_instance_config {
+    enable_secure_boot          = true
+    enable_vtpm                 = true
+    enable_integrity_monitoring = true
+  }
+}
+
+resource "google_compute_instance_template" "web" {
+  name_prefix  = "web-"
+  machine_type = "e2-medium"
+
+  disk {
+    source_image = "debian-cloud/debian-12"
+    auto_delete  = true
+    boot         = true
+    disk_size_gb = 20
+  }
+
+  network_interface {
+    subnetwork = google_compute_subnetwork.main.id
+  }
+
+  lifecycle { create_before_destroy = true }
+}
+
+resource "google_compute_region_instance_group_manager" "web" {
+  name               = "web-mig"
+  base_instance_name = "web"
+  region             = "us-central1"
+
+  version {
+    instance_template = google_compute_instance_template.web.id
+  }
+
+  target_size = 3
+  named_port { name = "http"; port = 80 }
+
+  auto_healing_policies {
+    health_check      = google_compute_health_check.http.id
+    initial_delay_sec = 120
+  }
+}
+
+resource "google_compute_region_autoscaler" "web" {
+  name   = "web-autoscaler"
+  region = "us-central1"
+  target = google_compute_region_instance_group_manager.web.id
+
+  autoscaling_policy {
+    min_replicas    = 2
+    max_replicas    = 10
+    cooldown_period = 90
+    cpu_utilization { target = 0.65 }
+  }
+}
+```
+
+## Common Operations
+
+```bash
+# SSH into an instance
+gcloud compute ssh web-server --zone=us-central1-a
+
+# List all instances with status
+gcloud compute instances list \
+  --format="table(name,zone,status,machineType.basename())"
+
+# Stop / start / resize
+gcloud compute instances stop web-server --zone=us-central1-a
+gcloud compute instances set-machine-type web-server \
+  --machine-type=e2-standard-4 --zone=us-central1-a
+gcloud compute instances start web-server --zone=us-central1-a
+
+# View serial port output (debug startup scripts)
+gcloud compute instances get-serial-port-output web-server --zone=us-central1-a
+```
+
+## Troubleshooting
+
+| Symptom | Cause | Fix |
+|---------|-------|-----|
+| Instance stuck in STAGING | Quota exceeded or resource unavailable | Check quota with `gcloud compute project-info describe`; try another zone |
+| Startup script not running | Syntax errors or wrong metadata key | Check serial output; ensure key is `startup-script` not `startup_script` |
+| Cannot SSH | Firewall blocks port 22 or OS Login misconfigured | Add firewall rule for `tcp:22`; verify `enable-oslogin` metadata |
+| Preempted too often | Zone resource pressure | Use Spot VM with `STOP` action; spread across zones in a MIG |
+| Disk out of space | Boot disk too small | Use `gcloud compute disks resize`; enable `--storage-auto-increase` for data disks |
+| MIG not healing | Health check misconfigured or initial delay too short | Verify health check path returns 200; increase `--initial-delay` |
+
+## Related Skills
+
+- **gcp-networking** - VPC, firewall rules, and load balancers for Compute Engine
+- **terraform-gcp** - Provision Compute Engine resources with Infrastructure as Code
+- **gcp-gke** - When workloads are better suited for containers than VMs
+- **gcp-cloud-sql** - Managed databases that Compute Engine applications connect to
+
+## Limitations
+
+- Infrastructure commands can disrupt services: confirm target host/scope and have backups/snapshots before mutating state.
+- Docs-only import: upstream scripts and templates not bundled.
+

package/bundled-skills/gcp-gke/SKILL.md

@@ -0,0 +1,307 @@
+---
+name: gcp-gke
+description: Deploy and manage Google Kubernetes Engine clusters. Configure node pools,
+  networking, and workload identity. Use when running Kubernetes on GCP.
+category: devops
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant OS/platform tooling and privileged access where
+  noted. Docs-only; helper scripts and templates not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# Google Kubernetes Engine (GKE)
+
+Deploy, operate, and scale managed Kubernetes clusters on Google Cloud Platform.
+
+## When to Use
+
+- Running containerized microservices at scale with automatic scaling and healing
+- Workloads requiring fine-grained orchestration, service mesh, or custom scheduling
+- Teams already invested in Kubernetes tooling (Helm, Argo CD, Flux)
+- When Cloud Run's request-based model does not fit (long-running, stateful workloads)
+
+## Prerequisites
+
+- Google Cloud SDK (`gcloud`) and `kubectl` installed
+- APIs enabled: Kubernetes Engine, Compute Engine
+- IAM role `roles/container.admin` for cluster management
+
+```bash
+gcloud services enable container.googleapis.com compute.googleapis.com
+gcloud components install kubectl
+```
+
+## Standard vs Autopilot
+
+| Feature | Standard | Autopilot |
+|---------|----------|-----------|
+| Node management | You manage node pools | Google manages nodes |
+| Pricing | Pay per node (VM) | Pay per pod resource request |
+| GPU/TPU | Full support | Supported (with limits) |
+| DaemonSets | Allowed | Restricted |
+| Best for | Full control, specialized HW | Hands-off, cost-optimized |
+
+## Create a Standard Cluster
+
+```bash
+gcloud container clusters create prod-cluster \
+  --region=us-central1 --num-nodes=2 \
+  --machine-type=e2-standard-4 --disk-size=100 \
+  --enable-autoscaling --min-nodes=1 --max-nodes=5 \
+  --enable-autorepair --enable-autoupgrade \
+  --release-channel=regular \
+  --workload-pool=${PROJECT_ID}.svc.id.goog \
+  --enable-ip-alias --enable-network-policy \
+  --enable-shielded-nodes \
+  --logging=SYSTEM,WORKLOAD --monitoring=SYSTEM,WORKLOAD \
+  --labels=env=production,team=platform
+
+gcloud container clusters get-credentials prod-cluster --region=us-central1
+```
+
+## Create an Autopilot Cluster
+
+```bash
+gcloud container clusters create-auto autopilot-prod \
+  --region=us-central1 --release-channel=regular \
+  --workload-pool=${PROJECT_ID}.svc.id.goog \
+  --network=my-vpc --subnetwork=gke-subnet
+```
+
+## Node Pools
+
+```bash
+# High-memory pool with taint
+gcloud container node-pools create highmem-pool \
+  --cluster=prod-cluster --region=us-central1 \
+  --machine-type=n2-highmem-8 --disk-size=200 --disk-type=pd-ssd \
+  --num-nodes=1 --enable-autoscaling --min-nodes=0 --max-nodes=4 \
+  --node-labels=workload=memory-intensive \
+  --node-taints=dedicated=highmem:NoSchedule
+
+# GPU pool
+gcloud container node-pools create gpu-pool \
+  --cluster=prod-cluster --region=us-central1 \
+  --machine-type=n1-standard-8 \
+  --accelerator=type=nvidia-tesla-t4,count=1 \
+  --num-nodes=0 --enable-autoscaling --min-nodes=0 --max-nodes=4 \
+  --node-taints=nvidia.com/gpu=present:NoSchedule
+
+# Spot pool for batch workloads
+gcloud container node-pools create spot-pool \
+  --cluster=prod-cluster --region=us-central1 \
+  --machine-type=e2-standard-4 --spot \
+  --num-nodes=0 --enable-autoscaling --min-nodes=0 --max-nodes=20 \
+  --node-taints=cloud.google.com/gke-spot=true:NoSchedule
+```
+
+## Workload Identity
+
+```bash
+# Create GSA and grant permissions
+gcloud iam service-accounts create app-gsa
+gcloud projects add-iam-policy-binding ${PROJECT_ID} \
+  --member="serviceAccount:app-gsa@${PROJECT_ID}.iam.gserviceaccount.com" \
+  --role="roles/storage.objectViewer"
+
+# Create KSA and bind to GSA
+kubectl create namespace myapp
+kubectl create serviceaccount app-ksa --namespace=myapp
+gcloud iam service-accounts add-iam-policy-binding \
+  app-gsa@${PROJECT_ID}.iam.gserviceaccount.com \
+  --role=roles/iam.workloadIdentityUser \
+  --member="serviceAccount:${PROJECT_ID}.svc.id.goog[myapp/app-ksa]"
+kubectl annotate serviceaccount app-ksa --namespace=myapp \
+  iam.gke.io/gcp-service-account=app-gsa@${PROJECT_ID}.iam.gserviceaccount.com
+```
+
+## Deploying Workloads
+
+```yaml
+# deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: web-app
+  namespace: myapp
+spec:
+  replicas: 3
+  selector:
+    matchLabels: { app: web-app }
+  template:
+    metadata:
+      labels: { app: web-app }
+    spec:
+      serviceAccountName: app-ksa
+      containers:
+      - name: web
+        image: us-central1-docker.pkg.dev/PROJECT_ID/repo/web-app:v1.2.0
+        ports: [{ containerPort: 8080 }]
+        resources:
+          requests: { cpu: 250m, memory: 512Mi }
+          limits: { cpu: 500m, memory: 1Gi }
+        readinessProbe:
+          httpGet: { path: /healthz, port: 8080 }
+          initialDelaySeconds: 5
+        livenessProbe:
+          httpGet: { path: /healthz, port: 8080 }
+          initialDelaySeconds: 15
+      topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: topology.kubernetes.io/zone
+        whenUnsatisfiable: DoNotSchedule
+        labelSelector:
+          matchLabels: { app: web-app }
+---
+apiVersion: v1
+kind: Service
+metadata: { name: web-app, namespace: myapp }
+spec:
+  selector: { app: web-app }
+  ports: [{ port: 80, targetPort: 8080 }]
+  type: ClusterIP
+```
+
+## Ingress with Managed SSL
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: web-ingress
+  namespace: myapp
+  annotations:
+    kubernetes.io/ingress.class: "gce"
+    networking.gke.io/managed-certificates: "web-cert"
+    kubernetes.io/ingress.global-static-ip-name: "web-static-ip"
+spec:
+  rules:
+  - host: app.example.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service: { name: web-app, port: { number: 80 } }
+---
+apiVersion: networking.gke.io/v1
+kind: ManagedCertificate
+metadata: { name: web-cert, namespace: myapp }
+spec:
+  domains: [app.example.com]
+```
+
+```bash
+gcloud compute addresses create web-static-ip --global
+```
+
+## Terraform Configuration
+
+```hcl
+resource "google_container_cluster" "primary" {
+  name     = "prod-cluster"
+  location = "us-central1"
+
+  release_channel { channel = "REGULAR" }
+  workload_identity_config { workload_pool = "${var.project_id}.svc.id.goog" }
+
+  network    = google_compute_network.vpc.name
+  subnetwork = google_compute_subnetwork.gke.name
+
+  ip_allocation_policy {
+    cluster_secondary_range_name  = "pods"
+    services_secondary_range_name = "services"
+  }
+
+  private_cluster_config {
+    enable_private_nodes   = true
+    master_ipv4_cidr_block = "172.16.0.0/28"
+  }
+
+  network_policy { enabled = true }
+  logging_config { enable_components = ["SYSTEM_COMPONENTS", "WORKLOADS"] }
+  monitoring_config {
+    enable_components = ["SYSTEM_COMPONENTS", "WORKLOADS"]
+    managed_prometheus { enabled = true }
+  }
+
+  remove_default_node_pool = true
+  initial_node_count       = 1
+}
+
+resource "google_container_node_pool" "primary" {
+  name     = "primary-pool"
+  cluster  = google_container_cluster.primary.name
+  location = "us-central1"
+
+  initial_node_count = 2
+  autoscaling { min_node_count = 1; max_node_count = 5 }
+  management  { auto_repair = true; auto_upgrade = true }
+
+  node_config {
+    machine_type = "e2-standard-4"
+    disk_size_gb = 100
+    disk_type    = "pd-balanced"
+    oauth_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
+    shielded_instance_config {
+      enable_secure_boot          = true
+      enable_integrity_monitoring = true
+    }
+    metadata = { disable-legacy-endpoints = "true" }
+  }
+}
+
+resource "google_compute_subnetwork" "gke" {
+  name          = "gke-subnet"
+  ip_cidr_range = "10.0.0.0/20"
+  region        = "us-central1"
+  network       = google_compute_network.vpc.id
+
+  secondary_ip_range { range_name = "pods";     ip_cidr_range = "10.4.0.0/14" }
+  secondary_ip_range { range_name = "services"; ip_cidr_range = "10.8.0.0/20" }
+}
+```
+
+## Common Operations
+
+```bash
+gcloud container clusters list
+gcloud container clusters upgrade prod-cluster --region=us-central1 --master
+kubectl top nodes && kubectl top pods --namespace=myapp
+kubectl scale deployment web-app --replicas=5 --namespace=myapp
+kubectl autoscale deployment web-app --namespace=myapp --min=3 --max=20 --cpu-percent=70
+kubectl logs -f deployment/web-app --namespace=myapp --all-containers
+```
+
+## Troubleshooting
+
+| Symptom | Cause | Fix |
+|---------|-------|-----|
+| Pods stuck in `Pending` | No nodes with enough resources | Check autoscaler; add larger node pool; verify resource requests |
+| `ImagePullBackOff` | Wrong image path or missing AR access | Verify image URL; grant `roles/artifactregistry.reader` to node SA |
+| Workload Identity wrong account | KSA annotation missing | Re-annotate KSA; restart pods to pick up new token |
+| Nodes `NotReady` | Disk/memory pressure or network issue | Run `kubectl describe node`; check taints and conditions |
+| Ingress returns 502 | Backend pods failing health check | Verify readiness probe; check NEG health in Console |
+| Cluster create quota error | Insufficient regional CPU/IP quota | Request quota increase in IAM & Admin > Quotas |
+| Network policy not working | Not enabled on cluster | Recreate with `--enable-network-policy` or use Dataplane V2 |
+
+## Related Skills
+
+- **gcp-networking** - VPC, firewall rules, and load balancers for GKE clusters
+- **terraform-gcp** - Provision GKE clusters with Infrastructure as Code
+- **gcp-compute** - When workloads are better suited for VMs than containers
+- **gcp-cloud-sql** - Connecting GKE pods to Cloud SQL via sidecar proxy
+
+## Limitations
+
+- Infrastructure commands can disrupt services: confirm target host/scope and have backups/snapshots before mutating state.
+- Docs-only import: upstream scripts and templates not bundled.
+