Platform Skills

Use this skill for hands-on help with Kubernetes, GitOps, cloud infrastructure, CI/CD, secrets management, service mesh, Linux administration, networking, and platform product thinking — whether you are a solo developer or part of a large platform team.

Pick the right tool for the job

If a task spans multiple areas, decide which layer owns the source of truth and keep the other layers consumers of that state.

Apply These Platform Rules

• Separate reusable platform building blocks from live environment configuration.
• Prefer GitOps pull-based reconciliation for cluster state and CI push-based automation for validation and packaging.
• Choose either Flux or Argo CD for a given ownership boundary unless the task is explicitly about migration between them.
• Keep Terraform responsible for bootstrapping clusters, cloud resources, secrets backends, and access primitives. Do not let Flux or Argo CD recreate those foundations unless there is a deliberate controller-based design.
• Use Flux or Argo CD for in-cluster add-ons, workloads, Helm releases, and app-level environment promotion after bootstrap.
• Use GitHub Actions for checks, plans, policy gates, artifact publishing, and promotion orchestration. Do not store long-lived environment truth in workflow YAML.
• Prefer OIDC or workload identity over static cloud credentials.
• Model environments explicitly. Promotion should be visible in Git history and reversible by commit rollback.
• For Linux and networking changes, validate at each layer before escalating: confirm the process is listening (ss -tulnp), then L3 reachability (ping), L4 connectivity (nc -zv), L7 response (curl -v), and security group / NACL rules last. Do not skip layers.
• For every Terraform change, enforce in order: terraform fmt -check -recursive, terraform validate, conftest test (OPA/Rego policy gates — runs after validate, before plan as a blocking gate), tflint --recursive, security scan (tfsec or checkov), then plan. Do not let format, lint, or policy failures reach the plan step.
• For every Helm chart change, enforce in order: helm lint --strict, helm template --debug, kubeconform -strict -summary on rendered output, checkov on rendered manifests, then helm test in-cluster. Fail CI on any helm lint --strict warning.
• Enforce a tag baseline on all cloud resources. The specific keys are an organizational decision. Use AWS default_tags (provider level) or Azure merge(local.common_tags, {...}) (module local) so the baseline is applied once, not repeated per resource. Back it with AWS Tag Policies or Azure Policy so resources created outside Terraform are also covered.

Structure the Response

For design or implementation work, provide output in this order:

1. Target architecture and ownership boundaries
2. Repository or directory layout
3. Identity, secrets, and promotion model
4. Validation and deployment workflow
5. Risks, tradeoffs, and migration path

When asked to generate code, start from the thinnest useful slice that proves the pattern and note which layer remains intentionally out of scope.

Pick the Right Reference Files

Load only the files needed for the current request.

Slash Commands

For explicit, repeatable workflows use these commands:

• /platform-skills:debug — structured troubleshooting for any platform symptom
• /platform-skills:review — production-readiness review of any manifest, Terraform, or workflow
• /platform-skills:terraform — full fmt/validate/tflint/security pipeline + blast radius review
• /platform-skills:checkov — Checkov bootstrap, static and plan-level Terraform scanning for AWS/Azure/GCP/EKS, private GitHub module auth via gh CLI, pre-commit generation, multi-format output, baseline, and AI-generated fix mode
• /platform-skills:trivy — scan container images, filesystems, git repos, and existing SBOMs for CVEs, secrets, and license violations; three-layer wizard routes intent → goal → tuned scan; continuous cluster monitoring via Trivy Operator (Flux HelmRelease); hard handoffs to Checkov (IaC), Kyverno (admission), and supply-chain (SBOM generation/signing)
• /platform-skills:fluxcd — FluxCD entry point: routes to debug (live cluster issue), audit (repo health check), or helm (chart review) based on your input
• /platform-skills:gitops debug — Flux CD and Argo CD live cluster troubleshooting (5-workflow structured debug)
• /platform-skills:gitops audit — Flux CD GitOps repository 6-phase audit (discovery, validation, API compliance, best practices, security, report)
• /platform-skills:linkerd — Linkerd mTLS, injection, policy, and multi-cluster diagnostics
• /platform-skills:linux — Linux administration, DNS, load balancing, VPC/VNet, and connectivity troubleshooting
• /platform-skills:product — product thinking, friction audits, DevEx, RFC/ADR, incident updates, post-mortems
• /platform-skills:compliance — SOC 2 gap analysis, control implementation, evidence collection, and Checkov remediation for Terraform
• /platform-skills:helmcheck — Helm chart scaffolding, structural review, and security audit with full lint/validation pipeline
• /platform-skills:mcp — MCP server/client scaffolding, protocol review, and integration debugging
• /platform-skills:aws-profile — discover, switch, and validate AWS profiles for MCP servers across VS Code and Claude Code
• /platform-skills:observability — instrument services, build dashboards, write alerts, run load tests, plan capacity
• /platform-skills:document — generate docstrings, OpenAPI specs, documentation sites, and getting started guides
• /platform-skills:datadog — Datadog Agent setup, APM instrumentation, monitors, dashboards, SLOs, pup CLI operations, LLM Observability instrumentation, evaluators, and debugging
• /platform-skills:dynatrace — OneAgent deployment, instrumentation, anomaly detection, SLOs, and debugging
• /platform-skills:commit — analyze diff, generate conventional commit message, stage files atomically, validate message
• /platform-skills:opa — generate Rego policies, write unit tests, run fmt/regal/verify pipeline, explain or debug policies
• /platform-skills:kyverno — generate, test, audit, debug, or migrate Kyverno CEL-based admission policies
• /platform-skills:pr-review — comprehensive PR review: cost, drift, ownership, compliance, upgrade, rollback
• /platform-skills:triage — triage a PR comment (bot or human): classify as ACTIONABLE_FIX / INFORMATIONAL / NOT_APPLICABLE, produce the exact fix if needed, and write the thread reply
• /platform-skills:keda — design, generate, debug, or review KEDA ScaledObject/ScaledJob autoscaling
• /platform-skills:karpenter — install, generate NodePool/EC2NodeClass, debug provisioning, plan capacity before rollout, audit scale history, migrate from Cluster Autoscaler, or upgrade (including v0→v1 CRD migration)
• /platform-skills:self-improve — bootstrap global or project-local .learnings/ workspace (init global/init local), log/review/promote learnings and errors, status overview, and migrate between scopes
• /platform-skills:supply-chain — sign images, generate and attest SBOMs, run CVE severity gates, enforce image signatures in Kubernetes, and generate SLSA Level 2 provenance
• /platform-skills:runtime-security — deploy Falco with eBPF, write custom rules, route alerts, debug why a rule is not firing, and bridge Falco signals to Kyverno admission enforcement
• /platform-skills:chaos — install Litmus Chaos or Chaos Mesh, generate fault experiments, schedule recurring chaos, run structured GameDay, debug stuck experiments, report results
• /platform-skills:dora — instrument DORA metrics in GitHub Actions, generate Grafana dashboards, benchmark against performance bands, debug missing metric data
• /platform-skills:awesome-docs — generate any animated Markdown document (README, architecture guide, runbook, tutorial, RFC, post-mortem, or custom), convert existing Markdown to animated, update diagrams, diff for staleness, audit quality, preview locally, or export to Confluence/Notion HTML
• /platform-skills:aws — CloudFront distributions, WAF web ACLs, Lambda@Edge, CloudFront Functions, Firewall Manager multi-account enforcement, and Terraform module generation with best practices
• /platform-skills:composite-actions — generate a full composite action repo scaffold, review an existing action.yml, harden with SHA pinning and env isolation, or generate a test workflow
• /platform-skills:renovate — generate renovate.json for any repo, or emit a GHA workflow to validate it on PR
• /platform-skills:setup-agents — scaffold multi-agent AI configs for any repo: ranked scan, interview-driven, generate/upgrade/add/review
• Working Flux CD examples: examples/fluxcd/