platform-skills

Migrate from the retired ingress-nginx controller to Kubernetes Gateway API, and design, debug, and review Gateway API ingress. Covers annotation inventory and risk triage, ingress2gateway conversion, implementation choice (Envoy Gateway default, Cilium, Istio, NGINX Gateway Fabric, AWS Load Balancer Controller), CRD channel and lifecycle, shared-Gateway ownership, cert-manager listener TLS, Flux layering, parallel-run DNS cutover, and rollback. Use when asked to "migrate off ingress-nginx", "convert my Ingresses to HTTPRoute", "set up Gateway API", "why is my HTTPRoute not attached", or "plan the ingress cutover". Flux reconciliation stuck → /platform-skills:gitops. East-west HTTPRoute in a mesh → /platform-skills:linkerd.

Design, review, secure, and debug GitHub Actions workflows — reusable workflows, OIDC federation, SHA pinning, token scoping, promotion orchestration, and CI failure diagnosis.

Design, review, secure, and debug GitHub Actions workflows — reusable workflows, OIDC federation, SHA pinning, token scoping, promotion orchestration, and CI failure diagnosis.

Flux CD and Argo CD — two modes. debug: five structured debug workflows for live clusters (installation, source, HelmRelease, Kustomization, ResourceSet) producing a five-section report. audit: six-phase read-only repo analysis (discovery, validation, API compliance, best practices, security) producing a prioritised Critical/Warning/Info report.

Flux CD and Argo CD — two modes. debug: five structured debug workflows for live clusters (installation, source, HelmRelease, Kustomization, ResourceSet) producing a five-section report. audit: six-phase read-only repo analysis (discovery, validation, API compliance, best practices, security) producing a prioritised Critical/Warning/Info report.

Scaffold, lint, review, security-audit, test, and upgrade-verify Helm charts. Runs an interactive interview to build production-ready charts from scratch. Covers chart structure, values design, schema validation, kubeconform, helm diff, and multi-environment scaffolding. Use when asked to "create a helm chart", "lint my chart", "review my helm chart", "check helm security", "generate values schema", "run helm diff", or "add helm tests".

Scaffold, lint, review, security-audit, test, and upgrade-verify Helm charts. Runs an interactive interview to build production-ready charts from scratch. Covers chart structure, values design, schema validation, kubeconform, helm diff, and multi-environment scaffolding. Use when asked to "create a helm chart", "lint my chart", "review my helm chart", "check helm security", "generate values schema", "run helm diff", or "add helm tests".

Design, install, debug, review, plan capacity, audit scaling history, migrate from Cluster Autoscaler, and upgrade Karpenter v1.x on EKS. Covers NodePool, EC2NodeClass, NodeClaim, Spot diversity, disruption strategy, Pod Identity/IRSA, interruption queue, private clusters, AMI rotation, and GitOps integration. Use when asked to "set up Karpenter", "debug why nodes aren't provisioning", "review my NodePool", "what would Karpenter provision for this workload", "why did this node terminate", "migrate from CA", or "upgrade Karpenter".

Design, install, debug, review, plan capacity, audit scaling history, migrate from Cluster Autoscaler, and upgrade Karpenter v1.x on EKS. Covers NodePool, EC2NodeClass, NodeClaim, Spot diversity, disruption strategy, Pod Identity/IRSA, interruption queue, private clusters, AMI rotation, and GitOps integration. Use when asked to "set up Karpenter", "debug why nodes aren't provisioning", "review my NodePool", "what would Karpenter provision for this workload", "why did this node terminate", "migrate from CA", or "upgrade Karpenter".

Design, debug, and review KEDA ScaledObject/ScaledJob autoscaling. Covers all major scalers (Prometheus, SQS, Kafka, Redis, Cron, HTTP Add-on, Azure Service Bus), TriggerAuthentication, scaling lifecycle tuning, GitOps integration, and troubleshooting. Use when asked to "add KEDA autoscaling", "debug why my ScaledObject isn't scaling", "review my KEDA config", or "generate a ScaledObject for <trigger>".

Design, debug, and review KEDA ScaledObject/ScaledJob autoscaling. Covers all major scalers (Prometheus, SQS, Kafka, Redis, Cron, HTTP Add-on, Azure Service Bus), TriggerAuthentication, scaling lifecycle tuning, GitOps integration, and troubleshooting. Use when asked to "add KEDA autoscaling", "debug why my ScaledObject isn't scaling", "review my KEDA config", or "generate a ScaledObject for <trigger>".

Find, live-validate, map the blast radius of, and revoke leaked secrets with Kingfisher (MongoDB) — across a local repo, Git history, a GitHub/GitLab/Bitbucket org, S3/GCS, Docker images, Slack, Jira, Confluence, Teams, or Postman. Covers local CLI scanning, direct validate/revoke without a scan, baseline management (track only new secrets), kingfisher.yaml policy, CI diff-scan gates, and pre-commit/Husky hooks. Use when asked to "scan for secrets", "is this key still live", "what can this credential reach", "revoke this token", "did we leak a secret", or "block new secrets in CI". Pattern-only secret scan bundled with a CVE pass → /platform-skills:trivy. Secrets-context safety in workflow YAML → /platform-skills:zizmor. Storing/rotating secrets inside the cluster → /platform-skills:secrets.

Find, live-validate, map the blast radius of, and revoke leaked secrets with Kingfisher (MongoDB) — across a local repo, Git history, a GitHub/GitLab/Bitbucket org, S3/GCS, Docker images, Slack, Jira, Confluence, Teams, or Postman. Covers local CLI scanning, direct validate/revoke without a scan, baseline management (track only new secrets), kingfisher.yaml policy, CI diff-scan gates, and pre-commit/Husky hooks. Use when asked to "scan for secrets", "is this key still live", "what can this credential reach", "revoke this token", "did we leak a secret", or "block new secrets in CI". Pattern-only secret scan bundled with a CVE pass → /platform-skills:trivy. Secrets-context safety in workflow YAML → /platform-skills:zizmor. Storing/rotating secrets inside the cluster → /platform-skills:secrets.

Cluster baseline scaffolding, RBAC diagnosis and generation, workload hardening, and structured pod/scheduling debug for plain Kubernetes across all distributions.

Cluster baseline scaffolding, RBAC diagnosis and generation, workload hardening, and structured pod/scheduling debug for plain Kubernetes across all distributions.

Check Kubernetes manifests, Helm charts, Kustomize overlays and live clusters against NSA-CISA, MITRE ATT&CK, CIS (EKS, AKS, GKE, vanilla) and SOC2 with the Kubescape CLI. Covers framework choice, score and severity gates, PR gates that fail only on new findings (--baseline), exceptions that actually suppress, controls configuration, auto-fix, Kubescape's CEL admission policy library, and one-off image scans. Interactive when run without arguments. Use when asked to "scan my manifests", "how secure is my cluster", "run a CIS benchmark", "NSA hardening check", "add a Kubernetes security gate to CI", "accept this finding", "fix what Kubescape found", or "run kubescape". Continuous in-cluster scanning, runtime alerts, NetworkPolicies from traffic → /platform-skills:kubescape-operator. Image CVE gates → /platform-skills:trivy. Admission with Kyverno → /platform-skills:kyverno. Terraform → /platform-skills:checkov.

Check Kubernetes manifests, Helm charts, Kustomize overlays and live clusters against NSA-CISA, MITRE ATT&CK, CIS (EKS, AKS, GKE, vanilla) and SOC2 with the Kubescape CLI. Covers framework choice, score and severity gates, PR gates that fail only on new findings (--baseline), exceptions that actually suppress, controls configuration, auto-fix, Kubescape's CEL admission policy library, and one-off image scans. Interactive when run without arguments. Use when asked to "scan my manifests", "how secure is my cluster", "run a CIS benchmark", "NSA hardening check", "add a Kubernetes security gate to CI", "accept this finding", "fix what Kubescape found", or "run kubescape". Continuous in-cluster scanning, runtime alerts, NetworkPolicies from traffic → /platform-skills:kubescape-operator. Image CVE gates → /platform-skills:trivy. Admission with Kyverno → /platform-skills:kyverno. Terraform → /platform-skills:checkov.

Install, tune and troubleshoot the Kubescape operator for continuous in-cluster security — posture scans on every change, vulnerabilities filtered to packages that actually load (relevancy), eBPF runtime threat detection against learned container profiles, NetworkPolicies generated from observed traffic, SecurityException resources with an expiry, and Prometheus metrics and alerts. Flux or Argo CD install with a capability matrix, preflight for kernel and overlap with Falco or Trivy Operator, upgrade and rollback. Interactive when run without arguments. Use when asked to "install kubescape in the cluster", "continuous kubernetes security scanning", "which CVEs actually run", "runtime alerts for containers", "generate network policies from traffic", "kubescape operator not working", or "node-agent crashloop". One-off scans, CIS audits and the PR gate → /platform-skills:kubescape. Falco rules → /platform-skills:runtime-security. Trivy Operator → /platform-skills:trivy.

Install, tune and troubleshoot the Kubescape operator for continuous in-cluster security — posture scans on every change, vulnerabilities filtered to packages that actually load (relevancy), eBPF runtime threat detection against learned container profiles, NetworkPolicies generated from observed traffic, SecurityException resources with an expiry, and Prometheus metrics and alerts. Flux or Argo CD install with a capability matrix, preflight for kernel and overlap with Falco or Trivy Operator, upgrade and rollback. Interactive when run without arguments. Use when asked to "install kubescape in the cluster", "continuous kubernetes security scanning", "which CVEs actually run", "runtime alerts for containers", "generate network policies from traffic", "kubescape operator not working", or "node-agent crashloop". One-off scans, CIS audits and the PR gate → /platform-skills:kubescape. Falco rules → /platform-skills:runtime-security. Trivy Operator → /platform-skills:trivy.

Generate, test, audit, debug, and migrate Kyverno policies using the new CEL-based policy types (ValidatingPolicy, MutatingPolicy, GeneratingPolicy, ImageValidatingPolicy — all apiVersion policies.kyverno.io/v1). Covers matchConstraints, matchConditions, CEL validations/mutations, generator.Apply(), Audit→Deny promotion, PolicyException, kyverno-cli testing, and migration from legacy ClusterPolicy or PodSecurityPolicy. Use when asked to "write a Kyverno policy", "test a ValidatingPolicy", "audit my cluster for violations", "why is my policy not firing", or "migrate from ClusterPolicy".