| name | platform-sre |
| description | Read-only SRE / diagnostics for Kubernetes clusters on Talos Linux. Trigger when the user wants to review cluster health, run a reliability review, scan for security drift, check certificate expiry / predict a cert outage, review vulnerabilities (CVE / image scan / Talos+Kubernetes version currency / supply chain), produce a platform maturity report (scored), or remediate a finding via GitOps (open a PR that ArgoCD syncs). Phrases: "check the cluster", "is dev healthy", "health of staging", "reliability review", "security review", "any privileged pods", "are any certs expiring", "any CVEs / scan the images", "are we behind on Talos", "maturity report", "score the platform", "fix the missing probes / PDB", "remediate this", "open a PR for the drift". Always asks which cluster first (dev / staging / prod); defaults to dev and never the current kube context. Refuses any mutating command — read-only except remediation, which changes git (a PR), never the cluster. |
| allowed-tools | Bash(kubectl:*) Bash(talosctl:*) Bash(python3:*) Bash(git:*) Bash(gh:*) |
platform-sre
Evidence-grounded SRE for Kubernetes on Talos. It runs against any cluster a
team owns — the book's local Docker lab (spikes/talos-gitops/: ops hub +
dev / staging / prod spokes) or a real organisation's clusters. It
reads clusters to find real problems, scores platform maturity, and (only
when asked) remediates through GitOps — never by touching a cluster directly.
Running deliverable of the book Zero to Autonomous AI-SRE on Talos; each chapter
adds one capability.
Core Rules
- Ask which cluster first. Resolve a named cluster (
dev / staging /
prod, or any kube context). If none is named, default to dev — never the
current kube context. Skip the prompt only if the user already named one.
- Read-only by default. Every capability uses the
kube.py wrappers, which
allow-list read verbs. The only state-changing path is remediate.py, and it
changes git (opens a PR); ArgoCD reconciles after a human merges.
- Show every command before running it. The scripts echo each
kubectl/talosctl invocation to stderr. Summarize findings from what they print.
- Cluster guard.
prerequisites.enforce() refuses an unknown context — the
cluster must exist in kubeconfig. (No repo guard: the skill targets clusters,
not one checkout, so it works for any org.)
- Steps run in order, fail fast. Always run preflight; stop and report on
failure — don't try to recover.
Capabilities (one per chapter)
| Ch | Script | Purpose |
|---|
| 1–2 | prerequisites.py | guards + lab inventory; the safe entry point |
| 3 | health.py | nodes / etcd / control-plane health |
| 3 | reliability.py | probes, replicas, PDBs |
| 4 | security_drift.py | privileged, runAsRoot, hostPath, NetworkPolicy |
| 4 | certs.py | cert expiry → outage prediction |
| 4 | report.py | scored platform maturity report |
| 5 | remediate.py | detect → open GitOps PR → ArgoCD syncs on merge |
| 6 | vuln.py | Talos/k8s version currency, image supply-chain, CVE scan (trivy/grype) |
| 6 | upgrade.py | upgrade readiness: version skew, deprecated-API preflight (pluto/kubent), A/B plan |
| 7 | worthiness.py | "is this even a k8s workload?" advisory (service count / scale / autoscaling) |
| 7 | — | the same skill runs unchanged against bare-metal clusters (just the kube/talos API) |
Follow the instructions in references/workflow.md.
