Deploy a virtual machine in a Kube-DC project with SSH, cloud-init, optional external access, and an optional gated Dedicated GPU VM profile. Use for ordinary VMs and whole-device GPU VMs that require platform preflight and non-migration safeguards.
Deploy a containerized application to a Kube-DC project with optional database, service exposure, persistent storage, and gated Shared GPU acceleration. Use for Helm or raw CPU workloads and for Shared GPU requests that must go through the platform preview/create API.
Manage Kube-DC storage resources — create S3 buckets (ObjectBucketClaim), DataVolumes for VMs, and PersistentVolumeClaims for containers.
Manage Kube-DC managed Kubernetes clusters — scale worker pools, upgrade versions, access kubeconfig, and monitor status. Covers day-2 operations via kubectl patch.
Create and manage Kube-DC DatabaseCredentialPolicy (DBCP) resources — project-scoped CRDs that rotate database passwords on a tenant-chosen schedule and project them into a Kubernetes Secret. Works against KdcDatabase (PostgreSQL via CNPG / MariaDB via mariadb-operator). Use this for application credentials on managed databases. For the database itself use create-database. For TLS use manage-certificates. For application secrets unrelated to databases use manage-secrets.
Create and operate per-project encryption keys (KMSKey) backed by OpenBao Transit. Use for encrypting opaque payloads ≤ 64 KiB directly, or for envelope encryption of larger blobs (files, database fields, message-queue messages). Plaintext NEVER leaves OpenBao — workloads call encrypt/decrypt by referencing the key, not by holding key material. The same KMSKey type powers managed-K8s etcd encryption-at-rest. For storing whole secrets use manage-secrets. For TLS certificates use manage-certificates.
Create and manage Kube-DC ManagedSecrets — project-scoped secrets backed by OpenBao, optionally projected into a Kubernetes Secret via External Secrets Operator. Use this for storing API tokens, OAuth client secrets, signing keys, third-party credentials. For rotated database passwords use manage-database-credentials (the parent KdcDatabase comes from create-database). For encryption keys use manage-kms. For TLS certificates use manage-certificates.
Request and manage x509 certificates in a Kube-DC project — ManagedCertificate resources backed by either the Organization's private intermediate CA (mTLS, internal services, code signing) or a public ACME issuer (Let's Encrypt by default). Certificates auto-renew before expiry; the result lands in a Kubernetes Secret your workloads mount. For HTTPS via Gateway / HTTPRoute use the expose-service skill — it auto-creates the ManagedCertificate. Use this skill directly only for mTLS, client certs, code signing, or custom durations.