openshift-online

Install and verify Ambient Code Platform on an OpenShift cluster using quay.io images. Use when deploying Ambient to any OpenShift namespace — production, ephemeral PR test instances, or developer clusters. Covers secrets, kustomize deploy, rollout verification, and troubleshooting.

Deploy a PR's images (api-server, control-plane, runner) to any OpenShift namespace for integration testing. Supports full SSO deployments (install-openshift.sh) and lightweight dev-mode deployments (install-standard.sh).

Log one or more Jira issues to the ENGPROD project with the acp component pre-filled. Gathers context to make issues agent-actionable from cold start. Use this whenever work needs tracking in Jira -- creating stories, filing bugs, logging tasks, opening spikes, creating epics, or any time the user says "create a jira", "log this", "file a bug", "new ticket", "open a story", "track this", "create tickets", "batch create", or provides a bullet list of work items. Supports single tickets and batch creation from bullet lists. Triggers on: "log jira", "create jira", "file a bug", "new ticket", "open a story", "jira issue", "track this work", "open a jira", "create a ticket", "create tickets", "batch tickets", "log these items".

Deploy a Kind cluster with OpenShell gateway mode, apply tenant fleet definitions via acpctl apply -k, set up Vertex/Google credentials, spin up sandbox sessions, and configure local openshell CLI connectivity. Use this skill whenever the user wants to test gateway-provisioned sandboxes, create credentials in tenants, debug sandbox provisioning, connect the openshell CLI to a gateway, or run dual-tenant tests. You SHOULD reach for this skill on: "kind-up", "kind cluster", "openshell gateway", "gateway mode", "OPENSHELL_USE_GATEWAY", "sandbox provisioning", "dual-tenant", "tenant-a", "tenant-b", "vertex credential", "spin up a sandbox", "credential in tenant", "openshell sandbox list", "gateway connectivity", "connect to the gateway", "mtls", "port-forward gateway", "acpctl apply -k", "local development".

Upgrade the rh-trex-ai upstream framework dependency in ambient-api-server. Handles version bump, compilation verification, breaking change detection, test execution, and go.sum cleanup. Use when: "upgrade rh-trex-ai", "bump upstream", "update trex", "new upstream version", "upgrade framework", "pull in upstream changes", "update rh-trex-ai to latest".

Top-level autonomous orchestrator that reconciles all specs against the codebase. Reads skills/RECONCILE.md for checkpoint state, runs field-level gap analysis, plans waves, and executes the full-stack-pipeline per wave. Idempotent: safe to run repeatedly -- produces the same result for the same spec+code state. Use when: "reconcile everything", "run full reconciliation", "what's the gap across all specs", "autonomous build", "just do it", "build everything", "reconcile specs to code", "spec coverage", "what's left to implement", "implementation status".

Manages Ambient Code Platform development clusters (kind) for testing changes locally. Use when deploying PRs to kind, bringing up local clusters, rebuilding images, troubleshooting pod issues, or running benchmarks. Triggers on: "test in kind", "deploy locally", "kind cluster", "rebuild images", "pod crashing", "bring up cluster", "kind-up", "dev environment", "local dev".

Comprehensive workflow to audit the `ambient-ui` component's ui & ux. Use after any changes are made to the `ambient-ui` user interface.

Analyze OCP version availability across OCM release channels and marketplace enablement (ROSA Classic, ROSA HCP, OSD GCP). Validates channel promotion status and marketplace availability. Exits 1 on validation FAIL for GA targets missing from required channels or marketplaces. Generates HTML and JSON reports.

Comprehensive gap analysis between OpenShift versions covering AWS STS policies, GCP WIF policies, feature gates, and OCP admin gate acknowledgments. Use when performing complete version upgrade assessment for managed OpenShift (OSD, ROSA). Exits 1 if any validation check (CHECK #1-7) fails; exits 0 if all checks pass. CHECK #8 (Feature Gates) is Info only.

Analyze OCM version gate configurations for OpenShift upgrade releases. Verifies that version gates exist for target OCP versions and checks metadata/configurations. Gracefully handles missing CLI tools or tokens by falling back to high-fidelity mock data. Automatically generates comprehensive reports in HTML and JSON formats.

Analyze AWS STS (Security Token Service) IAM policy gaps between OpenShift versions. Use when comparing AWS STS policies across OpenShift versions. Identifies new permissions, removed permissions, and changed permission scopes. Exits 0 when validation passes, exits 1 when validation fails or on execution error. Automatically generates comprehensive reports in HTML and JSON formats.

Analyze OpenShift feature gate differences between versions. Identifies new feature gates, removed gates, and default enablement changes. Logs detected feature gate changes but always exits 0 on successful execution. Automatically generates comprehensive reports in HTML and JSON formats.

Analyze GCP Workload Identity Federation (WIF) policy gaps between OpenShift versions. Use when comparing WIF configurations, IAM roles, and service account permissions across OpenShift versions. Exits 0 when validation passes, exits 1 when validation fails or on execution error. Automatically generates comprehensive reports in HTML and JSON formats.

Analyze OCP admin gate acknowledgments for upgrade readiness. Verifies that admin gates from baseline version are properly acknowledged in target version. Identifies missing acknowledgment files or unacknowledged gates that would block upgrades. Automatically generates comprehensive reports in HTML and JSON formats.

One-step automated Prow failure fix workflow. Analyzes latest failed CI job, generates required files (AWS STS policies, GCP WIF templates, acknowledgments), validates, and creates PR to managed-cluster-config. Automatic temporary directory cleanup. Recommended for CI/CD pipelines and automated remediation.

Guided exploration of the HostedCluster create flow from API types through GKE provisioning

Process GCP HCP meeting notes/transcripts into reviewed Jira updates — extracts action items, presents changes for approval, executes via MCP, and generates a Slack summary.

Use when working on GCP HCP-related code or design in any of the GCP HCP repositories: hypershift (platform/gcp/, GCP provider, GCP-related tests), gcp-hcp-infra (Terraform, ArgoCD, infrastructure), gcp-hcp-cli, cls-backend, cls-controller, or when creating or reviewing design decisions, or needing architectural context for GCP Hosted Control Planes on GKE. Accepts optional topic filter: networking, identity, observability, infrastructure, automation, governance, storage, operators, testing, incidents, slo.

Post a biweekly Agentic SDLC pilot update comment to GCP-579, gathering Jira and GitHub activity for the lookback period.

Use when adding a new GCP service account for Workload Identity Federation (WIF) in HyperShift and related GCP HCP repositories. Covers e2e plumbing, CI pipeline, API types, IAM bindings, CRD regeneration, CLS backend/controller propagation, and CLI updates across hypershift, openshift/release, gcp-hcp-infra, cls-backend, cls-controller, and gcp-hcp-cli.

Use when an implementation plan in gcp-hcp may have drifted from actual code, or when code may have drifted from the plan's design intent. Typically after a feature has landed or a PR has merged. Checks API surface, behavior, interfaces, and structure across repositories.

This skill should be used when tracing ManifestWork resources through the Maestro system to find relationships between user-created work names, resource IDs, and applied manifests, or to debug manifest application issues across the management cluster and database.

This skill should be used when tracing resource requests through the Maestro system to debug resource lifecycle issues, track request flow from client to agent and back, or troubleshoot failures in resource creation, update, or deletion operations across the server-agent-server pipeline. Supports both Kubernetes log files and ARO HCP Kusto CSV exports.

Sets up a long-running Maestro cluster environment using Azure ARO-HCP infrastructure with both service and management clusters

Diagnoses failed Maestro cluster deployments by analyzing Helm releases, pod status, and resource conflicts

Runs end-to-end or upgrade tests on existing long-running Maestro clusters deployed in Azure AKS

Discover ARO Classic Kusto endpoints available to the currently logged-in Azure user. Trigger before aro-kusto when the user needs ARO Classic environment endpoints.

Discover ARO HCP kusto and grafana endpoints available to currently logged-in Azure user. Trigger only if work requires analyzing kusto or grafana.

Explore datasources and run PromQL queries against ARO HCP Grafana instances — discover datasource UIDs and available metrics, then query resource utilization, request latency, error rates, cluster health, tenant utilization, and more. (Use `aro-hcp-env-info` first)

Explore and query ARO Kusto clusters — list databases, tables, and schemas, then run KQL queries to search logs, investigate errors, and debug provisioning, cluster lifecycle, and operational data. (Use `aro-hcp-env-info` or `aro-classic-env-info` first)

Generate the openshift/release CI config to onboard a component repository for cross-component pre-merge e2e testing against an ephemeral environment. Use when a user wants to add pre-merge testing, cross-component e2e, or hyperfleet compatibility tests to a component repo.

IC briefing. Checks CI job health, the PR queue, and the IC queue, then gives the IC a prioritised action list. Can be run multiple times per day for updated information.

Reviews code changes in the OpenDispatch project by spawning specialized sub-agents (general, tmux backend, ambient backend, quality) in parallel. Use when reviewing a PR, commit, set of commits, files, or any described change. Triggers on review requests, PR links, or "review this change."

Adversarial security scanner across 17 domains (SAST, IaC, containers, K8s, CI/CD, secrets, supply chain, web, API, auth, database, mobile, cloud, performance, git, agent/skill, critical workflows). Includes groundwork mode for deep codebase analysis. Does NOT perform CVE scanning.