oci-skills

OCI Administrator skill for Oracle Kubernetes Engine (OKE) application and cluster operations. Use when working with OKE clusters, kubeconfig, kubectl, Kubernetes manifests, namespaces, deployments, services, ingress-nginx, OCI Native Ingress Controller, OCI LoadBalancer services, TLS certificates, Kubernetes TLS secrets, OCIR image pulls, imagePullSecrets, rollout status, CrashLoopBackOff, ImagePullBackOff, Pending LoadBalancers, virtual nodes, managed node pools, Workload Identity, External Secrets, or OKE deployment troubleshooting. Also use when evaluating Kubernetes MCP read surfaces against OKE safety rules. Triggers: OKE deploy, nginx ingress, LB pending, certificate or TLS listener issue, kubeconfig endpoint error, kubectl Unauthorized, backend health CRITICAL, NodePort, virtual node, OCIR Unauthorized, pod readiness/liveness, Kubernetes MCP, or public app exposure on Kubernetes.

Turn one product or engineering goal into an ordered PRD program, delegate bounded tasks to model-tiered Codex agents, enforce test-first implementation and independent Sol review, and continue automatically until the agreed goal is complete or genuine user authority is required. Use for complex features, refactors, audits, migrations, or multi-phase project work where the user wants one initial prompt instead of repeatedly asking for the next task.

Default router for tenancy-agnostic Oracle Cloud Infrastructure engineering. Use for OCI administration, audit, security, IAM, Bastion, networking, compute, OKE, observability, storage, disaster recovery, Base Database, Exadata, DBM/OPSI, ADB, cost, Log Analytics, Resource Manager, Data Safe, Events, Functions, Queue, Terraform/HCL, landing zones, DevOps, API Gateway, Container Instances, Artifact Registry/OCIR, exact oci-cli commands, platform bundles, or project lifecycle requests. Routes to distinct domain skills and the oci-project, oci-product-development, oci-application-engineering, or oci-landing-zone orchestrator while enforcing named contexts, preflight receipts, redaction, and risk-specific approval. Routes deep GenAI, in-database work, specialist OKE, and Fusion work to official Oracle skills or documentation.

Design, inspect, validate, and operate OCI Full Stack Disaster Recovery orchestration. Use for DR protection groups, members, associations, DR plans, plan groups and user-defined steps, prechecks, drills, planned switchovers, unplanned failovers, reprotection, readiness evidence, RTO/RPO validation, and cross-region or intra-region application recovery. Database Data Guard remains with oci-database-cloud; storage replication remains with oci-storage.

Operate OCI VCNs, subnets, routes, gateways, DRGs, NSGs, load balancers, DNS, Traffic Management, Health Checks, Certificates, compute instances, VNICs, images, volume attachments, and instance groups. Use for connectivity, network policy, name resolution, TLS endpoint lifecycle, VM lifecycle, load-balancer health, capacity, or compute troubleshooting. Route storage protection and replication to oci-storage, OKE resources to oci-oke-admin, and Container Instances or registry delivery to oci-developer-services.

Operate OCI Object Storage, Archive Storage, File Storage, and Block/Boot Volume data-protection lifecycle. Use for buckets, objects, multipart uploads, lifecycle and retention rules, versioning, replication, pre-authenticated requests, file systems, mount targets, exports, snapshots, volume groups, backups, backup policies, clones, and volume replication. Compute attachment remains with oci-networking-compute; OKE persistent volumes remain with oci-oke-admin; database-native backups remain with their database owner.

Orchestrate OCI-backed application engineering: intake, local knowledge and reuse discovery, read-only plugin assessment, TDD implementation, independent review, security gates, verification, and efficiency measurement. Use for application code creation, code review, debugging, module reuse, or skill/plugin selection around OCI workloads. It never mutates OCI infrastructure; platform bundles remain oci-product-development and service delivery remains oci-developer-services.

Operate OCI Bastion access safely: bastion and session lifecycle, Managed SSH, fixed SSH port forwarding, dynamic SOCKS5 forwarding, client CIDR allowlists, Oracle Cloud Agent Bastion plugin health, connection diagnosis, and cleanup. Use for time-bound access to private targets. Pure NSG, route, subnet, or VCN changes remain with oci-networking-compute.

Operate OCI Base Database Service and Exadata Database Service control-plane lifecycle: DB systems, Exadata infrastructure and VM clusters, DB homes, databases and PDB resources, backups and restores, scaling, maintenance, patching, upgrades, and Data Guard associations. Excludes Autonomous Database, observability onboarding, and in-database SQL, RMAN, or tuning.

IAM and tenancy administration for any OCI tenancy via oci-cli: users, groups, group memberships, dynamic groups (matching rules), policies (least-privilege review, detect tenancy-wide manage-all grants), compartments (create, move, delete, subtree traversal), budgets and alert rules, quotas, service limits / resource-availability pre-checks, tags (namespaces, defined, freeform, cost-tracking), regions, and Identity Domains vs legacy IAM. Use whenever a request mentions OCI IAM, OCID, compartment, policy, tenancy, dynamic group, budget, quota, service limit, tag namespace, auth token, generic OIDC/OAuth or SAML application integration, claims/scopes, or SCIM provisioning.

Assess, design, deploy, upgrade, and validate OCI landing zones and greenfield tenancy guardrails using Cloud Adoption Framework and Well-Architected guidance. Orchestrates IAM, security, networking, observability, cost, Terraform, and Resource Manager while preserving one IaC owner and the existing Solution Blueprint. Ordinary project lifecycle remains with oci-project.

Compose secure OCI platform bundles for five product-development golden paths: API Gateway with Functions, Container Instances applications, OKE applications, Queue or Streaming event workers, and ADB-backed services. Use when a user asks to design, scaffold, or deploy an OCI application platform, select a runtime/ingress/data/delivery stack, or create platform-bundle.yaml. Produces infrastructure, delivery, IAM, OpenAPI, verification, and runbook artifacts—not business application logic.

End-to-end OCI project lifecycle orchestrator. Use whenever the request is about a *project* as a whole rather than one service: stand up / bootstrap / scaffold a new OCI project (compartment + scoped IAM + network skeleton + budget guardrail + project tags), get a project's overall status / health / posture, deploy or release a project (Resource Manager stack or OKE rollout), or tear down / decommission / clean up a project. It binds a project to a named context (compartment + region + profile), accepts a schema-v1 platform bundle after design, and sequences the owning domain skills, each call gated by the shared safety core. Triggers on: new OCI project, bootstrap, scaffold, set up a project, project status, project health, "is my project healthy", deploy the project, release, promote, tear down, decommission, clean up, delete the project, project guardrails, project compartment. For a single-service task, use that domain skill directly.

Author, discover, format, validate, test, plan, inspect, apply, and destroy OCI Terraform configurations. Use for local Terraform, provider schema, discovery, reviewed plans, Resource Manager-compatible packages, state ownership, drift, declarative import and moved blocks, native OCI Object Storage backends, execution-context authentication, sovereign realms, modules, or HCL. Existing Resource Manager stack and job operations remain with oci-resource-manager.

OCI security and compliance operations for administrators: Cloud Guard targets, detector/responder recipes and problems; Vault/KMS key and secret create, read (base64-decode), rotation and the oci-vault:// env-resolver; Security Zones; WAF web-app-firewall policies with SQLi/XSS/rate-limit BLOCK rules attached to a load balancer; Audit event queries; CIS / ISO-42001 / sovereignty / NIS2 compliance scanning; IAM least-privilege policy review; and secrets redaction. Trigger for oci-cli, Cloud Guard, Vault, KMS, WAF, Security Zones, Audit, CIS, compliance, secure software delivery, dependency vulnerability audits, DevSecOps, or secret-handling tasks in an OCI tenancy.

Design, provision, deliver, inspect, and roll back OCI developer platforms: DevOps projects, code repositories and external connections, build pipelines/specifications, artifacts, environments, deployment pipelines and triggers, API Gateway, Container Instances, Artifact Registry, and OCIR delivery. Use for OCI CI/CD, private APIs, container deployments, blue-green or canary releases, and DevOps-to-OKE/Functions/instance-group targets. Hand off runtime ownership to the matching OKE, Functions, networking, or Terraform skill.

Oracle Autonomous Database lifecycle and application connectivity via oci-cli and python-oracledb. Use when the user manages an ADB/ADW/ATP instance (start/stop/restart, scale ECPU/storage, enable auto-scaling), works with its wallet (generate-wallet, rotate wallet, mTLS vs TLS, TNS_ADMIN), tunes the access-control IP allowlist, clones or restores it, or connects an application (DSN service levels _high/_medium/_low/_tp, connection pooling, SQLAlchemy `oracle+oracledb://`, Alembic migrations, private-endpoint DSNs). Triggers: generate ADB wallet, rotate wallet, start/stop/scale Autonomous Database, whitelisted-ips / ACL, connect to ADB, TNS_ADMIN, oracledb thin/thick, SQLAlchemy Oracle URL, Alembic upgrade on Oracle, ORDS, run/execute SQL on ADB, SQLcl, blocking sessions, wait events, top SQL, SQL plan, DBMS_XPLAN. Mentions Autonomous Database, ADB, ADW, ATP, wallet, cwallet.sso, ewallet, DSN, oracledb, cx_Oracle, SQLcl, V$SESSION, in-DB diagnostics.

Cost, usage, and budget reporting (FinOps) for any OCI tenancy via oci-cli: spend grouped by service / compartment / region over a time window using the Usage API, budgets and alert rules (limit vs actual vs forecast), cost-tracking tags, and guardrail recommendations. Use whenever a request mentions OCI cost, spend, billing, invoice, usage, Usage API, budget, forecast, cost alert, FinOps, "what is this tenancy costing", or cost-tracking tags. Read-only by default; for creating budgets it defers to oci-iam-admin.

OCI Data Safe administration via oci-cli and the OCI SDK: target-database registration (Autonomous and Base DB / Exadata cloud service), Data Safe private endpoints, Security Assessment and User Assessment, Activity Auditing (scim_query time filters), Data Discovery (sensitive data models), and Data Masking. Use whenever a request mentions OCI Data Safe, target database registration, Data Safe private endpoint, security assessment, user assessment, activity auditing, audit policy/retention, sensitive data discovery, data masking, or a database NEEDS_ATTENTION / ORA-01017 in Data Safe. Assessments are read; registration/masking/audit-policy changes go through the safety core.

OCI Administrator skill for Database Management (DBM) and Operations Insights (OPSI) enablement, validation, and troubleshooting for OCI databases. Use when working with DBM private endpoints, managed databases, OPSI database insights, Performance Hub, AWR/ADDM/ASH, DBSNMP monitoring users, Data Safe target drift, Management Agent-backed Log Analytics ingestion for DBCS/Base DB, DBM/OPSI work requests, Database Insight lifecycle flaps, or Base Database Service observability. Triggers: DBM, Database Management, OPSI, Operations Insights, Performance Hub, AWR, ADDM, ASH, DBSNMP, Database Insight, create-pe-comanged-database, DbcsEntityChangeWorkflowFailed, managed-database, database-insights, and DB log ingestion.

Operate OCI Functions, Fn deployment/invocation, Events rules and CloudEvents filters, Notifications/ONS, Service Connector Hub, Queue, and Streaming/Kafka transports. Use for serverless applications, eventType and FAAS/ONS/Streaming actions, serviceconnector fan-out/IAM, Queue producer-consumer policy, visibility timeout, channels, retry/poison-message/DLQ behavior, stream publishing, consumer offsets, Kafka SASL/Connect, or event-worker automation. Delivery pipelines belong to oci-developer-services; Queue and event transport ownership stays here. Live create/update/invoke operations use the shared context-bound safety core.

OCI Log Analytics (Logan) administration and querying via oci-cli and the OCI SDK: the OCL query language (search + pipe commands like stats, timestats, where, eval, link, fields), running and validating queries, sources, parsers, fields, lookups, entities and log groups, on-demand log upload and continuous ingestion, saved/scheduled searches, detections (including Sigma→OCL conversion), management dashboards, and content migration. Use whenever a request mentions OCI Log Analytics, Logan, OCL, LQL, a log query, Log Source, OCI Audit Logs query, parser, log source, log group, entity, saved search, scheduled search, Cloud Guard / WAF / Sysmon query, Sigma-to-OCI, Sentinel KQL migration, management dashboard, or upload_log_file. Read-only querying by default; content changes go through the shared safety core.

Operate OCI Monitoring, Logging, APM, OpenTelemetry, Notifications, Service Connector Hub, service/custom logs, metrics, alarms, dashboards, agent traces, and Grafana integrations. Use for telemetry collection, queries, alerting, trace integrity, logging pipelines, or observability inventory. Route Database Management, Operations Insights, Performance Hub, AWR/ADDM/ASH, and DBSNMP to oci-dbm-opsi; route Autonomous Database lifecycle to oci-autonomous-db.

OCI Resource Manager (ORM) — managed Terraform — administration via oci-cli: stacks, plan/apply/destroy jobs, job log and state retrieval, drift detection, state import, variables (flat name→string map, JSON-encoded complex values), and packaging a Terraform bundle as a deployable stack with schema.yaml. Use whenever a request mentions OCI Resource Manager, ORM, RMS, a Terraform stack, plan/apply/destroy job, terraform-version, execution plan strategy, tfstate, drift, stack outputs, or "deploy to Oracle Cloud". Plan/read is safe; apply and destroy jobs are mutations gated by the shared safety core.

OCI Administrator skill for Zero Trust Packet Routing (ZPR) visibility and audit operations. Use when working with ZPR policies, security attributes, protected resources, VCN Flow Logs correlation, ZPR inventory collection, unexpected accepted/rejected flows, Log Analytics ZPR dashboards, ZPR custom logs, Service Connector Hub ingestion for ZPR evidence, or Terraform/CLI onboarding of ZPR visibility. Triggers: ZPR, Zero Trust Packet Routing, security attributes, ZPR policy, protected resource, zpr-family, ZPR flow correlation, unexpected_accepted, suspected_misconfiguration, and OCI ZPR visibility dashboard.