kube-dc-public

Deploy a virtual machine in a Kube-DC project with SSH, cloud-init, optional external access, and an optional gated Dedicated GPU VM profile. Use for ordinary VMs and whole-device GPU VMs that require platform preflight and non-migration safeguards.

Deploy a containerized application to a Kube-DC project with optional database, service exposure, persistent storage, and gated Shared GPU acceleration. Use for Helm or raw CPU workloads and for Shared GPU requests that must go through the platform preview/create API.

Manage Kube-DC storage resources — create S3 buckets (ObjectBucketClaim), DataVolumes for VMs, and PersistentVolumeClaims for containers.

Manage Kube-DC managed Kubernetes clusters — scale worker pools, upgrade versions, access kubeconfig, and monitor status. Covers day-2 operations via kubectl patch.

Create and manage Kube-DC DatabaseCredentialPolicy (DBCP) resources — project-scoped CRDs that rotate database passwords on a tenant-chosen schedule and project them into a Kubernetes Secret. Works against KdcDatabase (PostgreSQL via CNPG / MariaDB via mariadb-operator). Use this for application credentials on managed databases. For the database itself use create-database. For TLS use manage-certificates. For application secrets unrelated to databases use manage-secrets.

Create and operate per-project encryption keys (KMSKey) backed by OpenBao Transit. Use for encrypting opaque payloads ≤ 64 KiB directly, or for envelope encryption of larger blobs (files, database fields, message-queue messages). Plaintext NEVER leaves OpenBao — workloads call encrypt/decrypt by referencing the key, not by holding key material. The same KMSKey type powers managed-K8s etcd encryption-at-rest. For storing whole secrets use manage-secrets. For TLS certificates use manage-certificates.

Create and manage Kube-DC ManagedSecrets — project-scoped secrets backed by OpenBao, optionally projected into a Kubernetes Secret via External Secrets Operator. Use this for storing API tokens, OAuth client secrets, signing keys, third-party credentials. For rotated database passwords use manage-database-credentials (the parent KdcDatabase comes from create-database). For encryption keys use manage-kms. For TLS certificates use manage-certificates.

Request and manage x509 certificates in a Kube-DC project — ManagedCertificate resources backed by either the Organization's private intermediate CA (mTLS, internal services, code signing) or a public ACME issuer (Let's Encrypt by default). Certificates auto-renew before expiry; the result lands in a Kubernetes Secret your workloads mount. For HTTPS via Gateway / HTTPRoute use the expose-service skill — it auto-creates the ManagedCertificate. Use this skill directly only for mTLS, client certs, code signing, or custom durations.

Create a new Kube-DC project with isolated VPC networking inside an existing organization. Handles network type selection (cloud vs public), organization verification, and project manifest generation.

Create a managed PostgreSQL or MariaDB database in a Kube-DC project, configure access for workloads via environment variables and secrets, optionally expose externally via Gateway or LoadBalancer, and back up / restore via kubectl.

Check organization and project resource quota usage before deploying workloads. Covers org-level quota (CPU, memory, storage, pods, public IPv4, object storage) and per-project usage via Organization and Project status fields. Use this before creating VMs, apps, databases, clusters, or EIPs to avoid quota-exceeded errors.

Manage Kube-DC networking resources — create External IPs (EIp), Floating IPs (FIp), and understand VPC networking. Includes decision guide for choosing between EIP and FIP.

Expose a Kube-DC service externally via Gateway Route (HTTP/HTTPS/gRPC with auto TLS) or Direct EIP + LoadBalancer (any TCP/UDP). Includes decision guide for choosing the right exposure method.

Manage Kube-DC organization groups and RBAC — create OrganizationGroup resources to map user groups to Kubernetes roles per project. Note that user management is UI-only (Keycloak).

SSH into a Kube-DC virtual machine using the project's auto-generated SSH keypair. Covers extracting keys, finding VM IP, and connecting via internal IP or external FIP/EIP.

Use the kube-dc CLI for authentication, context switching, and namespace management. Covers login, use, ns, config, and kubectl integration.