메뉴
Take a routine on-demand k3s etcd snapshot and confirm it reached offsite R2. Non-destructive. Use for ad-hoc backups. RESTORE is NOT covered here (it is destructive + owner-gated).
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Run long or multi-checkpoint repository work through Hermes Kanban with autonomous OpenAI author/reviewer routing.
Commit a change and get it pushed. The git origin + write deploy key live ONLY on uap-ops-1 (100.82.241.121), NOT the workstation. Use whenever a change is ready to land.
Deploy a change to the cluster via Flux GitOps and VERIFY it actually reconciled. Use after editing anything under clusters/prod. A push alone is NOT a verified deploy.
Offload a token-HEAVY, quote-verifiable read (big log/doc/corpus) to the free local LLM so the big input never enters this paid context. Use when you are about to read a large file only to extract/locate/enumerate specific facts. NOT for judgment, synthesis, code edits, or small inputs.
Encrypt a Kubernetes Secret with SOPS for clusters/prod. MUST run on uap-home-1 (sops is absent on Windows; the age private key lives only there). Use when adding/rotating any secret.
Run the UAP validation gate (tests/verify-local.ps1) and interpret its result. Use before handing any change back, and before any commit/push. Knows the success tokens and which failures are EXPECTED on the Windows workstation.
| name | uap-etcd-snapshot |
| description | Take a routine on-demand k3s etcd snapshot and confirm it reached offsite R2. Non-destructive. Use for ad-hoc backups. RESTORE is NOT covered here (it is destructive + owner-gated). |
ssh uap@100.106.223.120 'SNAP=uap-local-$(date -u +%Y%m%d-%H%M%S); sudo k3s etcd-snapshot save --name "$SNAP" && sudo k3s etcd-snapshot list | grep -F "$SNAP"'
Production config already sets etcd-s3: true; current k3s rejects a duplicate CLI --s3 flag. Success means
the command exits 0 and prints the exact new snapshot name with an s3:// location.
k3s etcd-snapshot may print warnings about server-only flags in /etc/rancher/k3s/config.yaml. This is documented and expected (AGENTS.md -> Known Warnings, runbooks/k3s-snapshots.md).
etcd-snapshot list check above is the confirmation; a generic bucket listing is not sufficient.Authoritative reference: runbooks/k3s-snapshots.md, runbooks/offsite-backups.md, runbooks/validation-matrix.md.