cnative-skills

Use when the user reports an operational problem or incident — pods crashing or CrashLoopBackOff, latency spikes, rising error rates, missing/broken metrics, failing or stuck deployments, alerts firing, OOMKilled, service unreachable, node problems — or asks to investigate a production issue, find a root cause, plan a remediation, or write an incident report. Also invoked explicitly via /sre-agent.

Expert AWS CLI guidance. Use when the task involves aws commands or the AWS CLI — installing, updating, or pinning AWS CLI v2 (and migrating scripts off the end-of-support v1), authentication issues ("Unable to locate credentials", "ExpiredToken", "The SSO session has expired", aws configure sso and aws sso login, IAM Identity Center, access keys, assume-role, credential_process, EC2/ECS role credentials), profiles and the ~/.aws/config and ~/.aws/credentials files, AWS_PROFILE/AWS_REGION and other AWS_* env vars, scripting aws with --query JMESPath, --output json/text, --no-cli-pager, pagination and return codes, s3 vs s3api, or any AWS resource work driven through the aws CLI (EC2, S3, IAM, STS, Lambda, EKS, ECR, CloudFormation, CloudWatch Logs, SSM, DynamoDB).

Expert GitLab guidance covering the glab CLI, .gitlab-ci.yml authoring, and CI/CD pipeline design. Use when the task involves glab commands (mr, issue, ci, job, release, repo, api, variable, schedule, token, snippet, cluster, stack, duo, mcp), writing or debugging .gitlab-ci.yml pipeline YAML (stages, rules, workflow, needs, artifacts, cache, include, extends, spec inputs, id_tokens, trigger, environment, services, parallel matrix), designing CI/CD pipelines end-to-end (DAG, parent-child and multi-project pipelines, merge request pipelines, merge trains, environment promotion, review apps, rollback), CI/CD components and the catalog, GitLab Runner selection and tags, pipeline security (OIDC id_tokens, CI_JOB_TOKEN allowlists, protected branches/environments/variables, masked variables), or troubleshooting pipelines that don't trigger, jobs stuck pending, or "yaml invalid" errors.

Local-first meta-agent orchestrator for Dev and Ops tasks. Use when the user asks to run opsman, orchestrate a multi-skill task, check opsman status, or wants a test-driven, evidence-gated execution loop that discovers local skills, selects a team, plans, implements, and validates command evidence. Triggers: opsman, orchestrate, meta-agent, orchestrator, run lifecycle, evidence-gated validation, capability map, skill registry.

Expert Google Cloud CLI guidance. Use when the task involves gcloud commands or the Google Cloud SDK — installing or updating the CLI and components (bq, gsutil, kubectl, gke-gcloud-auth-plugin, alpha/beta), gcloud init, authentication issues (gcloud auth login vs application-default ADC, "could not find default credentials", service account keys, --impersonate-service-account, workload identity federation, headless/CI login), named configurations and switching projects, config properties and CLOUDSDK_* env vars, scripting gcloud with --format/--filter/--quiet, proxy or custom CA setup, or any GCP resource work driven through the gcloud CLI (compute, GKE, IAM, storage, run, logging).

Expert GitHub guidance covering the gh CLI, GitHub Actions, and repository management. Use when the task involves gh commands (repo, pr, issue, run, workflow, release, api, secret, ruleset, extension), writing or debugging GitHub Actions workflow YAML, designing CI/CD pipelines and deployment processes (stages, environment promotion, blue/green, canary, rollback), workflow triggers, matrix builds, caching, reusable workflows, building custom actions (composite, TypeScript/JavaScript, Docker, action.yml), Actions security (SHA pinning, permissions, script injection, pull_request_target, OIDC, secrets), or managing repos with branch protection, rulesets, CODEOWNERS, labels, releases, GHCR packages, webhooks, or the REST/GraphQL API.

Expert guide for agentgateway, the Linux Foundation AI-native proxy data plane (Rust, originally built by Solo.io, also used as kgateway's data plane). Covers MCP (Model Context Protocol) tool federation and multiplexing, A2A (agent-to-agent) proxying, multi-provider LLM/AI gateway routing (virtual models, weighted/failover/conditional routing, cost tracking), general HTTP/gRPC traffic management, security policies (JWT, OIDC, API key, CEL-based authorization, backend auth, rate limiting, TLS), observability (metrics, OpenTelemetry tracing, logging, admin UI), standalone binary/Docker configuration, and Kubernetes installation via Helm charts, Gateway API, and the AgentgatewayBackend/AgentgatewayPolicy CRDs. Use when the user mentions agentgateway, agentgateway.dev, MCP proxy/gateway/federation, A2A agent proxying, LLM gateway routing, AI gateway, virtual models, or asks an AI Gateway/MCP/LLM/agent-connectivity question that kgateway's own docs point elsewhere for.

Generic fallback implementer for opsman runs. Make the smallest code or configuration change that satisfies predefined acceptance checks — edit source files, fix bugs, add features or endpoints, refactor, update configuration, write or adjust tests — when no domain-specific skill matches the task. Triggers: implement, fix, add, change, modify, refactor, patch, write code, bug, feature, script, configuration, test.

Generic fallback operations troubleshooter for opsman runs. Diagnose and remediate service, deployment, and infrastructure problems — failing or crashing services, bad configuration, resource exhaustion, network and DNS issues, log analysis, incident triage — using only tools proven present, when no domain-specific skill matches the task. Triggers: ops, operations, service, deployment, deploy, outage, incident, degraded, restart, healthcheck, logs, monitoring, infrastructure, troubleshoot.

Generic fallback reviewer and validator for opsman runs. Review a diff for correctness, scope creep, and risk; judge test adequacy and acceptance-check coverage; verify captured evidence actually supports the claims — when no domain-specific skill matches the task. Triggers: review, verify, validate, check, audit, inspect diff, test coverage, acceptance, quality, correctness, regression.

Generic fallback investigator for opsman runs. Explore a codebase or running system, search and read code, trace call paths, reproduce failures, inspect configuration and logs, and gather evidence for diagnosis and root-cause analysis when no domain-specific skill matches the task. Triggers: investigate, explore, find, locate, trace, diagnose, debug, triage, root cause, analysis, evidence, logs, reproduce, inspect, understand.

Cut, plan, or recover a release of the cnative-skills repository. Use whenever the user wants to tag or publish a version, asks "what should the next version be", mentions bumping plugin versions, rc/prerelease tags, release notes/changelog, the release workflow failing, or deleting/redoing a release — even if they just say "ship it" or "let's release".

Karpenter (Kubernetes node autoscaling) expert for setting up, reviewing, fixing, and optimizing node provisioning on EKS — NodePools, EC2NodeClasses, EKS Auto Mode NodeClasses, consolidation/disruption tuning, spot adoption, GPU pools, and node-level troubleshooting. Use this skill whenever the user mentions Karpenter, NodePool, NodeClaim, EC2NodeClass, EKS Auto Mode compute, node autoscaling/provisioning, spot interruptions, node consolidation, drift, disruption budgets, or symptoms like "pods stuck Pending and no node launches", "nodes churning", "nodes won't scale down", or "surprise EC2 bills" — even if they never say the word "Karpenter".

Flux CD GitOps operator guidance for Kubernetes. Use when the task involves explaining Flux concepts, planning or reviewing GitOps repository structure, installing or bootstrapping Flux, authoring or validating Flux resources, securing Flux with SOPS/RBAC/supply-chain controls, operating Flux controllers, upgrading Flux by version, or troubleshooting Flux reconciliation, source, kustomize, Helm, notification, webhook, and drift issues.

Expert guidance for improving and enhancing prompts. Use when the user shares a raw, vague, or first-draft prompt and wants it clarified, tightened, strengthened, or made more reliable; asks to "improve / rewrite / optimize this prompt", "make this prompt better", or write a system prompt; or mentions prompt engineering, few-shot/multishot examples, chain-of-thought, role/system prompts, XML structuring, or prompt templates. Applies an ordered set of techniques (clarity, context, examples, structure, role, reasoning, chaining), scaled to the prompt's complexity, and returns the enhanced prompt plus a tagged change log explaining what changed and why.

Argo CD GitOps guidance for Kubernetes. Use when Codex needs to install or upgrade Argo CD, design GitOps architecture, author or review Application, AppProject, ApplicationSet, repository, project, RBAC, SSO, Dex, notification, Helm, Kustomize, multi-source, sync wave, hook, ignoreDifferences, or app-of-apps configuration, operate argocd CLI workflows, secure multi-tenant Argo CD, or troubleshoot sync, health, drift, repo, cluster, auth, and ApplicationSet issues. Trigger on Argo CD YAML, argocd CLI output, sync status, OutOfSync, Degraded, Progressing, Missing, InvalidSpecError, repo-server, application-controller, AppProject, ApplicationSet, Sealed Secrets, External Secrets, or GitOps CD questions where Argo CD is the tool.

Expert guidance for writing, hardening, debugging, and reviewing Bash and POSIX shell scripts. Use whenever the user writes, edits, refactors, or pastes a .sh / .bash file or shell snippet; asks for a script, automation, wrapper, installer, backup, deploy, cron, CI/CD, or system-admin script; mentions shebang, set -euo pipefail, strict mode, ShellCheck (SC2086 etc.), shfmt, Bats, trap, getopts, IFS, here-doc, subshell, command substitution, exit codes, quoting, globbing, arrays, or parameter expansion; reports a shell script that fails, hangs, mis-parses arguments, breaks on spaces/special characters, or behaves differently on macOS vs Linux; or asks "why does my bash script…" or "is this shell script safe/portable". Trigger even when the user does not say the word "bash" but is clearly authoring or fixing shell code. Prefer this over generic answers for any non-trivial shell work.

Expert guidance for Helm — the Kubernetes package manager. Use whenever the user creates, edits, reviews, or debugs a Helm chart or anything under a chart (Chart.yaml, values.yaml, values.schema.json, templates/*.yaml, _helpers.tpl, charts/, crds/); writes or fixes Go/Sprig template syntax ({{ }}, include, define, template, range, with, toYaml, nindent, indent, tpl, required, quote, default); runs the helm CLI (install, upgrade, rollback, uninstall, lint, template, package, dependency, repo, search, show, get, pull, status, history, test); manages releases or values across environments; discovers or vendors existing charts from repositories, Artifact Hub, or OCI registries; or debugs failures like "helm template fails", "wrong indentation", "nil pointer evaluating interface", "release stuck in pending-upgrade", "values not taking effect", or rendered YAML that won't apply. Trigger on Helm chart files, helm command output, Go template errors, or Kubernetes packaging/release questions where Helm is the tool — e

Expert guide for kagent — the open-source CNCF framework for building, deploying, and running AI agents on Kubernetes. Covers the kagent CLI, declarative and BYO agents (Agent, SandboxAgent, ModelConfig, RemoteMCPServer, MCPServer CRDs), LLM provider setup, MCP and HTTP tools, A2A subagents, human-in-the-loop tool approval, long-term agent memory, context compaction, Git/OCI-based kagent skills, AgentHarness/OpenShell, Agent Substrate runtimes, exposing agents to IDEs like Claude Code and Cursor via MCP, Helm values, OIDC authentication, observability, and systematic troubleshooting. Use this skill whenever the user mentions kagent, kagent.dev, deploying AI agents to Kubernetes, Agent or ModelConfig or RemoteMCPServer YAML, kagent CLI commands, connecting cluster agents to an IDE, tool approval flows, agent memory, context management, or is debugging kagent — even if they don't say "kagent" but describe running LLM agents inside a Kubernetes cluster.

Expert guide for kgateway, the CNCF Kubernetes Gateway API implementation backed by Envoy. Covers Helm installation, Gateway/GatewayClass/HTTPRoute/TCPRoute setup, kgateway CRDs, traffic management, security policies, resiliency, Istio integration, observability, debugging with admin/xDS/logs, upgrades, migration from Kubernetes Ingress, and version-specific migration notes. Use when the user mentions kgateway, kgateway.dev, Gloo gateway, Envoy-based Kubernetes ingress, Gateway API policies, TrafficPolicy, ListenerPolicy, rate limiting, JWT validation, or debugging a kgateway installation. For AI Gateway, LLM, MCP, or agent connectivity questions that mention kgateway docs, route users to Agentgateway documentation when the feature is no longer in the Envoy kgateway docs.

Use when the user asks about Kubernetes, k8s, kubectl, Helm, GitOps, Flux, Argo CD, kustomize, manifests, pods, deployments, services, ingress, Gateway API, RBAC, NetworkPolicy, Pod Security, CRDs, operators, cluster operations, or pasted Kubernetes YAML/errors.