菜单
Maintenance + advance task menu for devantler-tech/kyverno-policies — the shared, tested Kyverno policy catalog the platform and platform-template consume instead of vendoring per-repo copies. Use when the daily maintainer selects kyverno-policies.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/devantler-tech/monorepo --skill maintain-kyverno-policies命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
The run procedure for the Agentic Engineer (the products' primary engineer) — pre-flight, survey the whole devantler-tech portfolio, select the highest-value work (operate first, then advance), act via per-run worktrees and draft PRs (driving every actionable PR to a terminal state whoever authored it, including dependency-bot PRs that cannot finish autonomously), and report. Use when maintaining or advancing the monorepo's products on a schedule or on request.
The ADVANCE playbook for the Agentic Engineer (the products' primary engineer) — how to move a devantler-tech product forward once it's healthy: product strategy & roadmaps, issue triage & decomposition, planning & implementing issues, test coverage, benchmarking & performance, refactoring & code quality, and security hardening that never taxes developer experience. Use after the operate ladder is satisfied and you're picking proactive enhancement work.
Maintenance + advance task menu for the shared AGENT-EXTENSION libraries — devantler-tech/agent-skills (generic, cross-tool agent skills) and devantler-tech/agent-plugins (a tool-neutral marketplace bundling those skills for VS Code / Copilot CLI / Claude Code). Generic, cross-tool, industry-standard building blocks reused across the suite; high-care and backward-compatible. Use when the Agentic Engineer selects skills/plugins or runs the holistic shared-library review.
基于 SOC 职业分类
正在显示 SKILL.md
| name | maintain-kyverno-policies |
| description | Maintenance + advance task menu for devantler-tech/kyverno-policies — the shared, tested Kyverno policy catalog the platform and platform-template consume instead of vendoring per-repo copies. Use when the daily maintainer selects kyverno-policies. |
The reusable Kyverno policy catalog for the devantler-tech platforms. Generic admission and
generation policy behaviour lives here once, so consumer copies in
platform and platform-template cannot drift apart. Consumer wiring and
rollout stay separate changes in those repositories.
The canonical task menu lives in the repo itself — read the ## Maintenance section of
libraries/kyverno-policies/AGENTS.md (on the submodule's latest main):
https://github.com/devantler-tech/kyverno-policies/blob/main/AGENTS.md. This card is a pointer by
design — the menu is maintained once, in the product's own AGENTS.md.
A policy is inert until a consumer pins and references it. Adding one to the catalog changes nothing on any cluster; adoption is its own draft PR, validated in every affected overlay. Keep policies generic — environment-specific exclusions, patches, and rollout choices belong to the consumer repo, never here.
Behaviour is test-first, and the gate has teeth. Every policy carries a kyverno test contract
under tests/<policy>/; for a generate rule, assert the complete generated resource and at least
one nonmatching resource. kyverno test . discovers fixtures recursively, so a new policy is covered
as soon as its fixture exists — never hand-list fixture paths in a runner. Note that kyverno apply
exits 1 on rule failures, but is fail-open on load: a policy it cannot parse is silently
dropped ("Applying 0 policy rule(s)", exit 0), so an apply-based negative control passes vacuously
unless a positive control proves the policy loaded
(kyverno-policies#19). Trust the
repo's own validation block rather than a naive invocation.
Validation (run every gate before opening or updating a PR — the repo's AGENTS.md is
authoritative if this drifts). First confirm your local CLI matches the repo's pinned
KYVERNO_CLI_VERSION (in .github/workflows/ci.yaml) — the CLI defines how the behaviour
fixtures evaluate, so a version mismatch makes a local pass mean something different from CI:
kyverno version # must match KYVERNO_CLI_VERSION in .github/workflows/ci.yaml
yamllint .
kubectl kustomize . > /dev/null
kyverno test . --require-tests --detailed-results --remove-color
bash scripts/test-policy-catalog.sh
shellcheck scripts/test-policy-catalog.sh
actionlint .github/workflows/ci.yaml
zizmor .github/workflows/ci.yaml
git diff --check
Tests are static and local — never connect to or mutate a live cluster to validate a policy-library diff.
Shared cross-repo rules are in the monorepo AGENTS.md.
Roadmap lives in GitHub Issues on devantler-tech/kyverno-policies (roadmap-labelled epics +
milestones). To advance (catalog coverage, the GeneratingPolicy API migration, test depth, CI
hardening, docs) follow product-engineering.