菜单
This skill should be used when the user reports pod connectivity issues, timeout errors reaching external endpoints, "connection timed out", "max retries exceeded", or network problems from within Kubernetes pods.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Iterate on a written artifact (doc, design spec, RFC, runbook) using inline `annotate:` markers as a review channel. Defines a stable protocol for first-pass replies, follow-ups, resolution, and promotion of inline answers into the document body — so the user can review by editing the doc directly and the agent's behavior is predictable across rounds.
Investigate AWS cost surges or anomalies on the Kumo SaaS account using the CUR (Cost and Usage Report) in Athena. Use when the user reports a billing spike, month-over-month cost increase, needs a "where is the money going" breakdown, or wants to track cost per customer/nodepool/environment. Read-only — never mutates AWS resources.
Walk through a GitHub PR for learning purposes — explaining code, answering inline comments, generating diagrams, and demonstrating bugs with runnable scripts.
Scaffold a new VPC/BYOC customer workspace from scratch. Creates repo structure, generates all config files, clones child repos, and registers in Notion.
Use when a coding agent needs to tune and run an end-to-end Kumo workflow with the Kumo SDK, including data connection, graph creation, predictive query validation, training, model-plan iteration, prediction, and reporting concrete outputs.
Use when a coding agent needs to use KumoRFM to translate natural-language prediction requests into valid queries, inspect relational schema, construct or repair the graph, run instant predictions or evaluations, and return concrete outputs.
| name | k8s-egress-diagnose |
| metadata | {"version":"1.0.0"} |
| description | This skill should be used when the user reports pod connectivity issues, timeout errors reaching external endpoints, "connection timed out", "max retries exceeded", or network problems from within Kubernetes pods. |
| allowed-tools | Bash Read Grep Glob |
When a pod cannot reach an external endpoint, the cause is often an egress network policy blocking outbound traffic.
Use python3 since nslookup/dig may not be installed:
kubectl exec -n <ns> <pod> -- python3 -c \
"import socket; print(socket.getaddrinfo('<fqdn>', <port>))"
Then test TCP to the resolved IP, and also test a known-working endpoint for comparison. If some endpoints work and others don't, it's egress policy filtering.
kubectl get ciliumnetworkpolicy -n <namespace> -o yaml
kubectl get networkpolicy -n <namespace> -o yaml
Check whether the target FQDN is in the toFQDNs allow list. Note that
matchName is exact — the original FQDN must appear, not its CNAME.
Egress policies are typically managed via a dedicated git repo synced by a GitOps controller. Ask the user which repo manages egress policies. Compare live policies against git to detect config drift — manually-applied policies may be pruned on next reconciliation.
Before whitelisting, check pod logs and stack traces to understand the call. Common cause: SDK upgrades switching from API-proxied access to presigned URLs that go directly to backing cloud storage. The API endpoint may be allowed but the storage endpoint is not.