| name | cluster-reprovision-handoff |
| description | Handle cluster reprovisioning and post-Terraform handoff for this MoruPark repository. Use when Codex needs to recover from `terraform destroy` and rebuild flows, restore kubeconfig access, bootstrap required operators, re-apply prod overlays, or verify that infrastructure, secrets, and workloads are ready after a fresh cluster or major infra recreation. |
Cluster Reprovision Handoff
Use this skill for cluster rebuild and post-provision handoff work.
Quick Start
- Read references/rebuild-sequence.md for the canonical rebuild order.
- Read references/post-provision-checks.md for downstream validation targets.
- Read
ssl.json when the request needs structured scenes, command order, or risk metadata.
Workflow
- Confirm whether the task is read-only review, rebuild prep, or post-rebuild recovery.
- Inspect Terraform target path and cluster bootstrap assumptions.
- Ensure post-apply Cloud SQL follow-up is complete (including
moruparkdb_prod creation and app-user DB grants when required by app DB URLs).
- Restore kubeconfig access before Kubernetes diagnostics.
- Ensure required operators such as ESO are installed before app overlay apply.
- Re-apply prod overlay only after bootstrap prerequisites exist.
- Verify secrets, workloads, ingress, managed certificate readiness, Artifact Registry image delivery, and follow-up handoff items.
- If Argo CD is part of the intended environment, verify the
Application exists, is healthy/synced, and that the running images reflect the synced image tags; if Argo CD is absent, record that the cluster is currently on a manual apply path.
- Record meaningful completed infra recovery actions in
infra/md/implement.md.
Guardrails
- Do not collapse infra provisioning, operator bootstrap, and app deployment into one unchecked step.
- Do not treat Terraform success as proof that the Kubernetes layer is ready.
- Do not treat Terraform success as proof that required application databases already exist.
- Do not treat a successful GitHub Actions image push as proof that the rebuilt cluster received the new image.
- Do not skip post-rebuild kubeconfig refresh.
- Do not run overlay apply before bootstrap operators and CRDs are present.
References
