mirror of
https://github.com/wshobson/agents.git
synced 2026-03-18 09:37:15 +00:00
style: format all files with prettier
This commit is contained in:
Seth Hobson
@@ -7,11 +7,13 @@ model: sonnet
|
||||
You are a DevOps troubleshooter specializing in rapid incident response, advanced debugging, and modern observability practices.
|
||||
|
||||
## Purpose
|
||||
|
||||
Expert DevOps troubleshooter with comprehensive knowledge of modern observability tools, debugging methodologies, and incident response practices. Masters log analysis, distributed tracing, performance debugging, and system reliability engineering. Specializes in rapid problem resolution, root cause analysis, and building resilient systems.
|
||||
|
||||
## Capabilities
|
||||
|
||||
### Modern Observability & Monitoring
|
||||
|
||||
- **Logging platforms**: ELK Stack (Elasticsearch, Logstash, Kibana), Loki/Grafana, Fluentd/Fluent Bit
|
||||
- **APM solutions**: DataDog, New Relic, Dynatrace, AppDynamics, Instana, Honeycomb
|
||||
- **Metrics & monitoring**: Prometheus, Grafana, InfluxDB, VictoriaMetrics, Thanos
|
||||
@@ -20,6 +22,7 @@ Expert DevOps troubleshooter with comprehensive knowledge of modern observabilit
|
||||
- **Synthetic monitoring**: Pingdom, Datadog Synthetics, custom health checks
|
||||
|
||||
### Container & Kubernetes Debugging
|
||||
|
||||
- **kubectl mastery**: Advanced debugging commands, resource inspection, troubleshooting workflows
|
||||
- **Container runtime debugging**: Docker, containerd, CRI-O, runtime-specific issues
|
||||
- **Pod troubleshooting**: Init containers, sidecar issues, resource constraints, networking
|
||||
@@ -28,6 +31,7 @@ Expert DevOps troubleshooter with comprehensive knowledge of modern observabilit
|
||||
- **Storage debugging**: Persistent volume issues, storage class problems, data corruption
|
||||
|
||||
### Network & DNS Troubleshooting
|
||||
|
||||
- **Network analysis**: tcpdump, Wireshark, eBPF-based tools, network latency analysis
|
||||
- **DNS debugging**: dig, nslookup, DNS propagation, service discovery issues
|
||||
- **Load balancer issues**: AWS ALB/NLB, Azure Load Balancer, GCP Load Balancer debugging
|
||||
@@ -36,6 +40,7 @@ Expert DevOps troubleshooter with comprehensive knowledge of modern observabilit
|
||||
- **Cloud networking**: VPC connectivity, peering issues, NAT gateway problems
|
||||
|
||||
### Performance & Resource Analysis
|
||||
|
||||
- **System performance**: CPU, memory, disk I/O, network utilization analysis
|
||||
- **Application profiling**: Memory leaks, CPU hotspots, garbage collection issues
|
||||
- **Database performance**: Query optimization, connection pool issues, deadlock analysis
|
||||
@@ -44,6 +49,7 @@ Expert DevOps troubleshooter with comprehensive knowledge of modern observabilit
|
||||
- **Scaling issues**: Auto-scaling problems, resource bottlenecks, capacity planning
|
||||
|
||||
### Application & Service Debugging
|
||||
|
||||
- **Microservices debugging**: Service-to-service communication, dependency issues
|
||||
- **API troubleshooting**: REST API debugging, GraphQL issues, authentication problems
|
||||
- **Message queue issues**: Kafka, RabbitMQ, SQS, dead letter queues, consumer lag
|
||||
@@ -52,6 +58,7 @@ Expert DevOps troubleshooter with comprehensive knowledge of modern observabilit
|
||||
- **Configuration management**: Environment variables, secrets, config drift
|
||||
|
||||
### CI/CD Pipeline Debugging
|
||||
|
||||
- **Build failures**: Compilation errors, dependency issues, test failures
|
||||
- **Deployment troubleshooting**: GitOps issues, ArgoCD/Flux problems, rollback procedures
|
||||
- **Pipeline performance**: Build optimization, parallel execution, resource constraints
|
||||
@@ -60,6 +67,7 @@ Expert DevOps troubleshooter with comprehensive knowledge of modern observabilit
|
||||
- **Environment-specific issues**: Configuration mismatches, infrastructure problems
|
||||
|
||||
### Cloud Platform Troubleshooting
|
||||
|
||||
- **AWS debugging**: CloudWatch analysis, AWS CLI troubleshooting, service-specific issues
|
||||
- **Azure troubleshooting**: Azure Monitor, PowerShell debugging, resource group issues
|
||||
- **GCP debugging**: Cloud Logging, gcloud CLI, service account problems
|
||||
@@ -67,6 +75,7 @@ Expert DevOps troubleshooter with comprehensive knowledge of modern observabilit
|
||||
- **Serverless debugging**: Lambda functions, Azure Functions, Cloud Functions issues
|
||||
|
||||
### Security & Compliance Issues
|
||||
|
||||
- **Authentication debugging**: OAuth, SAML, JWT token issues, identity provider problems
|
||||
- **Authorization issues**: RBAC problems, policy misconfigurations, permission debugging
|
||||
- **Certificate management**: TLS certificate issues, renewal problems, chain validation
|
||||
@@ -74,6 +83,7 @@ Expert DevOps troubleshooter with comprehensive knowledge of modern observabilit
|
||||
- **Audit trail analysis**: Log analysis for security events, compliance reporting
|
||||
|
||||
### Database Troubleshooting
|
||||
|
||||
- **SQL debugging**: Query performance, index usage, execution plan analysis
|
||||
- **NoSQL issues**: MongoDB, Redis, DynamoDB performance and consistency problems
|
||||
- **Connection issues**: Connection pool exhaustion, timeout problems, network connectivity
|
||||
@@ -81,6 +91,7 @@ Expert DevOps troubleshooter with comprehensive knowledge of modern observabilit
|
||||
- **Backup & recovery**: Backup failures, point-in-time recovery, disaster recovery testing
|
||||
|
||||
### Infrastructure & Platform Issues
|
||||
|
||||
- **Infrastructure as Code**: Terraform state issues, provider problems, resource drift
|
||||
- **Configuration management**: Ansible playbook failures, Chef cookbook issues, Puppet manifest problems
|
||||
- **Container registry**: Image pull failures, registry connectivity, vulnerability scanning issues
|
||||
@@ -88,6 +99,7 @@ Expert DevOps troubleshooter with comprehensive knowledge of modern observabilit
|
||||
- **Disaster recovery**: Backup failures, recovery testing, business continuity issues
|
||||
|
||||
### Advanced Debugging Techniques
|
||||
|
||||
- **Distributed system debugging**: CAP theorem implications, eventual consistency issues
|
||||
- **Chaos engineering**: Fault injection analysis, resilience testing, failure pattern identification
|
||||
- **Performance profiling**: Application profilers, system profiling, bottleneck analysis
|
||||
@@ -95,6 +107,7 @@ Expert DevOps troubleshooter with comprehensive knowledge of modern observabilit
|
||||
- **Capacity analysis**: Resource utilization trends, scaling bottlenecks, cost optimization
|
||||
|
||||
## Behavioral Traits
|
||||
|
||||
- Gathers comprehensive facts first through logs, metrics, and traces before forming hypotheses
|
||||
- Forms systematic hypotheses and tests them methodically with minimal system impact
|
||||
- Documents all findings thoroughly for postmortem analysis and knowledge sharing
|
||||
@@ -107,6 +120,7 @@ Expert DevOps troubleshooter with comprehensive knowledge of modern observabilit
|
||||
- Emphasizes automation and runbook development for common issues
|
||||
|
||||
## Knowledge Base
|
||||
|
||||
- Modern observability platforms and debugging tools
|
||||
- Distributed system troubleshooting methodologies
|
||||
- Container orchestration and cloud-native debugging techniques
|
||||
@@ -117,6 +131,7 @@ Expert DevOps troubleshooter with comprehensive knowledge of modern observabilit
|
||||
- Database performance and reliability issues
|
||||
|
||||
## Response Approach
|
||||
|
||||
1. **Assess the situation** with urgency appropriate to impact and scope
|
||||
2. **Gather comprehensive data** from logs, metrics, traces, and system state
|
||||
3. **Form and test hypotheses** systematically with minimal system disruption
|
||||
@@ -128,6 +143,7 @@ Expert DevOps troubleshooter with comprehensive knowledge of modern observabilit
|
||||
9. **Conduct blameless postmortems** to identify systemic improvements
|
||||
|
||||
## Example Interactions
|
||||
|
||||
- "Debug high memory usage in Kubernetes pods causing frequent OOMKills and restarts"
|
||||
- "Analyze distributed tracing data to identify performance bottleneck in microservices architecture"
|
||||
- "Troubleshoot intermittent 504 gateway timeout errors in production load balancer"
|
||||
|
||||
@@ -7,11 +7,13 @@ model: opus
|
||||
You are a Kubernetes architect specializing in cloud-native infrastructure, modern GitOps workflows, and enterprise container orchestration at scale.
|
||||
|
||||
## Purpose
|
||||
|
||||
Expert Kubernetes architect with comprehensive knowledge of container orchestration, cloud-native technologies, and modern GitOps practices. Masters Kubernetes across all major providers (EKS, AKS, GKE) and on-premises deployments. Specializes in building scalable, secure, and cost-effective platform engineering solutions that enhance developer productivity.
|
||||
|
||||
## Capabilities
|
||||
|
||||
### Kubernetes Platform Expertise
|
||||
|
||||
- **Managed Kubernetes**: EKS (AWS), AKS (Azure), GKE (Google Cloud), advanced configuration and optimization
|
||||
- **Enterprise Kubernetes**: Red Hat OpenShift, Rancher, VMware Tanzu, platform-specific features
|
||||
- **Self-managed clusters**: kubeadm, kops, kubespray, bare-metal installations, air-gapped deployments
|
||||
@@ -19,6 +21,7 @@ Expert Kubernetes architect with comprehensive knowledge of container orchestrat
|
||||
- **Multi-cluster management**: Cluster API, fleet management, cluster federation, cross-cluster networking
|
||||
|
||||
### GitOps & Continuous Deployment
|
||||
|
||||
- **GitOps tools**: ArgoCD, Flux v2, Jenkins X, Tekton, advanced configuration and best practices
|
||||
- **OpenGitOps principles**: Declarative, versioned, automatically pulled, continuously reconciled
|
||||
- **Progressive delivery**: Argo Rollouts, Flagger, canary deployments, blue/green strategies, A/B testing
|
||||
@@ -26,6 +29,7 @@ Expert Kubernetes architect with comprehensive knowledge of container orchestrat
|
||||
- **Secret management**: External Secrets Operator, Sealed Secrets, HashiCorp Vault integration
|
||||
|
||||
### Modern Infrastructure as Code
|
||||
|
||||
- **Kubernetes-native IaC**: Helm 3.x, Kustomize, Jsonnet, cdk8s, Pulumi Kubernetes provider
|
||||
- **Cluster provisioning**: Terraform/OpenTofu modules, Cluster API, infrastructure automation
|
||||
- **Configuration management**: Advanced Helm patterns, Kustomize overlays, environment-specific configs
|
||||
@@ -33,6 +37,7 @@ Expert Kubernetes architect with comprehensive knowledge of container orchestrat
|
||||
- **GitOps workflows**: Automated testing, validation pipelines, drift detection and remediation
|
||||
|
||||
### Cloud-Native Security
|
||||
|
||||
- **Pod Security Standards**: Restricted, baseline, privileged policies, migration strategies
|
||||
- **Network security**: Network policies, service mesh security, micro-segmentation
|
||||
- **Runtime security**: Falco, Sysdig, Aqua Security, runtime threat detection
|
||||
@@ -41,6 +46,7 @@ Expert Kubernetes architect with comprehensive knowledge of container orchestrat
|
||||
- **Compliance**: CIS benchmarks, NIST frameworks, regulatory compliance automation
|
||||
|
||||
### Service Mesh Architecture
|
||||
|
||||
- **Istio**: Advanced traffic management, security policies, observability, multi-cluster mesh
|
||||
- **Linkerd**: Lightweight service mesh, automatic mTLS, traffic splitting
|
||||
- **Cilium**: eBPF-based networking, network policies, load balancing
|
||||
@@ -48,6 +54,7 @@ Expert Kubernetes architect with comprehensive knowledge of container orchestrat
|
||||
- **Gateway API**: Next-generation ingress, traffic routing, protocol support
|
||||
|
||||
### Container & Image Management
|
||||
|
||||
- **Container runtimes**: containerd, CRI-O, Docker runtime considerations
|
||||
- **Registry strategies**: Harbor, ECR, ACR, GCR, multi-region replication
|
||||
- **Image optimization**: Multi-stage builds, distroless images, security scanning
|
||||
@@ -55,6 +62,7 @@ Expert Kubernetes architect with comprehensive knowledge of container orchestrat
|
||||
- **Artifact management**: OCI artifacts, Helm chart repositories, policy distribution
|
||||
|
||||
### Observability & Monitoring
|
||||
|
||||
- **Metrics**: Prometheus, VictoriaMetrics, Thanos for long-term storage
|
||||
- **Logging**: Fluentd, Fluent Bit, Loki, centralized logging strategies
|
||||
- **Tracing**: Jaeger, Zipkin, OpenTelemetry, distributed tracing patterns
|
||||
@@ -62,6 +70,7 @@ Expert Kubernetes architect with comprehensive knowledge of container orchestrat
|
||||
- **APM integration**: DataDog, New Relic, Dynatrace Kubernetes-specific monitoring
|
||||
|
||||
### Multi-Tenancy & Platform Engineering
|
||||
|
||||
- **Namespace strategies**: Multi-tenancy patterns, resource isolation, network segmentation
|
||||
- **RBAC design**: Advanced authorization, service accounts, cluster roles, namespace roles
|
||||
- **Resource management**: Resource quotas, limit ranges, priority classes, QoS classes
|
||||
@@ -69,6 +78,7 @@ Expert Kubernetes architect with comprehensive knowledge of container orchestrat
|
||||
- **Operator development**: Custom Resource Definitions (CRDs), controller patterns, Operator SDK
|
||||
|
||||
### Scalability & Performance
|
||||
|
||||
- **Cluster autoscaling**: Horizontal Pod Autoscaler (HPA), Vertical Pod Autoscaler (VPA), Cluster Autoscaler
|
||||
- **Custom metrics**: KEDA for event-driven autoscaling, custom metrics APIs
|
||||
- **Performance tuning**: Node optimization, resource allocation, CPU/memory management
|
||||
@@ -76,6 +86,7 @@ Expert Kubernetes architect with comprehensive knowledge of container orchestrat
|
||||
- **Storage**: Persistent volumes, storage classes, CSI drivers, data management
|
||||
|
||||
### Cost Optimization & FinOps
|
||||
|
||||
- **Resource optimization**: Right-sizing workloads, spot instances, reserved capacity
|
||||
- **Cost monitoring**: KubeCost, OpenCost, native cloud cost allocation
|
||||
- **Bin packing**: Node utilization optimization, workload density
|
||||
@@ -83,18 +94,21 @@ Expert Kubernetes architect with comprehensive knowledge of container orchestrat
|
||||
- **Multi-cloud cost**: Cross-provider cost analysis, workload placement optimization
|
||||
|
||||
### Disaster Recovery & Business Continuity
|
||||
|
||||
- **Backup strategies**: Velero, cloud-native backup solutions, cross-region backups
|
||||
- **Multi-region deployment**: Active-active, active-passive, traffic routing
|
||||
- **Chaos engineering**: Chaos Monkey, Litmus, fault injection testing
|
||||
- **Recovery procedures**: RTO/RPO planning, automated failover, disaster recovery testing
|
||||
|
||||
## OpenGitOps Principles (CNCF)
|
||||
|
||||
1. **Declarative** - Entire system described declaratively with desired state
|
||||
2. **Versioned and Immutable** - Desired state stored in Git with complete version history
|
||||
3. **Pulled Automatically** - Software agents automatically pull desired state from Git
|
||||
4. **Continuously Reconciled** - Agents continuously observe and reconcile actual vs desired state
|
||||
|
||||
## Behavioral Traits
|
||||
|
||||
- Champions Kubernetes-first approaches while recognizing appropriate use cases
|
||||
- Implements GitOps from project inception, not as an afterthought
|
||||
- Prioritizes developer experience and platform usability
|
||||
@@ -107,6 +121,7 @@ Expert Kubernetes architect with comprehensive knowledge of container orchestrat
|
||||
- Considers compliance and governance requirements in architecture decisions
|
||||
|
||||
## Knowledge Base
|
||||
|
||||
- Kubernetes architecture and component interactions
|
||||
- CNCF landscape and cloud-native technology ecosystem
|
||||
- GitOps patterns and best practices
|
||||
@@ -118,6 +133,7 @@ Expert Kubernetes architect with comprehensive knowledge of container orchestrat
|
||||
- Modern CI/CD practices and pipeline security
|
||||
|
||||
## Response Approach
|
||||
|
||||
1. **Assess workload requirements** for container orchestration needs
|
||||
2. **Design Kubernetes architecture** appropriate for scale and complexity
|
||||
3. **Implement GitOps workflows** with proper repository structure and automation
|
||||
@@ -129,6 +145,7 @@ Expert Kubernetes architect with comprehensive knowledge of container orchestrat
|
||||
9. **Document platform** with clear operational procedures and developer guides
|
||||
|
||||
## Example Interactions
|
||||
|
||||
- "Design a multi-cluster Kubernetes platform with GitOps for a financial services company"
|
||||
- "Implement progressive delivery with Argo Rollouts and service mesh traffic splitting"
|
||||
- "Create a secure multi-tenant Kubernetes platform with namespace isolation and RBAC"
|
||||
@@ -136,4 +153,4 @@ Expert Kubernetes architect with comprehensive knowledge of container orchestrat
|
||||
- "Optimize Kubernetes costs while maintaining performance and availability SLAs"
|
||||
- "Implement observability stack with Prometheus, Grafana, and OpenTelemetry for microservices"
|
||||
- "Create CI/CD pipeline with GitOps for container applications with security scanning"
|
||||
- "Design Kubernetes operator for custom application lifecycle management"
|
||||
- "Design Kubernetes operator for custom application lifecycle management"
|
||||
|
||||
@@ -7,11 +7,13 @@ model: opus
|
||||
You are a Terraform/OpenTofu specialist focused on advanced infrastructure automation, state management, and modern IaC practices.
|
||||
|
||||
## Purpose
|
||||
|
||||
Expert Infrastructure as Code specialist with comprehensive knowledge of Terraform, OpenTofu, and modern IaC ecosystems. Masters advanced module design, state management, provider development, and enterprise-scale infrastructure automation. Specializes in GitOps workflows, policy as code, and complex multi-cloud deployments.
|
||||
|
||||
## Capabilities
|
||||
|
||||
### Terraform/OpenTofu Expertise
|
||||
|
||||
- **Core concepts**: Resources, data sources, variables, outputs, locals, expressions
|
||||
- **Advanced features**: Dynamic blocks, for_each loops, conditional expressions, complex type constraints
|
||||
- **State management**: Remote backends, state locking, state encryption, workspace strategies
|
||||
@@ -20,6 +22,7 @@ Expert Infrastructure as Code specialist with comprehensive knowledge of Terrafo
|
||||
- **OpenTofu migration**: Terraform to OpenTofu migration strategies, compatibility considerations
|
||||
|
||||
### Advanced Module Design
|
||||
|
||||
- **Module architecture**: Hierarchical module design, root modules, child modules
|
||||
- **Composition patterns**: Module composition, dependency injection, interface segregation
|
||||
- **Reusability**: Generic modules, environment-specific configurations, module registries
|
||||
@@ -28,6 +31,7 @@ Expert Infrastructure as Code specialist with comprehensive knowledge of Terrafo
|
||||
- **Versioning**: Semantic versioning, compatibility matrices, upgrade guides
|
||||
|
||||
### State Management & Security
|
||||
|
||||
- **Backend configuration**: S3, Azure Storage, GCS, Terraform Cloud, Consul, etcd
|
||||
- **State encryption**: Encryption at rest, encryption in transit, key management
|
||||
- **State locking**: DynamoDB, Azure Storage, GCS, Redis locking mechanisms
|
||||
@@ -36,6 +40,7 @@ Expert Infrastructure as Code specialist with comprehensive knowledge of Terrafo
|
||||
- **Security**: Sensitive variables, secret management, state file security
|
||||
|
||||
### Multi-Environment Strategies
|
||||
|
||||
- **Workspace patterns**: Terraform workspaces vs separate backends
|
||||
- **Environment isolation**: Directory structure, variable management, state separation
|
||||
- **Deployment strategies**: Environment promotion, blue/green deployments
|
||||
@@ -43,6 +48,7 @@ Expert Infrastructure as Code specialist with comprehensive knowledge of Terrafo
|
||||
- **GitOps integration**: Branch-based workflows, automated deployments
|
||||
|
||||
### Provider & Resource Management
|
||||
|
||||
- **Provider configuration**: Version constraints, multiple providers, provider aliases
|
||||
- **Resource lifecycle**: Creation, updates, destruction, import, replacement
|
||||
- **Data sources**: External data integration, computed values, dependency management
|
||||
@@ -51,6 +57,7 @@ Expert Infrastructure as Code specialist with comprehensive knowledge of Terrafo
|
||||
- **Resource graphs**: Dependency visualization, parallelization optimization
|
||||
|
||||
### Advanced Configuration Techniques
|
||||
|
||||
- **Dynamic configuration**: Dynamic blocks, complex expressions, conditional logic
|
||||
- **Templating**: Template functions, file interpolation, external data integration
|
||||
- **Validation**: Variable validation, precondition/postcondition checks
|
||||
@@ -58,6 +65,7 @@ Expert Infrastructure as Code specialist with comprehensive knowledge of Terrafo
|
||||
- **Performance optimization**: Resource parallelization, provider optimization
|
||||
|
||||
### CI/CD & Automation
|
||||
|
||||
- **Pipeline integration**: GitHub Actions, GitLab CI, Azure DevOps, Jenkins
|
||||
- **Automated testing**: Plan validation, policy checking, security scanning
|
||||
- **Deployment automation**: Automated apply, approval workflows, rollback strategies
|
||||
@@ -66,6 +74,7 @@ Expert Infrastructure as Code specialist with comprehensive knowledge of Terrafo
|
||||
- **Quality gates**: Pre-commit hooks, continuous validation, compliance checking
|
||||
|
||||
### Multi-Cloud & Hybrid
|
||||
|
||||
- **Multi-cloud patterns**: Provider abstraction, cloud-agnostic modules
|
||||
- **Hybrid deployments**: On-premises integration, edge computing, hybrid connectivity
|
||||
- **Cross-provider dependencies**: Resource sharing, data passing between providers
|
||||
@@ -73,6 +82,7 @@ Expert Infrastructure as Code specialist with comprehensive knowledge of Terrafo
|
||||
- **Migration strategies**: Cloud-to-cloud migration, infrastructure modernization
|
||||
|
||||
### Modern IaC Ecosystem
|
||||
|
||||
- **Alternative tools**: Pulumi, AWS CDK, Azure Bicep, Google Deployment Manager
|
||||
- **Complementary tools**: Helm, Kustomize, Ansible integration
|
||||
- **State alternatives**: Stateless deployments, immutable infrastructure patterns
|
||||
@@ -80,6 +90,7 @@ Expert Infrastructure as Code specialist with comprehensive knowledge of Terrafo
|
||||
- **Policy engines**: OPA/Gatekeeper, native policy frameworks
|
||||
|
||||
### Enterprise & Governance
|
||||
|
||||
- **Access control**: RBAC, team-based access, service account management
|
||||
- **Compliance**: SOC2, PCI-DSS, HIPAA infrastructure compliance
|
||||
- **Auditing**: Change tracking, audit trails, compliance reporting
|
||||
@@ -87,6 +98,7 @@ Expert Infrastructure as Code specialist with comprehensive knowledge of Terrafo
|
||||
- **Service catalogs**: Self-service infrastructure, approved module catalogs
|
||||
|
||||
### Troubleshooting & Operations
|
||||
|
||||
- **Debugging**: Log analysis, state inspection, resource investigation
|
||||
- **Performance tuning**: Provider optimization, parallelization, resource batching
|
||||
- **Error recovery**: State corruption recovery, failed apply resolution
|
||||
@@ -94,6 +106,7 @@ Expert Infrastructure as Code specialist with comprehensive knowledge of Terrafo
|
||||
- **Maintenance**: Provider updates, module upgrades, deprecation management
|
||||
|
||||
## Behavioral Traits
|
||||
|
||||
- Follows DRY principles with reusable, composable modules
|
||||
- Treats state files as critical infrastructure requiring protection
|
||||
- Always plans before applying with thorough change review
|
||||
@@ -106,6 +119,7 @@ Expert Infrastructure as Code specialist with comprehensive knowledge of Terrafo
|
||||
- Considers long-term maintenance and upgrade strategies
|
||||
|
||||
## Knowledge Base
|
||||
|
||||
- Terraform/OpenTofu syntax, functions, and best practices
|
||||
- Major cloud provider services and their Terraform representations
|
||||
- Infrastructure patterns and architectural best practices
|
||||
@@ -116,6 +130,7 @@ Expert Infrastructure as Code specialist with comprehensive knowledge of Terrafo
|
||||
- Monitoring and observability for infrastructure
|
||||
|
||||
## Response Approach
|
||||
|
||||
1. **Analyze infrastructure requirements** for appropriate IaC patterns
|
||||
2. **Design modular architecture** with proper abstraction and reusability
|
||||
3. **Configure secure backends** with appropriate locking and encryption
|
||||
@@ -127,6 +142,7 @@ Expert Infrastructure as Code specialist with comprehensive knowledge of Terrafo
|
||||
9. **Optimize for performance** and cost efficiency
|
||||
|
||||
## Example Interactions
|
||||
|
||||
- "Design a reusable Terraform module for a three-tier web application with proper testing"
|
||||
- "Set up secure remote state management with encryption and locking for multi-team environment"
|
||||
- "Create CI/CD pipeline for infrastructure deployment with security scanning and approval workflows"
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -80,21 +80,21 @@ deploy:production:
|
||||
```yaml
|
||||
# Azure Pipelines
|
||||
stages:
|
||||
- stage: Production
|
||||
dependsOn: Staging
|
||||
jobs:
|
||||
- deployment: Deploy
|
||||
environment:
|
||||
name: production
|
||||
resourceType: Kubernetes
|
||||
strategy:
|
||||
runOnce:
|
||||
preDeploy:
|
||||
steps:
|
||||
- task: ManualValidation@0
|
||||
inputs:
|
||||
notifyUsers: 'team-leads@example.com'
|
||||
instructions: 'Review staging metrics before approving'
|
||||
- stage: Production
|
||||
dependsOn: Staging
|
||||
jobs:
|
||||
- deployment: Deploy
|
||||
environment:
|
||||
name: production
|
||||
resourceType: Kubernetes
|
||||
strategy:
|
||||
runOnce:
|
||||
preDeploy:
|
||||
steps:
|
||||
- task: ManualValidation@0
|
||||
inputs:
|
||||
notifyUsers: "team-leads@example.com"
|
||||
instructions: "Review staging metrics before approving"
|
||||
```
|
||||
|
||||
**Reference:** See `assets/approval-gate-template.yml`
|
||||
@@ -118,6 +118,7 @@ spec:
|
||||
```
|
||||
|
||||
**Characteristics:**
|
||||
|
||||
- Gradual rollout
|
||||
- Zero downtime
|
||||
- Easy rollback
|
||||
@@ -140,6 +141,7 @@ kubectl label service my-app version=blue
|
||||
```
|
||||
|
||||
**Characteristics:**
|
||||
|
||||
- Instant switchover
|
||||
- Easy rollback
|
||||
- Doubles infrastructure cost temporarily
|
||||
@@ -157,16 +159,17 @@ spec:
|
||||
strategy:
|
||||
canary:
|
||||
steps:
|
||||
- setWeight: 10
|
||||
- pause: {duration: 5m}
|
||||
- setWeight: 25
|
||||
- pause: {duration: 5m}
|
||||
- setWeight: 50
|
||||
- pause: {duration: 5m}
|
||||
- setWeight: 100
|
||||
- setWeight: 10
|
||||
- pause: { duration: 5m }
|
||||
- setWeight: 25
|
||||
- pause: { duration: 5m }
|
||||
- setWeight: 50
|
||||
- pause: { duration: 5m }
|
||||
- setWeight: 100
|
||||
```
|
||||
|
||||
**Characteristics:**
|
||||
|
||||
- Gradual traffic shift
|
||||
- Risk mitigation
|
||||
- Real user testing
|
||||
@@ -188,6 +191,7 @@ else:
|
||||
```
|
||||
|
||||
**Characteristics:**
|
||||
|
||||
- Deploy without releasing
|
||||
- A/B testing
|
||||
- Instant rollback
|
||||
@@ -202,7 +206,7 @@ name: Production Pipeline
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ main ]
|
||||
branches: [main]
|
||||
|
||||
jobs:
|
||||
build:
|
||||
|
||||
@@ -28,9 +28,9 @@ name: Test
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ main, develop ]
|
||||
branches: [main, develop]
|
||||
pull_request:
|
||||
branches: [ main ]
|
||||
branches: [main]
|
||||
|
||||
jobs:
|
||||
test:
|
||||
@@ -41,27 +41,27 @@ jobs:
|
||||
node-version: [18.x, 20.x]
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Use Node.js ${{ matrix.node-version }}
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ matrix.node-version }}
|
||||
cache: 'npm'
|
||||
- name: Use Node.js ${{ matrix.node-version }}
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ matrix.node-version }}
|
||||
cache: "npm"
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci
|
||||
- name: Install dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Run linter
|
||||
run: npm run lint
|
||||
- name: Run linter
|
||||
run: npm run lint
|
||||
|
||||
- name: Run tests
|
||||
run: npm test
|
||||
- name: Run tests
|
||||
run: npm test
|
||||
|
||||
- name: Upload coverage
|
||||
uses: codecov/codecov-action@v3
|
||||
with:
|
||||
files: ./coverage/lcov.info
|
||||
- name: Upload coverage
|
||||
uses: codecov/codecov-action@v3
|
||||
with:
|
||||
files: ./coverage/lcov.info
|
||||
```
|
||||
|
||||
**Reference:** See `assets/test-workflow.yml`
|
||||
@@ -73,8 +73,8 @@ name: Build and Push
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ main ]
|
||||
tags: [ 'v*' ]
|
||||
branches: [main]
|
||||
tags: ["v*"]
|
||||
|
||||
env:
|
||||
REGISTRY: ghcr.io
|
||||
@@ -88,35 +88,35 @@ jobs:
|
||||
packages: write
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Log in to Container Registry
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
- name: Log in to Container Registry
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Extract metadata
|
||||
id: meta
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
||||
tags: |
|
||||
type=ref,event=branch
|
||||
type=ref,event=pr
|
||||
type=semver,pattern={{version}}
|
||||
type=semver,pattern={{major}}.{{minor}}
|
||||
- name: Extract metadata
|
||||
id: meta
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
||||
tags: |
|
||||
type=ref,event=branch
|
||||
type=ref,event=pr
|
||||
type=semver,pattern={{version}}
|
||||
type=semver,pattern={{major}}.{{minor}}
|
||||
|
||||
- name: Build and push
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
context: .
|
||||
push: true
|
||||
tags: ${{ steps.meta.outputs.tags }}
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
cache-from: type=gha
|
||||
cache-to: type=gha,mode=max
|
||||
- name: Build and push
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
context: .
|
||||
push: true
|
||||
tags: ${{ steps.meta.outputs.tags }}
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
cache-from: type=gha
|
||||
cache-to: type=gha,mode=max
|
||||
```
|
||||
|
||||
**Reference:** See `assets/deploy-workflow.yml`
|
||||
@@ -128,36 +128,36 @@ name: Deploy to Kubernetes
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ main ]
|
||||
branches: [main]
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Configure AWS credentials
|
||||
uses: aws-actions/configure-aws-credentials@v4
|
||||
with:
|
||||
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
||||
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
||||
aws-region: us-west-2
|
||||
- name: Configure AWS credentials
|
||||
uses: aws-actions/configure-aws-credentials@v4
|
||||
with:
|
||||
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
||||
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
||||
aws-region: us-west-2
|
||||
|
||||
- name: Update kubeconfig
|
||||
run: |
|
||||
aws eks update-kubeconfig --name production-cluster --region us-west-2
|
||||
- name: Update kubeconfig
|
||||
run: |
|
||||
aws eks update-kubeconfig --name production-cluster --region us-west-2
|
||||
|
||||
- name: Deploy to Kubernetes
|
||||
run: |
|
||||
kubectl apply -f k8s/
|
||||
kubectl rollout status deployment/my-app -n production
|
||||
kubectl get services -n production
|
||||
- name: Deploy to Kubernetes
|
||||
run: |
|
||||
kubectl apply -f k8s/
|
||||
kubectl rollout status deployment/my-app -n production
|
||||
kubectl get services -n production
|
||||
|
||||
- name: Verify deployment
|
||||
run: |
|
||||
kubectl get pods -n production
|
||||
kubectl describe deployment my-app -n production
|
||||
- name: Verify deployment
|
||||
run: |
|
||||
kubectl get pods -n production
|
||||
kubectl describe deployment my-app -n production
|
||||
```
|
||||
|
||||
### Pattern 4: Matrix Build
|
||||
@@ -174,23 +174,23 @@ jobs:
|
||||
strategy:
|
||||
matrix:
|
||||
os: [ubuntu-latest, macos-latest, windows-latest]
|
||||
python-version: ['3.9', '3.10', '3.11', '3.12']
|
||||
python-version: ["3.9", "3.10", "3.11", "3.12"]
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@v5
|
||||
with:
|
||||
python-version: ${{ matrix.python-version }}
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@v5
|
||||
with:
|
||||
python-version: ${{ matrix.python-version }}
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
python -m pip install --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
python -m pip install --upgrade pip
|
||||
pip install -r requirements.txt
|
||||
|
||||
- name: Run tests
|
||||
run: pytest
|
||||
- name: Run tests
|
||||
run: pytest
|
||||
```
|
||||
|
||||
**Reference:** See `assets/matrix-build.yml`
|
||||
@@ -228,21 +228,22 @@ jobs:
|
||||
test:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ inputs.node-version }}
|
||||
- run: npm ci
|
||||
- run: npm test
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ inputs.node-version }}
|
||||
- run: npm ci
|
||||
- run: npm test
|
||||
```
|
||||
|
||||
**Use reusable workflow:**
|
||||
|
||||
```yaml
|
||||
jobs:
|
||||
call-test:
|
||||
uses: ./.github/workflows/reusable-test.yml
|
||||
with:
|
||||
node-version: '20.x'
|
||||
node-version: "20.x"
|
||||
secrets:
|
||||
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
|
||||
```
|
||||
@@ -254,34 +255,34 @@ name: Security Scan
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ main ]
|
||||
branches: [main]
|
||||
pull_request:
|
||||
branches: [ main ]
|
||||
branches: [main]
|
||||
|
||||
jobs:
|
||||
security:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Run Trivy vulnerability scanner
|
||||
uses: aquasecurity/trivy-action@master
|
||||
with:
|
||||
scan-type: 'fs'
|
||||
scan-ref: '.'
|
||||
format: 'sarif'
|
||||
output: 'trivy-results.sarif'
|
||||
- name: Run Trivy vulnerability scanner
|
||||
uses: aquasecurity/trivy-action@master
|
||||
with:
|
||||
scan-type: "fs"
|
||||
scan-ref: "."
|
||||
format: "sarif"
|
||||
output: "trivy-results.sarif"
|
||||
|
||||
- name: Upload Trivy results to GitHub Security
|
||||
uses: github/codeql-action/upload-sarif@v2
|
||||
with:
|
||||
sarif_file: 'trivy-results.sarif'
|
||||
- name: Upload Trivy results to GitHub Security
|
||||
uses: github/codeql-action/upload-sarif@v2
|
||||
with:
|
||||
sarif_file: "trivy-results.sarif"
|
||||
|
||||
- name: Run Snyk Security Scan
|
||||
uses: snyk/actions/node@master
|
||||
env:
|
||||
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
|
||||
- name: Run Snyk Security Scan
|
||||
uses: snyk/actions/node@master
|
||||
env:
|
||||
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
|
||||
```
|
||||
|
||||
## Deployment with Approvals
|
||||
@@ -291,7 +292,7 @@ name: Deploy to Production
|
||||
|
||||
on:
|
||||
push:
|
||||
tags: [ 'v*' ]
|
||||
tags: ["v*"]
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
@@ -301,22 +302,22 @@ jobs:
|
||||
url: https://app.example.com
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Deploy application
|
||||
run: |
|
||||
echo "Deploying to production..."
|
||||
# Deployment commands here
|
||||
- name: Deploy application
|
||||
run: |
|
||||
echo "Deploying to production..."
|
||||
# Deployment commands here
|
||||
|
||||
- name: Notify Slack
|
||||
if: success()
|
||||
uses: slackapi/slack-github-action@v1
|
||||
with:
|
||||
webhook-url: ${{ secrets.SLACK_WEBHOOK }}
|
||||
payload: |
|
||||
{
|
||||
"text": "Deployment to production completed successfully!"
|
||||
}
|
||||
- name: Notify Slack
|
||||
if: success()
|
||||
uses: slackapi/slack-github-action@v1
|
||||
with:
|
||||
webhook-url: ${{ secrets.SLACK_WEBHOOK }}
|
||||
payload: |
|
||||
{
|
||||
"text": "Deployment to production completed successfully!"
|
||||
}
|
||||
```
|
||||
|
||||
## Reference Files
|
||||
|
||||
@@ -22,6 +22,7 @@ Implement secure secrets management in CI/CD pipelines without hardcoding sensit
|
||||
## Secrets Management Tools
|
||||
|
||||
### HashiCorp Vault
|
||||
|
||||
- Centralized secrets management
|
||||
- Dynamic secrets generation
|
||||
- Secret rotation
|
||||
@@ -29,18 +30,21 @@ Implement secure secrets management in CI/CD pipelines without hardcoding sensit
|
||||
- Fine-grained access control
|
||||
|
||||
### AWS Secrets Manager
|
||||
|
||||
- AWS-native solution
|
||||
- Automatic rotation
|
||||
- Integration with RDS
|
||||
- CloudFormation support
|
||||
|
||||
### Azure Key Vault
|
||||
|
||||
- Azure-native solution
|
||||
- HSM-backed keys
|
||||
- Certificate management
|
||||
- RBAC integration
|
||||
|
||||
### Google Secret Manager
|
||||
|
||||
- GCP-native solution
|
||||
- Versioning
|
||||
- IAM integration
|
||||
@@ -75,22 +79,22 @@ jobs:
|
||||
deploy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Import Secrets from Vault
|
||||
uses: hashicorp/vault-action@v2
|
||||
with:
|
||||
url: https://vault.example.com:8200
|
||||
token: ${{ secrets.VAULT_TOKEN }}
|
||||
secrets: |
|
||||
secret/data/database username | DB_USERNAME ;
|
||||
secret/data/database password | DB_PASSWORD ;
|
||||
secret/data/api key | API_KEY
|
||||
- name: Import Secrets from Vault
|
||||
uses: hashicorp/vault-action@v2
|
||||
with:
|
||||
url: https://vault.example.com:8200
|
||||
token: ${{ secrets.VAULT_TOKEN }}
|
||||
secrets: |
|
||||
secret/data/database username | DB_USERNAME ;
|
||||
secret/data/database password | DB_PASSWORD ;
|
||||
secret/data/api key | API_KEY
|
||||
|
||||
- name: Use secrets
|
||||
run: |
|
||||
echo "Connecting to database as $DB_USERNAME"
|
||||
# Use $DB_PASSWORD, $API_KEY
|
||||
- name: Use secrets
|
||||
run: |
|
||||
echo "Connecting to database as $DB_USERNAME"
|
||||
# Use $DB_PASSWORD, $API_KEY
|
||||
```
|
||||
|
||||
### GitLab CI with Vault
|
||||
@@ -181,9 +185,9 @@ deploy:
|
||||
runs-on: ubuntu-latest
|
||||
environment: production
|
||||
steps:
|
||||
- name: Deploy
|
||||
run: |
|
||||
echo "Deploying with ${{ secrets.PROD_API_KEY }}"
|
||||
- name: Deploy
|
||||
run: |
|
||||
echo "Deploying with ${{ secrets.PROD_API_KEY }}"
|
||||
```
|
||||
|
||||
**Reference:** See `references/github-secrets.md`
|
||||
@@ -200,6 +204,7 @@ deploy:
|
||||
```
|
||||
|
||||
### Protected and Masked Variables
|
||||
|
||||
- Protected: Only available in protected branches
|
||||
- Masked: Hidden in job logs
|
||||
- File type: Stored as file
|
||||
@@ -294,14 +299,14 @@ spec:
|
||||
name: database-credentials
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: username
|
||||
remoteRef:
|
||||
key: database/config
|
||||
property: username
|
||||
- secretKey: password
|
||||
remoteRef:
|
||||
key: database/config
|
||||
property: password
|
||||
- secretKey: username
|
||||
remoteRef:
|
||||
key: database/config
|
||||
property: username
|
||||
- secretKey: password
|
||||
remoteRef:
|
||||
key: database/config
|
||||
property: password
|
||||
```
|
||||
|
||||
## Secret Scanning
|
||||
|
||||
Reference in New Issue
Block a user