Devopsai Templates

CI/CD pipeline design, optimization, and security. Activates when creating or debugging GitHub Actions, GitLab CI, Jenkins pipelines, or discussing build/test/deploy workflows. Covers pipeline security, artifact management, and deployment strategies.

Cloud cost optimization and FinOps practices. Activates when analyzing cloud bills, optimizing resource costs, implementing tagging strategies, rightsizing workloads, or discussing Reserved Instances, Savings Plans, and Spot instances.

DevSecOps, security scanning, and vulnerability management. Activates when reviewing security configurations, analyzing vulnerabilities, implementing secrets management, hardening infrastructure, or discussing compliance (SOC2, PCI-DSS, HIPAA).

Automatically diagnose Kubernetes cluster and application issues. Collects node status, unhealthy pods, events, and resource usage, then returns a structured report with severity, evidence, and remediation steps.

Terraform infrastructure code review, validation, and best practices. Activates when reviewing .tf files, analyzing terraform plan output, discussing IaC patterns, or troubleshooting Terraform errors. Covers modules, state management, security, and cost optimization.

Review Kubernetes manifests for security, reliability and best practices before deployment. Scores manifests across three dimensions and returns prioritized findings with specific YAML fixes.

Kubernetes troubleshooting, diagnostics, and incident response. Activates when debugging pod failures, analyzing cluster issues, reviewing K8s manifests, or responding to production incidents. Covers deployments, services, networking, and resource management.

Start a new Spec-Driven feature — orchestrates requirements → design → tasks with human approval gates between phases

Show progress of in-flight specs — phase, completed tasks, remaining work, last activity

Implement the next unchecked task from an approved tasks.md, one task at a time, with validation

Observability, monitoring, and incident response. Activates when setting up Prometheus, Grafana, alerting rules, analyzing metrics/logs, debugging performance issues, or reducing MTTR. Covers SLOs, SLIs, distributed tracing, and on-call workflows.

Validate that an approved spec is internally consistent and that current code/infra matches it (drift detection)

Comprehensive DevOps engineering covering infrastructure, CI/CD, containers, cloud platforms, and SRE practices. This is a general-purpose skill that activates for broad DevOps questions, architecture decisions, tooling recommendations, and best practices across the entire DevOps lifecycle.

EKS/Kubernetes upgrade verification and compatibility analysis. Activates when planning cluster upgrades, checking deprecated APIs, analyzing addon compatibility, or preparing upgrade runbooks. Covers Pluto, Kubent, EKS MCP Server, and CI/CD integration.

Builds and pushes Docker images to Amazon ECR repositories. Use whenever the user asks to build and send images to ECR, push containers, upload an image to the registry or publish a Docker image to AWS, even without mentioning "docker-push-ecr" explicitly. Takes app-path and ECR-URI pairs as arguments; multiple pairs are supported in a single run.

Runs the Terraform stack deploy pipeline (fmt → validate → plan → apply) in sandbox/dev environments. Use when the user asks to deploy, apply, provision or bring up Terraform infrastructure in a non-production environment, even without mentioning "terraform-deploy" explicitly. With a stack name as argument (e.g. "01-networking"), deploys only that stack; with no argument, deploys all stacks in sequence. Always skips the remote-backend stack. NEVER use against a production workspace/environment.

Automatically diagnose Karpenter issues — provisioning failures, consolidation problems, NodeClaim lifecycle issues. Collects cluster state and returns structured report with severity, evidence, and remediation steps.

Generates optimized, production-ready Dockerfiles. Use whenever the user asks to create a Dockerfile, containerize an application, dockerize an app or build a Docker image, even without mentioning "dockerfile-generator" explicitly. Takes the application folder path as argument, detects the language automatically and generates a Dockerfile + .dockerignore with security and size best practices, then tests the result automatically.

Generate optimized Karpenter NodePool and EC2NodeClass configurations based on workload requirements. Handles Spot strategies, disruption budgets, instance diversity, and cost optimization.

Automated GKE incident triage with read-only-first discipline. Diagnoses pod failures (OOMKilled, CrashLoopBackOff, ImagePullBackOff, scheduling failures), latency spikes, and rollout problems by chaining GKE MCP read-only tools, Cloud Logging, and Cloud Monitoring. Produces a structured root-cause + remediation plan with two options (fast rollback vs forward fix), tools needed for each, and an explicit endpoint promotion request before any mutating call. Activates during on-call investigations and incident response.

Full preflight for an EKS Kubernetes version upgrade. Activates before any control plane hop. Runs pluto (declared intent), kubent (live objects) and EKS upgrade insights (observed traffic), checks the Karpenter and addon compatibility matrices, audits AMI selection mode and drift gates, and consolidates everything into a single go/no-go report.

Guided rollback rehearsal for EKS upgrades. Activates after an upgrade completes in a non-critical environment, or when planning production rollback strategy. Walks the five rollback layers (Git, nodes, addons, control plane, CRDs), times each one, and produces the evidence that decides between drift and blue/green for production fleets.

Provision GKE Autopilot clusters across multiple regions in parallel using an Agent Team. Each regional subagent creates VPC, subnets, Cloud NAT, the cluster with Workload Identity and Dataplane V2, baseline namespaces, and validates first 5 minutes for zero Warning events. The orchestrator runs a reconciliation pass to detect cross-region drift before incidents. Activates when bootstrapping multi-region GKE infrastructure, expanding into new regions, or migrating from single-region to multi-region. Supports dry_run mode that produces JSON plans without applying.