mchittineni
- 44 skills
- 0 followers
- 8 hours ago last updated
- ▌ Skill Name In Kebab Case · mchittineni bundleWhat this skill covers, naming the concrete tools, APIs and named patterns it actually teaches. Use when `<the symptoms and requests a real user would type>`, when `<second trigger>`, or when `<third trigger>`. Third person, 120-700 characters, no seniority prefix.
- ▌ Write A Skill · mchittineni bundleAgent-skill authoring meta-skill: strict SKILL.md structure, progressive disclosure, description triggers, bundled scripts and references, and a 3-phase Gather/Draft/Review workflow with validation gates. Use when creating, refactoring, auditing, or reviewing an AI agent skill in this repository or any skills library.
- ▌ Cicd Pipeline Design · mchittineni bundleCI/CD pipeline architecture for GitHub Actions and GitLab CI: matrix testing, dependency caching, OIDC keyless cloud authentication, security gating, and concurrency control. Use when a pipeline is slow because every job reinstalls dependencies, when long-lived AWS or cloud access keys stored as CI secrets must be removed, or when building, gating and speeding up a build-test-deploy workflow.
- ▌ Terraform Iac Modules · mchittineni bundleTerraform and OpenTofu module architecture, remote state with locking and encryption, provider and module version pinning, drift detection, and safe plan/apply workflow. Use when structuring or restructuring a Terraform repository across dev, staging and production environments, writing reusable modules, configuring a state backend, or investigating unexplained infrastructure drift.
- ▌ API Gateway Service Mesh · mchittineni bundleAPI gateway and service mesh architecture: Istio strict mTLS and authorization policy, VirtualService traffic shifting, Envoy Gateway and Kong ingress, retries/timeouts/outlier detection, and rate limiting. Use when configuring ingress routing, enforcing zero-trust service-to-service traffic, or debugging mesh routing and mTLS failures.
- ▌ Devops Metrics Dora Kpis · mchittineni bundleDORA metrics instrumentation: deployment frequency, lead time for changes, change failure rate, and time to restore, with PromQL dashboards, benchmark bands, and anti-gaming guidance. Use when measuring delivery performance, building an engineering-metrics dashboard, or diagnosing why throughput or stability is poor.
- ▌ Performance Load Testing · mchittineni bundlePerformance engineering with k6 and Locust: load, stress, spike and soak profiles, virtual users (VUs), latency percentiles (p95/p99), threshold-gated tests in CI, and bottleneck profiling. Use when writing a k6 or Locust script, deciding whether an API can handle a peak traffic event, capacity planning before launch, or investigating why average latency looks fine while users report slowness.
- ▌ Scripting And Automation · mchittineni bundleProduction Bash and Python automation: `set -euo pipefail` discipline, lockfile-guarded single execution, idempotent design, structured logging, trap-based cleanup, and CLI ergonomics. Use when writing, reviewing, or hardening an operational script, cron job, or internal CLI tool.
- ▌ Database Devops Lifecycle · mchittineni bundleDatabase DevOps: expand/contract zero-downtime schema migration, migration-as-code with Flyway, Liquibase and Atlas, connection pooling, replication lag, and rollback strategy. Use when adding, renaming or dropping a column on a large Postgres or MySQL table without downtime, running migrations from a deploy pipeline, or diagnosing read replicas lagging behind the primary and serving stale data.
- ▌ Helm Kubernetes Deployment · mchittineni bundleHelm chart engineering: chart/subchart layout, values schema validation, hardened Deployment templates (probes, resources, securityContext, PDB), and release lifecycle with rollback. Use when authoring or reviewing a Helm chart, templating Kubernetes manifests, or debugging a failed or stuck Helm release.
- ▌ Policy As Code Opa Kyverno · mchittineni bundlePolicy as code for Kubernetes and infrastructure: authoring Kyverno ClusterPolicy rules, OPA Rego in a Gatekeeper ConstraintTemplate, and Conftest checks, plus Pod Security Standards enforcement, policy unit testing, and an owned exception register with expiry dates. Use when privileged containers or pods without resource limits must be rejected at admission rather than reported, when admission policies need tests so a rule cannot silently stop matching, or when choosing between Kyverno and OPA Gatekeeper.
- ▌ AWS Eks Enterprise Patterns · mchittineni bundleEnterprise AWS EKS architecture: VPC CNI prefix delegation and IP planning, Karpenter NodePool/EC2NodeClass autoscaling, IRSA and EKS Pod Identity, add-on lifecycle, and upgrade strategy. Use when designing, scaling, hardening, or upgrading an EKS cluster, or fixing pod IP exhaustion and node-scaling problems.
- ▌ AWS Iam Zero Trust Policies · mchittineni bundleAWS identity governance: Service Control Policies (SCPs) that deny actions organization-wide such as disabling CloudTrail or creating public S3 buckets, permission boundaries, ABAC tag-based access, condition keys, and cross-account role trust with ExternalId and OIDC. Use when writing or reviewing an SCP or IAM policy, scoping down a role that has AdministratorAccess, or designing multi-account guardrails and federated access.
- ▌ Sli Slo Error Budget Design · mchittineni bundleSLI, SLO and SLA design: indicator selection with explicit good-events and valid-events definitions, availability and latency target setting, error-budget accounting and freeze policy, and multi-window multi-burn-rate alerting. Use when defining reliability targets or an SLO target for a user-facing API or service, replacing noisy threshold alerts with burn-rate alerts, or governing releases against a spent budget.
- ▌ Backup And Disaster Recovery · mchittineni bundleBackup and DR engineering: RPO/RTO tiering (backup-restore, pilot light, warm standby, multi-region active), cross-region replication, Velero Kubernetes backups, immutability/retention, and failover drills. Use when designing a DR strategy, setting RPO/RTO targets, automating backups, or running a restore or failover exercise.
- ▌ Secrets Management Vault Kms · mchittineni bundleSecrets management with HashiCorp Vault, External Secrets Operator, and cloud KMS: dynamic short-lived credentials, envelope encryption, Kubernetes auth and workload identity, automatic rotation on a schedule instead of manual 90-day resets, and revocation under compromise. Use when a database password or API key sits in a plain Kubernetes Secret or a manifest checked into Git, or when workloads need credential material injected at runtime without storing it.
- ▌ Shift Left Security Sast Sca · mchittineni bundleShift-left security automation: Semgrep SAST, Trivy and Snyk dependency and image scanning, Gitleaks repository scans for committed credentials, and SBOM generation in CycloneDX or SPDX format. Use when adding code, dependency or image scanning to a CI pipeline, when a scanner reports hundreds of findings that developers now ignore and gates need tuning for false positives, or when a customer or auditor asks for an SBOM produced by the build.
- ▌ AI Agent Security LLM Threats · mchittineni bundleSecurity for LLM and agent systems: direct and indirect prompt injection, the OWASP Top 10 for LLM Applications, MITRE ATLAS technique mapping, excessive agency and tool-scope containment, egress allowlisting to stop data exfiltration, human confirmation for irreversible actions, and treating third-party skills and MCP servers as untrusted code. Use when an agent is given tools or credentials, when retrieved documents or repository files could carry injected instructions, or when reviewing an AI feature before it reaches production.
- ▌ AWS Cloud Migration Strategies · mchittineni bundleAWS migration planning: the 6Rs framework (rehost, replatform, refactor, repurchase, retain, retire), discovery and wave planning, MGN server migration, DMS data cutover with CDC, and rollback criteria. Use when planning a datacenter exit or lease expiry, deciding whether a legacy monolith should be rehosted or refactored, or moving a large Oracle, SQL Server or Postgres database with minimal downtime.
- ▌ Docker Containerization Basics · mchittineni bundleContainer image engineering: multi-stage builds, layer-cache ordering, non-root users, distroless and minimal base images, and image-size/attack-surface reduction. Use when writing or reviewing a Dockerfile, shrinking image size, fixing slow builds, or hardening containers before they reach a registry.
- ▌ GCP Cloud Engineering Patterns · mchittineni bundleGCP platform engineering: organization, folder and project hierarchy, Organization Policy constraints, Shared VPC, VPC Service Controls, IAM Workload Identity Federation, and BigQuery operations. Use when designing a Google Cloud resource hierarchy or network, letting GitHub Actions or another external CI deploy to GCP without a service account key, or building a data perimeter.
- ▌ GCP Gke Autopilot Multi Tenant · mchittineni bundleGKE Autopilot and Standard multi-tenancy: namespace and node isolation, Workload Identity, network policy, Shared VPC topology, VPC Service Controls, and Autopilot vs Standard trade-offs. Use when designing a multi-tenant GKE platform, isolating tenant workloads, or choosing between Autopilot and Standard.
- ▌ Git Branching Merge Strategies · mchittineni bundleGit workflow selection (trunk-based, GitHub Flow, GitFlow), rebase vs merge policy, interactive rebase hygiene, conflict resolution, and emergency recovery operations. Use when choosing a branching model, defining merge/rebase rules for a team, resolving conflicts, or recovering from a bad commit, push, or revert.
- ▌ Gitops Multi Cluster Argo Flux · mchittineni bundleMulti-cluster GitOps with ArgoCD ApplicationSets, app-of-apps topology, and Flux v2: fleet reconciliation, sync waves, prune and self-heal semantics, drift detection. Use when managing many clusters or environments declaratively, deciding how to structure repositories, branches and overlays to promote a release from staging to production, or debugging an Application stuck OutOfSync.
- ▌ Infrastructure Host Monitoring · mchittineni bundleFleet-wide infrastructure telemetry: node_exporter and cAdvisor collection with PromQL alert rules for CPU saturation, memory pressure, I/O wait, and disk-fill prediction using predict_linear. Use when standing up monitoring or dashboards across a fleet of nodes, authoring or tuning infrastructure alert rules, or arranging to be paged before a filesystem fills rather than after it is already full.
- ▌ Linux Sysadmin Troubleshooting · mchittineni bundleLinux host troubleshooting with the USE method (Utilization, Saturation, Errors): high load average, memory pressure and OOM kills, disk and inode exhaustion, I/O wait, processes hung in D state, socket and DNS failures. Use when a server or VM is degraded, crawling, or unresponsive and needs live hands-on diagnosis, when writes fail with 'No space left on device' despite free space, or when a stuck process must be traced.
- ▌ Cloud Security Posture Cspm Cis · mchittineni bundleCloud Security Posture Management: Prowler and ScoutSuite multi-cloud audits, CIS Benchmark baselines for AWS, Azure and GCP, over-permissive IAM discovery, and exception workflow. Use when auditing an account or organization's security posture, finding unused and over-permissive permissions across hundreds of roles, preparing for a CIS or compliance review, or triaging misconfiguration findings.
- ▌ Prometheus Grafana Otel Tracing · mchittineni bundleUnified observability: OpenTelemetry Collector pipelines, Prometheus scraping and recording rules, Loki log correlation, Tempo distributed tracing, exemplars, sampling strategy, and cardinality control. Use when instrumenting services so a latency spike can be followed to the exact trace and log line, building the metrics-logs-traces stack, or fixing missing telemetry and cardinality blowups.
- ▌ Azure Cloud Engineering Patterns · mchittineni bundleAzure platform engineering: Cloud Adoption Framework management groups and subscription hierarchy, hub-and-spoke and Virtual WAN networking, Private Endpoints with Private DNS zones, Key Vault, Azure Policy as code, and Entra RBAC. Use when designing an Azure landing zone or network topology, making Storage, SQL or other PaaS unreachable from the internet, or enforcing tagging and allowed regions across every subscription.
- ▌ Configuration Management Ansible · mchittineni bundleAnsible configuration management: idempotent playbooks, role architecture, group_vars and host_vars layout, Jinja2 templating, Vault-encrypted variables, and check-mode verification. Use when applying a hardening or CIS baseline repeatably across many Ubuntu or RHEL hosts, refactoring a monolithic playbook into roles, or fixing a playbook that reports 'changed' on every run.
- ▌ Container Runtime Security Falco · mchittineni bundleRuntime threat detection with Falco and eBPF: custom rule authoring, syscall and Kubernetes audit sources, macros, lists and exceptions for tuning, alert routing, and response playbooks. Use when alerting on attacker behaviour inside a running container such as an interactive shell being opened in production, writing or tuning a noisy Falco rule, or triaging a runtime alert.
- ▌ Secops Incident Triage Forensics · mchittineni bundleSecurity incident response: compromise triage, cloud instance and credential containment, forensic disk and memory capture with chain of custody, IAM session and key revocation, and SIEM correlation for threat hunting. Use when a host, container or cloud credential is suspected compromised, when a leaked access key found in a public repository has already been used, or when capturing evidence.
- ▌ Zero Downtime Release Strategies · mchittineni bundleProgressive delivery: Argo Rollouts and Flagger canaries with automated Prometheus analysis, blue-green cutover, Istio traffic shifting, and automatic rollback. Use when releasing to a small percentage of traffic first while watching error rate and latency, when a bad deploy must roll back automatically without a human, or when choosing between canary, blue-green and rolling deployment.
- ▌ Azure Aks Enterprise Landing Zones · mchittineni bundleAzure AKS enterprise landing zones: Azure CNI Overlay networking and IP planning, private clusters, Entra Workload Identity federation, Azure Policy for Kubernetes, and node-pool topology. Use when building or hardening AKS to an enterprise baseline, when AKS pods must authenticate to Key Vault or other Azure services without any stored secret, or when enforcing Kubernetes governance on Azure.
- ▌ Incident Management And Postmortem · mchittineni bundleSRE incident command: ICS role assignment (IC, Ops, Comms, Scribe), severity matrix, live mitigation and comms protocol, and blameless post-mortem with tracked action items. Use when running or improving incident response, declaring severity, coordinating an active outage, or writing a post-mortem.
- ▌ Cloud Native Microservices Patterns · mchittineni bundleCloud-native service design: 12-factor compliance, liveness, readiness and startup probes, graceful shutdown with SIGTERM handling and connection draining, structured logging with correlation IDs, and idempotency. Use when pods are killed during a deploy and drop in-flight requests, when Kubernetes restarts a container that is merely slow to start, or when refactoring a service to run correctly on Kubernetes.
- ▌ Internal Developer Portal Backstage · mchittineni bundleInternal Developer Platform engineering: Backstage software catalog and entity model, Golden Path scaffolder templates, TechDocs, and platform-as-product adoption and DevEx metrics. Use when building self-service so developers can create a new production-ready service in one click, defining golden paths, onboarding services into a catalog, or measuring platform adoption.
- ▌ Supply Chain Security Slsa Sigstore · mchittineni bundleSoftware supply chain security: keyless Sigstore/cosign signing with OIDC, SLSA build levels, in-toto provenance attestations, SBOM attestation, and signature plus identity verification enforced at Kubernetes admission with Kyverno or the sigstore policy-controller. Use when release artifacts or container images need signing, provenance or attestation, when a customer or auditor asks which SLSA level a build meets, or when only trusted and verified images should be allowed to run in a cluster.
- ▌ Chaos Engineering Resilience Testing · mchittineni bundleChaos engineering practice: steady-state hypotheses tied to SLIs, blast-radius containment, pre-agreed abort criteria and automated rollback, fault injection with AWS FIS, Chaos Mesh or LitmusChaos, and GameDay facilitation that produces fixes. Use when a failover or redundancy claim has never actually been tested, when planning a GameDay or resilience exercise, or when deciding whether it is safe to inject failure into production and how to bound it.
- ▌ Detection Engineering Threat Hunting · mchittineni bundleDetection engineering and threat hunting: detection-as-code with Sigma rules in version control, log pipeline and telemetry source coverage, MITRE ATT&CK coverage mapping, alert precision and tuning to survive analyst trust, validation with Atomic Red Team, and hypothesis-driven hunts for activity that evaded automated controls. Use when security alerts are too noisy to act on, when deciding which detections to write and which telemetry to collect first, or when hunting for attacker activity nothing has alerted on.
- ▌ Enterprise Iac Governance Terragrunt · mchittineni bundleEnterprise IaC governance: Terragrunt DRY multi-account layouts, generated backends and providers, dependency graphs, and policy-as-code gates with OPA and Conftest. Use when Terraform has been copy-pasted across many accounts or environments, or when non-compliant resources such as unencrypted or untagged S3 buckets must be blocked in CI before apply rather than found afterwards.
- ▌ Serverless Event Driven Architecture · mchittineni bundleServerless and event-driven architecture: Lambda concurrency, EventBridge routing, SQS standard and FIFO queues with MessageGroupId ordering, Step Functions orchestration, dead-letter queues with redrive, idempotency, and cold-start mitigation. Use when designing event-driven flows, choosing FIFO versus standard for per-customer ordering at high throughput, or when events are lost, duplicated or throttled.
- ▌ Scalability High Availability Patterns · mchittineni bundleScalability and high availability: multi-AZ and active-active topology, global load balancing and failover, HPA and KEDA autoscaling on custom or queue-depth metrics, circuit breakers, bulkheads, retries with jitter, and rate limiting. Use when a service must survive an availability zone failure, when it collapses under traffic spikes and drags downstream services with it, or when CPU is the wrong autoscaling signal.
- ▌ Finops Framework Inform Optimize Operate · mchittineni bundleCloud FinOps: the Inform, Optimize and Operate lifecycle, allocation tagging, showback and chargeback, unit economics, Kubernetes cost attribution with Kubecost and OpenCost, Savings Plans, Reserved Instances and CUD commitment modelling, and waste detection. Use when a cloud bill has jumped unexpectedly and the driver is unknown, when deciding whether to buy commitments, or when charging shared spend back to teams.