platform-skills

Platform Skills

A production-grade field handbook for platform, DevOps, SRE, and cloud engineers covering Kubernetes, Flux CD, Terraform, GitHub Actions, AWS, OPA/Rego, KEDA, Karpenter, supply chain security, Falco, observability, and more. Use it on GitHub, as a local reference, or with Claude, Codex, Cursor, and Copilot for interactive guidance with blast radius, validation steps, and rollback plans built in.

Works With

If this handbook saves you time, give it a star — it helps others find it. Found a gap or a better pattern? Contributions are welcome — open an issue, improve a reference guide, or add an example.

Why Platform Skills

Platform teams keep rediscovering the same hard lessons: unclear ownership, unsafe IAM, weak Kubernetes defaults, drifting GitOps overlays, CI checks that run too late, and rollback plans that only appear after an incident. Platform Skills turns those lessons into reusable guidance for the tools engineers already use.

Use it when you need a second brain for production platform work:

• Review a Terraform, Helm, Kubernetes, Flux, GitHub Actions, or AWS change before it merges
• Generate platform assets with security, observability, validation, and rollback already considered
• Debug incidents with evidence-first troubleshooting instead of guesswork
• Give every developer the same platform engineering baseline in Claude, Codex, Cursor, and Copilot

Install In 60 Seconds

Clone once, then install the integration your team uses:

git clone https://github.com/nitinjain999/platform-skills.git
cd platform-skills

Need manual setup, global editor rules, or troubleshooting? See INSTALLATION.md.

Try It On Your Repo

See BEFORE_AFTER.md for side-by-side before/after examples across Kubernetes, Terraform, Flux CD, GitHub Actions, OPA/Rego, and PR triage. More copy-paste workflows in PROMPTS.md.

Use $platform-skills to review this Terraform change for IAM scope, replacement risk, validation, and rollback.

Review this Kubernetes Deployment for production readiness: securityContext, resources, probes, HPA, PDB, and NetworkPolicy.

My Flux Kustomization is stuck NotReady. Walk me from evidence to fix to rollback.

Generate a production-ready GitHub Actions workflow with OIDC, pinned actions, cache safety, and least privilege.

What is this?

This repository is a reference handbook for developers, DevOps engineers, SREs, cloud engineers, and platform teams. It is structured in independent layers:

• Handbook — references/ and examples/ are the main product. Every domain has a deep-dive guide and working example assets you can copy directly into your project. Use it on GitHub, from a local clone, or as a team knowledge base.
• Claude plugin — SKILL.md and .claude-plugin/marketplace.json add an optional routing layer so Claude surfaces the right section of the handbook when you ask platform engineering questions interactively.
• Codex skill — the repo root is a self-contained skill folder: SKILL.md provides routing, agents/openai.yaml provides Codex UI metadata, and references/ plus examples/ are loaded on demand.
• Cursor rules — .cursorrules and .cursor/rules/*.mdc give Cursor project-level and scoped file rules for platform engineering reviews and generation.
• Copilot instructions — .github/copilot-instructions.md lets teams commit the baseline into application and platform repositories.

All layers work independently. Agent integrations are optional.

Navigate

Domains

Domain	Reference guide	What it covers
Kubernetes	references/kubernetes.md	Cluster baseline, workload patterns, network policy, RBAC, pod security — /platform-skills:kubernetes
🛡️ Kyverno	references/kyverno.md	Validate/mutate/generate/verifyImages policies, Audit→Deny promotion, PolicyException, PolicyReport, kyverno-cli testing, PSP/Gatekeeper migration
OpenShift	references/openshift.md	SCC diagnosis, Routes TLS, OpenShift GitOps delivery, cluster upgrade validation — /platform-skills:openshift
Argo CD	references/argocd.md	App-of-apps design, ApplicationSet, sync control, promotion flows
Flux CD	references/fluxcd.md	Monorepo structure, reconciliation, multi-tenancy, image automation. Deep-dive guides: Sources, HelmRelease, Kustomization, Notifications, Operator, Security, Troubleshooting, Migration, ResourceSets, MCP, Terraform bootstrap — /platform-skills:fluxcd
AWS	references/aws.md	IAM least-privilege, IRSA, EKS, resource tagging, cost allocation
AWS CloudFront	references/aws-cloudfront.md	Distributions, OAC, cache policies, security headers, Lambda@Edge, CloudFront Functions, multi-account
AWS WAF	references/aws-waf.md	Web ACLs, managed rule groups, rate limiting, Bot Control, Firewall Manager, Shield Advanced
Azure	references/azure.md	Workload identity, AKS, RBAC, resource tagging, Azure Policy — /platform-skills:azure
Terraform	references/terraform.md	Module design, state management, testing, CI/CD integration
Checkov	references/checkov.md	Bootstrap, static + plan scanning, multi-cloud provider detection, fix mode, custom checks
🔍 Trivy	references/trivy.md	Image, fs, repo, SBOM, and cluster CVE scanning; severity gates; Trivy Operator via Flux
GitHub Actions	references/github-actions.md	Security hardening, OIDC, SHA pinning, reusable workflows — /platform-skills:github-actions
Composite GitHub Actions	references/composite-actions.md	Composite action scaffolding, review, hardening, testing, release, private repo access
🐈 Zizmor	references/zizmor.md	Workflow and action security audit: template injection, credential persistence, unpinned uses:, over-broad permissions, impostor commits; personas, zizmor.yml policy, exit-code gating, auto-fix, SARIF — /platform-skills:zizmor
🦅 Kingfisher	references/kingfisher.md	Find, live-validate, map blast radius of, and revoke leaked secrets across repos, Git history, GitHub/GitLab/Bitbucket orgs, S3/GCS, Docker images, Slack, Jira, Confluence, Teams; baseline tracking, kingfisher.yaml policy, CI gate, pre-commit — /platform-skills:kingfisher