platform

Plugin platform from marketplace greenblacked-ai in greenblacked/AI. Commands read from the repo's manifest — 2 days ago.

Skills (22)

• apiserver-pressure

  Find out why the Kubernetes API server or etcd is slow, throttling or near its limits, and fix the client before raising any limit: slice request rate and latency by verb and resource, name the top caller from the audit log's user agent, count stored objects per resource, read etcd database size aga

• bootstrap-dependency-audit

  Hostile audit of the tooling needed to recover production, hunting for cycles: could you still sign in, read secrets, pull images, deploy, run Terraform and change DNS if CI, the registry, the identity provider, the secrets store, DNS or the state backend is down? Write the recovery path's dependenc

• brownfield-iac-adoption

  Bring a hand-built, click-ops estate under Terraform or OpenTofu, or measure how much of it is still unmanaged. Enumerate from the provider's inventory API (AWS Resource Explorer or Config, Cloud Asset Inventory, Azure Resource Graph) rather than memory, diff it against every state for the unmanaged

• cdn-configuration

  Tune CDN and edge caching for origin offload and safe purges: audit the origin's Cache-Control and Vary before any edge rule, normalise the cache key (strip tracking parameters, allowlist cookies), make fingerprinted assets immutable and HTML short-lived with stale-while-revalidate, shield the origi

• commitment-planning

  Decide how much Savings Plan, reserved instance or committed-use discount to buy, and when, so a discount never becomes a floor paid for idle capacity: rightsize first, measure the trailing 90-day hourly floor of eligible usage rather than the average, convert it to a commitment at the discounted ra

• connection-exhaustion-hunt

  Hunt intermittent timeouts from exhausting the network path: NAT or SNAT ports, local ephemeral ports, a full conntrack table, or 5-second DNS stalls (ndots:5 search expansion, the conntrack race). Read counters first, compute connections per destination IP and port against its ceiling, then fix in

• data-transfer-forensics

  Find which workloads generate the bytes behind a data-transfer line on the cloud bill — cross-AZ, NAT gateway processing, internet egress, inter-region — and fix the costliest. Enable VPC flow logs with the extended fields, aggregate bytes by source, destination, zone pair, path and port in a query

• db-major-upgrade

  Upgrade a PostgreSQL or MySQL major version, managed or self-hosted: scan extensions, removed features and authentication plugins first; restore a production snapshot and rehearse the whole upgrade with timings; choose in-place pg_upgrade, blue/green or logical replication by the downtime you can to

• db-replication

  Operate PostgreSQL and MySQL replicas, logical replication and failover, including a replication slot filling the primary's disk: set a lag budget per read path and send read-your-writes reads to the primary; alert on lag in bytes and seconds and on slot-retained WAL well before the disk fills; writ

• dns-operations

  Run DNS as code and audit it, so a forgotten record cannot be taken over and a key rollover cannot take the domain offline. Put every zone under Terraform, octoDNS or DNSControl with a reviewed plan and a drift check, harden the registrar (domain locks, MFA, a recovery email off the domain), sweep C

• ephemeral-environments

  Build per-pull-request preview environments that are cheap, safe and gone when the pull request is: isolate by data sensitivity and never in the production account, label every resource with owner, pull request and expiry and refuse anything unlabelled, seed synthetic data rather than a production c

• gateway-api-migration

  Move HTTP routing off an Ingress controller, such as the retired ingress-nginx or a setup leaning on annotations and snippets, onto Gateway API or another controller without a flag day. Inventory every annotation, snippet and controller-wide default, map each to a Gateway API field or mark it unport

• iac-version-upgrade

  Upgrade Terraform or OpenTofu core, or move a provider across a major version, without an apply nobody meant: read every release's breaking changes against the arguments you use, clear deprecation warnings on the old version first, move one provider at a time with the lock file committed for every p

• intermittent-502-hunt

  Find the cause of sporadic 502s and 504s behind a load balancer or proxy: confirm the balancer's idle timeout is shorter than the upstream's keepalive timeout (the reverse makes the backend close a connection the balancer is reusing), then deregistration delay against the longest request, health-che

• ip-exhaustion-recovery

  Recover from running out of IP addresses — subnets with no free addresses, pods stuck in ContainerCreating because the CNI cannot assign one, nodes that will not launch, or networks that cannot be peered because their CIDRs overlap — without a rebuild. Measure who holds the addresses per subnet and

• k8s-network-policy

  Roll out default-deny Kubernetes NetworkPolicy, or its Cilium or Calico equivalent, without an outage: confirm the CNI enforces policy at all, observe real flows for a full business cycle before writing a rule, generate allows from the observed edges, allow DNS and the API server explicitly, run in

• k8s-storage

  Run persistent volumes and stateful workloads on Kubernetes without losing data: set reclaimPolicy Retain, allowVolumeExpansion and WaitForFirstConsumer binding before the first claim, treat a zonal volume as a scheduling constraint, grow a PVC or a StatefulSet's claims, snapshot and prove the resto

• monolith-state-split

  Split one oversized Terraform or OpenTofu state, thousands of resources and half-hour plans, into smaller stacks without destroying or recreating anything. Back up, draw the dependency graph, cut by blast radius and change cadence (network, data, compute, applications), replace in-state references w

• resource-decommission

  Retire an unused service, cloud account or orphaned resource without deleting something still in use: prove no use across a full business cycle including month-end jobs, run a scream test (deny access or scale to zero) for a set window, take a final snapshot, keep deletion protection on until the la

• restore-canary

  Build a scheduled, unattended restore of the newest database backup into a throwaway instance, verified and torn down daily, so \"we have backups\" becomes a measurement rather than a belief. Fails first when the newest backup is older than its interval, restores into an isolated scratch target, com

• spot-readiness

  Make workloads survive spot or preemptible capacity being reclaimed, and decide which must not run there: classify each workload by its recovery time against the interruption notice (two minutes on AWS, 30 seconds on GCP and Azure), diversify across many instance types and every zone, run exactly on

• workload-identity

  Replace static cloud keys with federated identity for pods and CI: IRSA or EKS Pod Identity, GKE and Azure workload identity, GitHub Actions OIDC. The trust policy pins issuer, audience and the exact subject (repository plus branch or environment; namespace plus service account), never a wildcard; o

Subagents (1)

• connection-table-reader

  Read a saved conntrack table dump, ss or netstat socket listing, or NAT gateway port-allocation export and return connection counts per destination IP and port against the relevant limit, with the one destination that dominates, so the table itself never enters the caller's context. Use when someone

Similar plugins