Container orchestration

解答与开源产品有关的深度技术问题，输出图文并茂的 Markdown 技术文章。触发条件：用户提出与开源项目（如 PostgreSQL、Redis、Kafka、Kubernetes、ClickHouse、Flink 等）相关的技术问题，并提供源码目录或 URL、deepwiki repo 名称。即使用户只说"帮我解答这个开源问题"或"分析一下这个项目的某个机制"，也应使用本…

digoal/blog

Install the Datadog Agent on Kubernetes using the Datadog Operator — required before enabling Single Step Instrumentation (SSI), which automatically instruments applications for APM without code…

datadog-labs/agent-skills

Oracle Cloud Infrastructure guidance for designing, operating, and troubleshooting OCI services, including OCI Kubernetes Engine (OKE), OCI Internet of Things Platform, OCI Functions deployment and…

oracle/skills

Launches, monitors, debugs, and collects one run-scoped AIPerf Kubernetes benchmark without changing its workload semantics.

ai-dynamo/dynamo

Container and Kubernetes security assessment — image vulnerability scanning, SBOM diff analysis, K8s cluster auditing, RBAC privilege mapping, NetworkPolicy review, container escape testing, and…

hardw00t/ai-security-arsenal

A skill your agent uses when reviewing AICR's Markdown documentation for duplication, drift, bloat, and gaps — to keep docs high-value as the project evolves.

NVIDIA/aicr

Repository maintenance for devantler-tech/ksail — triage, bug fixes, CI/workflow health & CI-failure/flaky investigation, docs upkeep, driving every open PR (external contributions included) to a…

devantler-tech/ksail

Run focused ServiceRadar Elixir database tests against a scratch database on the Kubernetes CNPG instance in the srql-fixtures namespace.

carverauto/serviceradar

Policy-as-code enforcement and compliance validation using Open Policy Agent (OPA).

AgentSecOps/SecOpsAgentKit

Autonomous DevSecOps & FinOps Guardrails. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Operate GPU-backed Kubernetes clusters for AI inference and training with scheduling, autoscaling, node health, MIG partitioning, and cost controls.

sickn33/agentic-awesome-skills

Add, configure, or modify GitOps addons on the PEEKS platform.

aws-samples/appmod-blueprints

A skill your agent uses for VSS live metrics, OpenTelemetry traces, pipeline bottlenecks, and metrics-panel troubleshooting.

open-edge-platform/edge-ai-libraries

Use aai-cli to inspect and manage Bitbucket repositories, pull requests, branches, commits, source files, comments, and pipelines.

aai-labs/agent-barn

Detects container escape at runtime across tooling - namespace manipulation, capability abuse, kernel exploits, sensitive host mounts, and anomalous syscalls - and explains which signals matter…

mukul975/Anthropic-Cybersecurity-Skills

Writes and tunes Falco rule syntax for container escape detection - conditions, macros, lists, priorities, and output fields - covering host filesystem mounts, sensitive host path access, kernel…

mukul975/Anthropic-Cybersecurity-Skills

Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring (Falco), and audit log analysis of security contexts, Linux…

mukul975/Anthropic-Cybersecurity-Skills

Signs and verifies container image provenance with Sigstore Cosign, covering key-based and keyless OIDC signing (Fulcio, Rekor transparency log), SLSA attestations, and enforcing signature…

mukul975/Anthropic-Cybersecurity-Skills

Implements automated security scanning for Infrastructure as Code using Checkov, tfsec, and KICS to detect misconfigurations in Terraform, CloudFormation, Kubernetes manifests, and Helm charts, plus…

mukul975/Anthropic-Cybersecurity-Skills

Installs Calico as the cluster CNI and writes standard Kubernetes NetworkPolicy under it, covering default-deny baselines, policy ordering and precedence, service-account-based selectors, and…

mukul975/Anthropic-Cybersecurity-Skills

Chooses and applies the correct Kubernetes Pod Security Standard (Privileged, Baseline, Restricted) for a workload: what each profile forbids, how to map existing workloads to a profile, which…

mukul975/Anthropic-Cybersecurity-Skills

Writes portable upstream Kubernetes NetworkPolicy YAML - default-deny-all, DNS egress, namespace and pod selector rules - that works on any conformant CNI such as Calico or Cilium.

mukul975/Anthropic-Cybersecurity-Skills

Deploys OPA Gatekeeper via Helm as a Kubernetes admission controller and writes ConstraintTemplates with Rego plus instantiated Constraints to validate, mutate, or deny resource requests at…

mukul975/Anthropic-Cybersecurity-Skills

Configures and operates the Kubernetes Pod Security Admission (PSA) controller that enforces Pod Security Standards: namespace enforce/audit/warn labels, cluster-wide defaults via…

mukul975/Anthropic-Cybersecurity-Skills

Implements policy-as-code enforcement with Open Policy Agent (OPA) and Gatekeeper for Kubernetes and CI/CD pipelines, covering writing Rego policies, deploying OPA Gatekeeper as a Kubernetes…

mukul975/Anthropic-Cybersecurity-Skills

Hardens Kubernetes RBAC by designing least-privilege Roles and ClusterRoles, auditing RoleBindings, eliminating cluster-admin sprawl, separating service accounts, and integrating an external OIDC…

mukul975/Anthropic-Cybersecurity-Skills

Implements eBPF-based runtime observability and in-kernel enforcement in Kubernetes with Cilium Tetragon, monitoring process execution, file access, network connections, and syscalls, and blocking…

mukul975/Anthropic-Cybersecurity-Skills

Turns kube-bench output into a finished CIS Kubernetes Benchmark audit: interpreting PASS/FAIL/WARN per control, judging which failures are genuine on a managed cluster, writing remediation, and…

mukul975/Anthropic-Cybersecurity-Skills

Assesses the security posture of the etcd cluster backing Kubernetes: encryption at rest, TLS peer and client transport, access control, backup encryption, and network isolation.

mukul975/Anthropic-Cybersecurity-Skills

Evaluates Kubernetes cluster security by actively simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policy, and secrets, using kube-hunter, Kubescape…

mukul975/Anthropic-Cybersecurity-Skills

Scores Kubernetes resource manifests with Kubesec to flag misconfiguration and privilege-escalation risk before deployment, mapping each finding back to the securityContext change that fixes it.

mukul975/Anthropic-Cybersecurity-Skills

Run a live EKS cluster cost efficiency assessment — analyze spending across 6 dimensions (compute efficiency, Spot/Graviton adoption, networking, storage, observability, idle resources), calculate a…

aws-samples/appmod-blueprints

Reference knowledge for installing, uninstalling, or creating-and-installing Dynatrace OneAgent across VM/server, Kubernetes (Operator + DynaKube), AWS Lambda (layer + env vars, plus optional fresh…

Dynatrace/dynatrace-for-ai

A skill your agent uses when building a Kubernetes Operator — custom controllers that reconcile CRD state.

alirezarezvani/claude-skills

Security review of Infrastructure-as-Code (Terraform, Kubernetes, CloudFormation).

OWASP/secure-agent-playbook

Harden Docker/container images and runtime deployments with secure base images, non-root users, CVE scanning, SBOM/signing, seccomp/AppArmor, and Kubernetes pod security controls.

sickn33/agentic-awesome-skills

Deploy, scale, and manage Kubernetes workloads. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Infrastructure alert triage — dedup via YT search, deep PVE/K8s investigation, auto-escalation for recurring/flapping alerts, control plane deep dive for K8s controller nodes.

papadopouloskyriakos/agentic-chatops

Infrastructure-as-Code security scanning router for Terraform, CloudFormation, Kubernetes manifests, Helm, ARM/Bicep.

hardw00t/ai-security-arsenal

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules…

mukul975/Anthropic-Cybersecurity-Skills

Finds over-permissive RBAC roles and service-account token abuse paths in a Kubernetes cluster using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess, tracing which subjects can…

mukul975/Anthropic-Cybersecurity-Skills

Installs and runs the kube-bench tool against a Kubernetes cluster as a Job, DaemonSet, or standalone binary, selecting the correct benchmark version and targets (control plane, etcd, kubelet…

mukul975/Anthropic-Cybersecurity-Skills

Implements eBPF-based security monitoring using Cilium Tetragon for real-time process execution tracking, network connection observability, file access auditing, and runtime enforcement.

mukul975/Anthropic-Cybersecurity-Skills

Deploy HashiCorp Vault for centralized secrets management, covering dynamic secret generation for databases and cloud providers, transit encryption, PKI certificate management, and Kubernetes…

mukul975/Anthropic-Cybersecurity-Skills

Uses Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalation.

mukul975/Anthropic-Cybersecurity-Skills

Audits container and pod configuration for escape-enabling misconfiguration using the Kubernetes Python client - privileged flags, dangerous capability grants, host path mounts, shared namespaces…

mukul975/Anthropic-Cybersecurity-Skills

Hardens managed Kubernetes clusters on EKS, AKS, and GKE by implementing Pod Security Standards, network policies, workload identity (IRSA for EKS, Workload Identity for GKE, Managed Identities for…

mukul975/Anthropic-Cybersecurity-Skills

Set up or reconfigure Bionic's local k3d Kubernetes environment.

bionic-gpt/bionic-gpt