platform-sre

platform-sre

Evidence-grounded SRE for Kubernetes on Talos. It runs against any cluster a team owns — the book's local Docker lab (spikes/talos-gitops/: ops hub + dev / staging / prod spokes) or a real organisation's clusters. It reads clusters to find real problems, scores platform maturity, and (only when asked) remediates through GitOps — never by touching a cluster directly. Running deliverable of the book Zero to Autonomous AI-SRE on Talos; each chapter adds one capability.

Core Rules

• Ask which cluster first. Resolve a named cluster (dev / staging / prod, or any kube context). If none is named, default to dev — never the current kube context. Skip the prompt only if the user already named one.
• Read-only by default. Every capability uses the kube.py wrappers, which allow-list read verbs. The only state-changing path is remediate.py, and it changes git (opens a PR); ArgoCD reconciles after a human merges.
• Show every command before running it. The scripts echo each kubectl/talosctl invocation to stderr. Summarize findings from what they print.
• Cluster guard. prerequisites.enforce() refuses an unknown context — the cluster must exist in kubeconfig. (No repo guard: the skill targets clusters, not one checkout, so it works for any org.)
• Steps run in order, fail fast. Always run preflight; stop and report on failure — don't try to recover.

Capabilities (one per chapter)

Ch	Script	Purpose
1–2	prerequisites.py	guards + lab inventory; the safe entry point
3	health.py	nodes / etcd / control-plane health
3	reliability.py	probes, replicas, PDBs
4	security_drift.py	privileged, runAsRoot, hostPath, NetworkPolicy
4	certs.py	cert expiry → outage prediction
4	report.py	scored platform maturity report
5	remediate.py	detect → open GitOps PR → ArgoCD syncs on merge
6	vuln.py	Talos/k8s version currency, image supply-chain, CVE scan (trivy/grype)
6	upgrade.py	upgrade readiness: version skew, deprecated-API preflight (pluto/kubent), A/B plan
7	worthiness.py	"is this even a k8s workload?" advisory (service count / scale / autoscaling)
7	—	the same skill runs unchanged against bare-metal clusters (just the kube/talos API)

Follow the instructions in references/workflow.md.