Skip to content
Documentation

platform

FieldValue
TypeSkill
Source~/.copilot/skills/platform/SKILL.md
DescriptionFront door for platform and infrastructure — Helm charts (CRDs out-of-band, Artifact Hub lookup, bjw-s app-template default), raw K8s manifests and custom operators (Kubebuilder/Metacontroller/Crossplane), DevOps (CI/CD, Terraform, Dockerfiles, rollouts), GitHub Actions (reusable workflows, OIDC, signing/scanning), observability (SLOs, burn-rate alerts, dashboards, OTel), and incident command (live response, blameless postmortems, on-call). Absorbs helm, kubernetes-operator, senior-devops, github-actions-architect, observability-designer, incident-commander. Triggers: “helm chart”, “CRDs”, “kubectl apply”, “kubernetes operator”, “CRD”, “kubebuilder”, “dockerfile”, “containerize”, “terraform module”, “ci/cd pipeline”, “github actions workflow”, “OIDC”, “canary”, “blue/green”, “SLO”, “SLI”, “error budget”, “dashboard”, “alerting”, “observability”, “postmortem”, “PIR”, “incident”, “on-call”, “production down”, “SEV1”. NOT app code (frontend/backend), Postgres tuning (database), security review (security).

Bundled Pages

GroupNameSource
ReferencesGeneral DevOps: Pipelines, Containers, IaC, Rollouts~/.copilot/skills/platform/references/devops.md
ReferencesGitHub Actions: Org-Wide CI/CD~/.copilot/skills/platform/references/github-actions.md
ReferencesIncident Command: Live Response and Postmortems~/.copilot/skills/platform/references/incident-command.md
ReferencesKubernetes Operators: CRD + Controller~/.copilot/skills/platform/references/kubernetes-operator.md
ReferencesObservability: SLOs, Alerts, Dashboards~/.copilot/skills/platform/references/observability.md
References HelmCRD Ordering: kubectl First, Helm Second~/.copilot/skills/platform/references/helm/crd-ordering.md
References HelmThe bjw-s app-template Chart~/.copilot/skills/platform/references/helm/app-template.md
References HelmThird-Party Charts: Artifact Hub First~/.copilot/skills/platform/references/helm/third-party-charts.md
References HelmValidate and Ship~/.copilot/skills/platform/references/helm/validate.md
ResourcesLints~/.copilot/skills/platform/lints.toml
Scripts_lint_slo_doc~/.copilot/skills/platform/scripts/_lint_slo_doc.py
ScriptsAlert_optimizer~/.copilot/skills/platform/scripts/alert_optimizer.py
ScriptsCheck_manifests~/.copilot/skills/platform/scripts/check_manifests.sh
ScriptsCheck_pir~/.copilot/skills/platform/scripts/check_pir.sh
ScriptsDashboard_generator~/.copilot/skills/platform/scripts/dashboard_generator.py
ScriptsLint~/.copilot/skills/platform/scripts/lint.py
ScriptsLint_chart~/.copilot/skills/platform/scripts/lint_chart.sh
ScriptsLint_slo_doc~/.copilot/skills/platform/scripts/lint_slo_doc.sh
ScriptsLint_workflows~/.copilot/skills/platform/scripts/lint_workflows.sh
ScriptsSlo_designer~/.copilot/skills/platform/scripts/slo_designer.py
TemplatesApp Template Values~/.copilot/skills/platform/templates/app-template-values.yaml

Source Content

Platform

DomainKubernetes, Helm, CI/CD, IaC, observability, incident response
RolePlatform engineer, SRE, and incident commander in one front door
OutputCharts, manifests, pipelines, SLO docs, dashboards, PIRs — each gated by its own script

This skill absorbed helm, kubernetes-operator, senior-devops, github-actions-architect, observability-designer, and incident-commander. Their rules live in this skill’s own references; nothing invokes them separately.

Route by task

You’re…ReadGate with
Writing or configuring a Helm chartreferences/helm/ (crd-ordering, third-party-charts, app-template, validate)scripts/lint_chart.sh
Writing raw K8s manifests or a custom operator/controllerreferences/kubernetes-operator.mdscripts/check_manifests.sh
Setting up CI/CD, Terraform, Dockerfiles, or a rollout strategyreferences/devops.md-
Building or hardening GitHub Actions workflowsreferences/github-actions.mdscripts/lint_workflows.sh
Designing SLOs, alerts, or dashboardsreferences/observability.mdscripts/lint_slo_doc.sh
Running a live incident or writing a postmortemreferences/incident-command.mdscripts/check_pir.sh
Picking a single-service chart defaultreferences/helm/app-template.md-
Deciding CRD install orderreferences/helm/crd-ordering.md-

References load lazily — a one-line Dockerfile fix never pays for the SLO cookbook. Each script under scripts/ is a standalone validator for its own artifact type; there is no single universal check.sh because a Helm chart, a GitHub workflow, and a PIR doc have nothing in common to dispatch on — use the routing table above to find the right one.

House rules (non-negotiable)

  1. CRDs are never Helm-managed. Apply CRDs as a separate kubectl apply step, before any Helm install/upgrade that depends on them. Every chart that ships CRDs gets its opt-out flag set (installCRDs: false, crds.enabled: false, or equivalent) plus --skip-crds as a backstop. See references/helm/crd-ordering.md.
  2. Single services default to the bjw-s app-template chart, not a hand-rolled Deployment/Service/Ingress. Hand-roll only when the workload genuinely can’t be expressed that way, and say why. See references/helm/app-template.md and templates/app-template-values.yaml.
  3. Check Artifact Hub before configuring any third-party chart. Never guess a values key, a version, or the CRD opt-out. See references/helm/third-party-charts.md.
  4. No :latest, ever. Pin chart versions, image tags, and ArgoCD targetRevision to an exact value everywhere.
  5. Secrets never land in a values file, a manifest, or a workflow as plaintext. They come from 1Password Connect / external-secrets / OIDC federation — a committed secret is an incident, not a lint warning.
  6. Actions are pinned to a full commit SHA, never @main or a floating @v* from an untrusted publisher. OIDC replaces long-lived AWS_*/GCP_* cloud secrets wherever the provider supports it.
  7. Alerts page only on user-visible symptoms, tied to an SLO’s burn rate — never a raw resource threshold — and every alert carries a runbook link and a dashboard/panel reference.
  8. Incidents get roles before they get root-cause hunting. IC, Comms, Scribe, SME are pinned and separate from whoever is debugging; mitigation comes before root cause.
  9. Postmortems are blameless and dated. Every PIR names a real Incident Commander, keeps a timestamped decision log, and ships at least one action item with an owner and a due date — language targets the system, never a person.

Don’t use me for

  • Application/frontend/backend code → the frontend / backend skills.
  • Postgres schema design or query tuning → the database skill.
  • Threat modeling, supply-chain hardening beyond signing/scanning, SIEM rules → the security skill.
  • ADR-level platform decisions (ADR-028 CRD ordering, ADR-029 multi-tenancy) → the adr skill, which this skill cites but does not own.
  • Prose (release notes, runbook narration for a customer) → the technical-writing skill.

How I work

  1. Classify the artifact. Chart? Raw manifest/operator? Pipeline/Terraform/Dockerfile? GitHub workflow? SLO/dashboard? Live incident or PIR? Pick one row from the routing table above.
  2. Load only that reference. Don’t pull in the whole references/ tree for a one-file fix.
  3. Apply the house rule that governs it — CRD ordering, app-template default, Artifact Hub lookup, pinned versions, no plaintext secrets, SHA-pinned actions, burn-rate alerting, blameless PIR structure.
  4. Validate with the matching script, standalone, from its new home under scripts/:
    • scripts/lint_chart.sh <chart-dir> [values-file ...]
    • scripts/check_manifests.sh <manifests-dir-or-file>
    • scripts/lint_workflows.sh [workflows-dir]
    • scripts/lint_slo_doc.sh [slo-doc.md|slo-doc.yaml]
    • scripts/check_pir.sh PIR.md
  5. Fix every ❌ to zero before calling the work done. Missing external tools (helm, kubeconform, actionlint, yamllint) degrade their half of a check to a ⚠️ warning rather than a hard failure — the house-rule checks that need no external tool still run.

When I’m unsure, I ask

  • “Does this chart ship CRDs? What’s its opt-out flag, and is the kubectl CRD task already in the Taskfile?”
  • “Is this a single service app-template can express, or does it genuinely need a hand-rolled chart / a custom operator?”
  • “Is this customer-impacting right now, or only internally visible? That sets incident severity.”
  • “What SLO target are we defending — 99%, 99.9%, 99.95%? Each implies a different alert design.”

Elicitation tool order: AskUserQuestion (Claude Code) → elicitation/create (MCP host) → #followup chips (VS Code Copilot) → a numbered Markdown fallback with explicit reply hints.

Self-rubric

  • Right reference loaded for the artifact type — not the whole tree.
  • CRDs out of band; app-template is the single-service default; Artifact Hub checked for any third-party chart.
  • No :latest; no plaintext secret in a values file, manifest, or workflow.
  • GitHub Actions pinned to a SHA; OIDC used over static cloud keys where supported.
  • Every alert ties to an SLO’s burn rate and carries a runbook + dashboard reference.
  • Any PIR is blameless, timestamped, and has an owner + due date on its action items.
  • The matching validator script exits 0 (or its failures are understood and accepted).

References

  • references/helm/crd-ordering.md — the CRD-then-Helm pattern and a paste-ready Taskfile.
  • references/helm/third-party-charts.md — the Artifact Hub lookup workflow and CRD opt-out keys for common charts.
  • references/helm/app-template.md — when to use bjw-s app-template, its values surface, install command.
  • references/helm/validate.md — helm lint, kubeconform, and the ArgoCD Application skeleton.
  • references/kubernetes-operator.md — Kubebuilder/Metacontroller/Crossplane, CRD design, reconcile/finalizer/webhook rules.
  • references/devops.md — pipelines, Terraform, containers, rollout strategy selection.
  • references/github-actions.md — reusable workflows, OIDC, caching/concurrency, signing/scanning, branch protection.
  • references/observability.md — SLIs/SLOs, error budgets, burn-rate alerting, dashboard pyramid, tracing/cardinality.
  • references/incident-command.md — live incident roles/cadence, blameless postmortems, on-call program design.
  • templates/app-template-values.yaml — a worked single-service bjw-s app-template values file.
  • scripts/lint_chart.sh — Helm chart validator (helm lint + kubeconform -strict + house-rule checks).
  • scripts/check_manifests.sh — raw-manifest validator (kubeconform, no :latest, resources: present).
  • scripts/lint_workflows.sh — GitHub Actions validator (actionlint + SHA-pinning + secret/ruleset checks).
  • scripts/lint_slo_doc.sh (+ scripts/_lint_slo_doc.py) — SLO-doc completeness validator.
  • scripts/check_pir.sh — postmortem/PIR validator.
  • scripts/alert_optimizer.py, scripts/slo_designer.py, scripts/dashboard_generator.py — generative helpers (not linters) for scaffolding a new service’s alerts, SLO framework, and dashboard spec.
  • ADR-028 (platform foundations) and ADR-029 (multi-tenancy) in the adr skill — the binding decisions behind the CRD and naming rules.
  • The go-task skill — owns the kubectl apply CRD Taskfile target this skill depends on.