--- name: cluster-agent-swarm description: > Complete Platform Agent Swarm — A coordinated multi-agent system for Kubernetes and OpenShift platform operations. Includes Orchestrator (Jarvis), Cluster Ops (Atlas), GitOps (Flow), Security (Shield), Observability (Pulse), Artifacts (Cache), and Developer Experience (Desk). metadata: author: cluster-agent-swarm version: 1.0.1 agent_name: Swarm agent_role: Platform Agent Swarm (All Agents) session_key: "agent:platform:swarm" heartbeat: "/5 *" platforms: - openshift - kubernetes - eks - aks - gke - rosa - aro install_source: "https://github.com/kcns008/cluster-agent-swarm-skills" install_type: "scripted" always: false model_invocation: true requires: env: - KUBECONFIG binaries: - kubectl - oc - helm - kustomize - jq - curl - git credentials: - kubeconfig: "Cluster access (KUBECONFIG env var or ~/.kube/config)" - cloud_credentials: "Optional - only if using specific cloud provider (AWS/Azure/GCP)" - service_tokens: "Optional - for integrations (ArgoCD, Vault, GitHub)" conditions: | ### Credential Requirements

Minimum required: - KUBECONFIG - Access to target Kubernetes/OpenShift cluster

Optional - only enable what you need: - AWS credentials: Only if managing EKS or ROSA clusters - Azure credentials: Only if managing AKS or ARO clusters - GCP credentials: Only if managing GKE clusters - ArgoCD token: Only if using GitOps agent - Vault token: Only if using secrets management - GitHub token: Only if pushing changes to repositories

Principle: Only grant the minimum credentials required for your specific use case. ---

Cluster Agent Swarm — Complete Platform Operations

Runtime Requirements

This skill package provides Kubernetes/OpenShift cluster management capabilities. Credentials are modular - only configure what you need for your specific use case.

Always Required

| Requirement | Description | Environment Variable | |-------------|-------------|---------------------| | Kubeconfig | Valid kubeconfig with cluster access | KUBECONFIG or ~/.kube/config | | kubectl | Kubernetes CLI | Must be in PATH |

Conditional - Enable Only As Needed

| Platform | Enable If... | Credentials | |----------|--------------|-------------| | AWS/EKS/ROSA | Managing AWS-hosted Kubernetes | AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY | | Azure/ARO | Managing Azure-hosted Kubernetes | AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID | | GCP/GKE | Managing GCP-hosted Kubernetes | GOOGLE_APPLICATION_CREDENTIALS | | ArgoCD | Using GitOps agent | ARGOCD_AUTH_TOKEN, ARGOCD_SERVER | | Vault | Using secrets management | VAULT_TOKEN | | GitHub | Pushing to git repositories | GITHUB_TOKEN |

Session Setup

Before using the agents, you MUST set up a session context:

# Set up session context for your environment
bash skills/orchestrator/scripts/setup-session.sh <environment> [context-name]

# Environments: dev, qa, staging, prod
# Note: prod requires human approval for all modifications

Security Considerations

• Agents operate with least privilege by default
• All credential access is logged
• Production modifications require human approval
• Secrets are never logged or stored in code

---

Security Assessment - Read Before Installing

Source Verification

• This skill pulls code from a third-party GitHub repository
• Verify the source URL before installing: https://github.com/kcns008/cluster-agent-swarm-skills
• Pin to a specific version - never use main branch in production:

```bash git clone https://github.com/kcns008/cluster-agent-swarm-skills.git cd cluster-agent-swarm-skills git fetch --tags git checkout v1.0.0 # Use verified release tag or commit hash ```

Third-Party Script Execution Warning

• This is a scripted skill - it will write executable bash scripts to disk
• Scripts perform cluster operations including: deployments, scaling, scanning, configuration
• Some scripts can be destructive - review before running:

- Scripts with -delete, -cleanup in name may remove resources - Scripts with -promote, -deploy modify cluster state

• Always test in non-production first

Install Mechanism

• Installing via npx skills add downloads and executes code from GitHub
• The skill cannot verify integrity of external scripts
• Audit all scripts locally before running in production
• Consider maintaining a verified, offline copy of trusted scripts
• ALWAYS PIN TO VERIFIED COMMIT HASH for production - NEVER use floating URLs like tree/main or untagged branches
• Use manual git clone with verified checkout for highest security

Persistence & Blast Radius

• Agents maintain persistent state across sessions via:

- WORKING.md - session progress tracking - LOGS.md - action audit trail - MEMORY.md - long-term learnings

• Agents are configured to commit changes to these files as part of normal operation
• This persistence increases blast radius if misused - limit repository write access if concerned

Human Approval Enforcement

• The skill documentation claims human approval required for production changes
• This is a procedural control, NOT a technical enforcement
• Your platform MUST enforce an approval gate before allowing production operations
• Do not rely on agent self-restriction for production safety

Principle of Least Privilege - Required

• DO NOT provide owner/root-level cloud credentials
• Create dedicated, minimal-permission service accounts for:

- Kubernetes namespace-level access (not cluster-admin) - AWS IAM roles with limited EKS permissions - Azure service principals with limited subscription access - GCP service accounts with limited project permissions

• Never provide production credentials until you have audited the code in non-production

Sandbox Before Production

1. Run this skill in an isolated/non-production environment first
2. Manually step through scripts to understand their behavior
3. Pay special attention to:

- *-cleanup.sh scripts - may delete resources - *-promote.sh scripts - may promote artifacts - *-delete.sh scripts - explicitly destructive

1. Verify no unexpected network calls to external endpoints

Supply Chain Tools

• Scripts may download binaries (syft, cosign, trivy, etc.)
• Only allow downloads from trusted release sources (official GitHub releases, package managers)
• Consider curating offline toolchains if your environment requires it

Additional Documentation

• OPERATIONAL_RISKS.md - Complete documentation of operational risks, inconsistencies, and mitigations
• SECURITY.md - Security policy, external dependencies, and verification requirements

---

This is the complete cluster-agent-swarm skill package. When you add this skill, you get access to ALL 7 specialized agents working together as a coordinated swarm.

Installation

Security Warning - Read Before Installing

> ⚠️ CRITICAL SECURITY WARNING > > The installation commands below use GitHub URLs that fetch and execute code on your system. > This is a supply chain risk - you must verify the repository and commit before use. > > For production deployments: > 1. ALWAYS pin to a specific, verified commit hash > 2. Review the commit: git show > 3. Verify GPG signatures if available: git verify-commit > 4. Use the manual clone method below for highest security > > NEVER use floating URLs (tree/main, main branch) in production.

Install All Skills (Development Only)

> ⚠️ NOT FOR PRODUCTION: Uses floating URL without commit pinning.

...