DevOps & Security skills

Browse reusable Agent Skills, each with a clear purpose and practical guidance.

doca-urom-svc

SECURITY: the DOCA UROM Service binary has NO standalone access control (no authz list / `allowed_host` / `allowed_users` / `auth_token`) — access is governed ENTIRELY by DOCA Comch pairing + RDMA permissions, so any host able to establish a Comch pairing can drive remote memory ops; isolate accordingly. Use when operating the DOCA UROM Service container on a BlueField Arm to run remote memory ops (puts, gets, atomics, collectives) that paired hosts enqueue via the host-side `doca-urom` library — pulling the NGC container, choosing UCX-component surface, sizing the enqueue queue, wiring Comch endpoint pairing with `doca-urom`, or pinning host-library + service versions per the DOCA Compatibility Policy. Trigger even without 'DOCA UROM' — e.g. 'UCX collectives slow on host CPU, want BlueField offload', 'enqueue returns NOT_PERMITTED though doca_dev access is fine', 'ops enqueue but completions never fire'. Refuse for host-side app code, MPI/UCX integration, or installing DOCA.

2.52k repo starsObserved in 2 repos
DevOps & Security

doca-flow-grpc-server

PLAINTEXT-ONLY: the shipped `doca_flow_grpc` server uses `grpc::InsecureServerCredentials()` with NO TLS / mTLS / token-auth knob on the binary — transport security must come from external infrastructure (e.g. an mTLS proxy / sidecar) on a trusted segment. Use this skill when bringing up, configuring, hardening, or debugging `doca_flow_grpc` — the DOCA-shipped gRPC remote-control surface in front of `doca-flow` that lets non-C++ clients (Python, Go, Rust, Java) program Flow pipes and entries over RPC instead of linking `libdoca_flow.so` directly. Trigger even when the user doesn't say 'doca-flow-grpc-server' or 'gRPC' — e.g. 'program Flow rules from Python on another host', 'remotely configure pipes on the BlueField', 'client times out connecting to the Flow server', 'where is the .proto for Flow', 'UNAUTHENTICATED / FAILED_PRECONDITION on a Flow RPC'. Route elsewhere for the underlying doca-flow API, generic gRPC tooling (protoc, language bindings), or DOCA install / BFB bring-up.

2.52k repo starsObserved in 1 repos
DevOps & Security

agent-module-architecture

处理 BK-CI Agent 构建机侧能力时使用,例如守护进程、心跳、Ask 轮询、任务拉起、升级更新和与 Dispatch/Worker 的协作。当用户要改构建机宿主侧行为而不是 Worker 执行细节时优先使用。

2.51k repo starsObserved in 1 repos
DevOps & Security

artifactory-module-architecture

处理 BK-CI 制品上传下载、制品元数据、BkRepo 或磁盘后端存储、文件任务和清理链路时使用。当用户提到构建产物、制品归档、下载令牌、报告文件、BkRepo 集成或制品清理时优先使用。

2.51k repo starsObserved in 1 repos
DevOps & Security

dispatch-module-architecture

处理 BK-CI 构建调度时使用,例如构建机选择、队列推进、配额控制、第三方构建机调度、Docker/Kubernetes 调度。当用户要改任务分配策略而不是 Agent/Worker 执行细节时优先使用。

2.51k repo starsObserved in 1 repos
DevOps & Security

managing-devops-pipeline

通过 MCP 管理 BK-CI 流水线构建时使用,例如查询构建历史、获取启动参数、查看构建状态和在确认后触发构建。当用户要操作现有流水线而不是修改代码实现时优先使用。

2.51k repo starsObserved in 1 repos
DevOps & Security

microservice-infrastructure

处理 BK-CI 微服务底层基础设施时使用,例如条件配置、事件驱动、服务间通信、国际化与日志规范。当用户要搭多环境配置、异步事件、Feign 调用或统一 i18n/日志时优先使用。

2.51k repo starsObserved in 1 repos
DevOps & Security

permission-model-change-guide

修改 BK-CI IAM RBAC 权限模型时使用,例如新增资源类型、设计操作列表、配置 IAM 资源、补迁移数据和验证回调链路。当用户要变更权限模型而不是普通权限调用时优先使用。

2.51k repo starsObserved in 1 repos
DevOps & Security

pipeline-model-architecture

理解或修改 BK-CI 流水线 Model、Stage、Container、Element 结构时使用。当用户提到流水线模型、Stage/Job/Task 数据结构、模型扩展、模型校验、版本兼容、YAML 与 Model 转换时优先使用。

2.51k repo starsObserved in 1 repos
DevOps & Security

pipeline-template-module

处理 BK-CI 流水线模板的创建、版本管理、实例化、权限控制、PAC 模板和商店集成时使用。当用户提到模板复用、模板版本、批量实例化、模板迁移、商店模板或 PAC 模板时优先使用。

2.51k repo starsObserved in 1 repos
DevOps & Security