Cloud & DevOps Workflows

Designs and debugs ArgoCD ApplicationSets, picks generators, templates per-tenant deploys, configures sync waves and hooks, and untangles syncPolicy.automated prune/selfHeal. Use when working with ArgoCD, ApplicationSet, sync wave, GitOps, or per-tenant Application deploys.

Authors and debugs AWS CodePipeline + CodeBuild workflows — pipeline v1 vs v2 (triggers, variables), source providers via CodeStar Connections, artifact handoff, buildspec.yml authoring, IAM service roles, ECR pull permissions, VPC build environments, S3/local caching strategies, Lambda invoke action callback pattern, and manual approval setup. Use when working with AWS CodePipeline, AWS CodeBuild, buildspec.yml, CodeStar Connections, pipeline service roles, build VPC config, or "CodeBuild can't pull image" / "Lambda action hangs" debugging.

Diagnoses AWS cost spikes and audits accounts for ongoing waste. Cost Explorer + Cost & Usage Report query patterns, anomaly detection, the cost-trap inventory (forever log groups, NAT egress, unattached EBS/EIPs, idle ELBs, incomplete S3 multipart uploads, gp2/gp3 migration), commitment decision rules (Compute SP vs EC2 Instance SP vs RI), and the cost-allocation-tag activation trap. Use when working with AWS billing, "bill is up", aws ce, Cost Explorer, Cost and Usage Report, Savings Plans, Reserved Instances, NAT vs VPC endpoint trade-offs, or AWS cost optimization.

Identifies which object-storage provider an S3-compatible target actually hits, from endpoint URLs, env vars, or Terraform provider blocks. Prevents AWS-default assumptions on GCS/DO Spaces/R2/Hetzner/B2/MinIO. Use when working with boto3, awss3bucket, rclone, s3cmd, or S3-compatible storage.

Adds OAuth/SSO to a remote MCP server using Cloudflare. Three paths — AI Controls MCP Portal (REST, fastest), self-hosted Access app with Managed OAuth (REST), and the same as Terraform (when IaC already exists) — with a decision matrix, REST recipes per path, Terraform templates for the IaC path, and a stdlib validator that lints a terraform show -json plan. Use when the user asks to put an MCP server behind Cloudflare, add OAuth/SSO to a remote MCP server, expose a private MCP server via Cloudflare Tunnel, register MCP servers with the AI Controls portal, enable Managed OAuth or DCR on an Access app, or wire Claude Desktop / claude.ai web / Claude Code to an internal MCP server.

Operates Cloudflare's new unified cf CLI (technical preview, April 2026) — install path, flag conventions, the local-vs-remote default trap, coexistence with Wrangler and wrangler.jsonc, and agent-mode usage via the Local Explorer OpenAPI. Use when the user mentions cf, npx cf, "the new Cloudflare CLI", or is choosing between cf / wrangler / REST / Terraform.

Operates Cloudflare DNS zones and records via the REST API (curl + jq) — token scoping, zone discovery, record CRUD, batch operations, BIND import/export, proxied vs DNS-only decisions, CNAME flattening at apex, DNSSEC, and DNS-01 ACME challenge wiring with cert-manager. Use when working with Cloudflare DNS, api.cloudflare.com, CFAPITOKEN, zone records, DNS-01 challenges, mail records (MX/SPF/DKIM/DMARC), or "orange cloud / grey cloud" proxy decisions.

Lints DigitalOcean App Platform app specs (app.yaml / doctl apps spec JSON / digitaloceanapp Terraform) for security, reliability, correctness, and sizing anti-patterns — plaintext secrets, missing health checks, single-instance services, dev databases in production, port mismatches, overlapping ingress routes, conflicting git/image sources, deprecated routes, unknown instance sizes, and app/database region mismatch. Use when working with DigitalOcean App Platform, app.yaml, .do/app.yaml, doctl apps, the digitaloceanapp Terraform resource, or reviewing an App Platform deployment for problems.

Operates DigitalOcean DNS zones and records via doctl, the DigitalOcean API v2, and the digitalocean Terraform provider — domain/record CRUD, the apex CNAME / no-flattening trap when migrating from Cloudflare, account-wide token handling, FQDN trailing-dot semantics, DNS-01 ACME wildcard certs, and nameserver delegation. Use when working with DigitalOcean DNS, doctl compute domain, DIGITALOCEANACCESSTOKEN, api.digitalocean.com domains, digitaloceanrecord/digitaloceandomain Terraform, apex CNAME questions, wildcard cert DNS-01, or moving a zone between Cloudflare and DigitalOcean.

Analyze and clean DigitalOcean Container Registry images. Lists repos with tag counts, deletes old tags (keep last N), finds stale repos, triggers garbage collection. Supports dry-run mode. Use when user says "clean registry", "delete old images", "DO registry", "registry cleanup", "docker images cleanup", "container registry", or "clean up old tags".

Create and open draw.io diagrams. Use when the user wants to generate, edit, or open a diagram in draw.io (architecture/HLA diagrams, infra & Kubernetes topology, flowcharts, network diagrams) — covers the draw.io MCP servers (opendrawioxml/mermaid/csv) and native .drawio file generation.

Debugs and authors GitHub Actions workflows — OIDC federation to AWS/GCP/Azure, GITHUBTOKEN permissions hardening, reusable workflows vs composite actions, deploy concurrency, caching, the path-filter/required-check trap, and pullrequesttarget security. Use when working with GitHub Actions, .github/workflows/, OIDC to cloud providers, pullrequesttarget, branch protection required checks, reusable workflows, or CI/CD pipelines that deploy to AWS/GCP/DigitalOcean.

Designs and audits Kubernetes Operators — CRD shape, reconcile-loop correctness, finalizer and status-subresource handling, OperatorHub capability levels, framework choice. Use when building a controller for a CRD, reviewing an operator for capability gaps, or designing the API surface of a Custom Resource. Not for general pod debugging — see kubernetes-operations.

Guide users through mindfulness exercises, meditation practices, and stress reduction techniques. Use when users ask for help with relaxation, stress management, breathing exercises, or cultivating inner peace.

Injects and audits 1Password secrets via the op CLI using op:// references, prefers op run/op inject over op read so values stay out of context, gates every op call behind an always-ask permission rule, and ships an opt-in deny-capable audit hook. Use when handling API keys, tokens, passwords, credentials, .env secrets, OPSERVICEACCOUNTTOKEN, or when the user mentions 1Password or the op CLI.

Installs skills from a user-curated manifest (~/.claude/skill-manifest.json) into the current project's .claude/skills/ — symlinks local skills, runs npx skills add for third-party ones, and advises /plugin install for native Claude plugins. Optionally scans the project for trigger files (Dockerfile, wrangler.jsonc, .tf, etc.) and pre-selects recommended matches. Use when the user wants to set up skills in a new project, add a skill they curated, see what skills fit the current project, or bootstrap a freshly cloned repo with their toolbox.

Reviews Terraform/OpenTofu plans, detects drift, performs state surgery (mv/rm/import), upgrades providers, and traces Terragrunt cache errors. Multi-cloud. Use when working with Terraform, OpenTofu, Terragrunt, terraform plan, drift, or provider upgrades.

Terragrunt-specific orchestration patterns — CLI redesign migration (run/run --all, --terragrunt- flag removal, TG env vars, strict controls), config composition (include, locals, inputs deep-merge, generate blocks), dependency wiring (mockoutputs semantics), run --all safety, hooks, and the new terragrunt.stack.hcl. Use when working with Terragrunt, terragrunt.hcl, terragrunt.stack.hcl, the deprecated run-all, --terragrunt- flags, TERRAGRUNT env vars, include blocks, dependency blocks, or terragrunt run --all.