OverviewHistoryStatsSecurity
npx skills add ...
Documentation
SKILL.md
npx skills add yonatangross/orchestkit --skill devops-deployment
Use when setting up CI/CD pipelines, containerizing applications, deploying to Kubernetes, or writing infrastructure as code. DevOps & Deployment covers GitHub Actions, Docker, Helm, and Terraform patterns.
npx skills add yonatangross/orchestkit --skill devops-deployment
Comprehensive frameworks for CI/CD pipelines, containerization, deployment strategies, and infrastructure automation.
Note: If
disableSkillShellExecutionis enabled (CC 2.1.91), the Docker install check won't run. Verify Docker is available for container operations:docker --version.
Multi-stage builds minimize image size:
Security hardening:
Essential manifests:
Security context:
runAsNonRoot: trueallowPrivilegeEscalation: falsereadOnlyRootFilesystem: true| Strategy | Use Case | Risk |
|---|---|---|
| Rolling | Default, gradual replacement | Low - automatic rollback |
| Blue-Green | Instant switch, easy rollback | Medium - double resources |
| Canary | Progressive traffic shift | Low - gradual exposure |
Rolling Update (Kubernetes default):
Use External Secrets Operator to sync from cloud providers:
Load: Read("references/docker-patterns.md")
Key topics covered:
Load: Read("references/ork-delta.md")
Key topics covered:
Load: Read("rules/railway-deployment.md")
Key topics covered:
references/railway-json-config.md, references/nixpacks-customization.md, references/multi-service-setup.mdLoad: Read("references/deployment-strategies.md")
Key topics covered:
maxUnavailable / maxSurge)This skill wraps third-party products. Vendor mechanics are not restated here; fetch them from the source below. Where a row says "house subset stays in X", that file keeps only OrchestKit's threshold, config or ordering decision, not the vendor tutorial.
| Topic | Fetch from |
|---|---|
| GitHub Actions workflow syntax, matrix builds, artifact upload/download, cache mechanics | https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax (house cache-key subset stays in rules/devops-ci-caching.md) |
Trigger filters (on.push.paths, schedules, workflow_dispatch) | https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow |
| Service containers for integration tests | https://docs.github.com/en/actions/tutorials/use-containerized-services/use-docker-service-containers |
| Deployment environments and approval gates | https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments |
| Protected branches and required status checks | https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches (house approval counts stay in rules/devops-branch-protection.md) |
| Kubernetes probe semantics and every probe field | https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ (house probe numbers stay in references/ork-delta.md) |
| Requests, limits, quotas and QoS classes | https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ (house baseline stays in references/ork-delta.md) |
| PodDisruptionBudget semantics and eviction API | https://kubernetes.io/docs/tasks/run-application/configure-pdb/ (house minAvailable floor stays in references/ork-delta.md) |
| StatefulSets, ordinal identity, volumeClaimTemplates | https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/ |
| Helm chart authoring, templating and values files | https://helm.sh/docs/topics/charts/ (the chart directory layout we use stays in references/checklists-and-templates.md) |
| External Secrets Operator CRD fields and backends | https://external-secrets.io/latest/api/externalsecret/ (house refresh/creation policy stays in references/ork-delta.md) |
| ArgoCD automated sync, prune and self-heal | https://argo-cd.readthedocs.io/en/stable/user-guide/auto_sync/ (house retry/backoff stays in references/ork-delta.md) |
| Terraform S3 backend and state locking | https://developer.hashicorp.com/terraform/language/backend/s3 (house backend config stays in references/ork-delta.md) |
| Terraform module composition and variable files | https://developer.hashicorp.com/terraform/language/modules |
| Alembic revision, upgrade and downgrade CLI | https://alembic.sqlalchemy.org/en/latest/tutorial.html (the zero-downtime migration ordering stays in rules/devops-db-migrations.md) |
| Prometheus client instrumentation (Counter, Histogram, exposition) | https://prometheus.github.io/client_python/ |
PromQL functions (rate, histogram_quantile) for dashboards | https://prometheus.io/docs/prometheus/latest/querying/functions/ |
| Prometheus alerting rule syntax | https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/ (house thresholds and dwell windows stay in references/ork-delta.md) |
| OpenTelemetry FastAPI auto-instrumentation and manual spans | https://opentelemetry-python-contrib.readthedocs.io/en/latest/instrumentation/fastapi/fastapi.html |
| structlog context binding | https://www.structlog.org/en/stable/contextvars.html (the bind-then-call ordering stays in references/ork-delta.md) |
| Trivy severity filtering and scan configuration | https://trivy.dev/latest/docs/configuration/filtering/ (the house image-scan CI wiring stays in references/docker-patterns.md, the weekly-scan schedule and severity floor in references/ork-delta.md) |
| CloudFront invalidation semantics and cost | https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Invalidation.html (the sync-then-invalidate order stays in references/ork-delta.md) |
| Pre-launch security, load-testing and monitoring checklists | ork:security-patterns, ork:testing-perf, ork:monitoring-observability (the deploy-day checklist stays in references/checklists-and-templates.md) |
Load: Read("references/checklists-and-templates.md") for pre/during/post-deployment checklists, Helm chart structure, template reference table, and extended thinking triggers.
ork:security-patterns - Security scanning and hardening patterns for CI/CD pipelinesork:monitoring-observability - Prometheus, Grafana and alerting for deployed applicationsork:database-patterns - Python/Alembic migration workflow for backend deploymentsportless (upstream) - Named .localhost URLs for multi-service local dev (portless alias api 8080)| Decision | Choice | Rationale |
|---|---|---|
| Container user | Non-root (uid 1001) | Security best practice, required by many orchestrators |
| Deployment strategy | Rolling update (default) | Zero downtime, automatic rollback, resource efficient |
| Secrets management | External Secrets Operator | Syncs from cloud providers, GitOps compatible |
| Health checks | Separate startup/liveness/readiness | Prevents premature traffic, enables graceful shutdown |
Load: Read("references/capability-details.md") for full keyword index and problem-solution mapping across all 6 capabilities (ci-cd, docker, kubernetes, infrastructure-as-code, deployment-strategies, observability).