isolation-planner

Name: isolation-planner
Author: KnoxOps

38stars4forks

How to install isolation-planner?

knoxops/open-devops-skills/isolation-planner

$npx -y skills add KnoxOps/open-devops-skills --skill isolation-planner

Installs into the current project.

Summary

Generates human-executable isolation plans for zombie resources identified in Phase 1/2. Creates per-resource isolation strategies with pre-checklists, rollback procedures, and observation configurations, plus a global batch plan sorted by dependency safety. Never auto-executes i

Files · 1

View on GitHub

SKILL.md

1	## Input Parameters
2
3	\| Name \| Type \| Required \| Description \|
4	\|------\|------\|----------\|-------------\|
5	\| run_dir \| string \| Yes \| Workspace root directory for file passing between agents \|
6	\| ssh_key_path \| string \| No \| SSH key path for cloud provider access \|
7	\| environment \| string \| Yes \| Target environment for isolation method selection \|
8
9	## Execution Flow
10
11	### Task Context
12
13	Before starting execution, initialize `task_context.json`:
14
15	```json
16	{
17	"task_id": "<task_id from input>",
18	"current_step": 0,
19	"current_step_id": null,
20	"status": "running",
21	"steps": {
22	"phase3_plan_generation": "pending",
23	"phase3_batch_planning": "pending",
24	"phase3_review_gate": "pending"
25	},
26	"updated_at": "<ISO timestamp>"
27	}
28	```
29
30	Update this file after each step completes. On error, set step status to `"failed"` and overall `status` to `"failed"`.
31
32	### Step 1: phase3_plan_generation
33
34	Type: inline
35	Description: Read Phase 1/2 output and generate per-resource isolation plans
36
37	## Execution
38	Follow these instructions:
39
40	Read Phase 1/2 output files from {run_dir}/analysis/:
41	- suspect_assessment.json
42	- zombie_suspect_{resource_id}.json (per resource, from Phase 1 resource-screener)
43	- deep_scan_{resource_id}.json (per resource, from Phase 2 deep-scanner)
44
45	For each resource with suspect_level in {high, medium}:
46
47	1. Data Extraction:
48	- suspect_level, zombie_score, priority, owner_detail: from zombie_suspect_{resource_id}.json
49	- owner name, team: from deep_scan_{resource_id}.json `business.owner`
50	- related_resources (blast_radius / dependency graph): from deep_scan_{resource_id}.json `business.related_resources`
51
52	2. Method Selection: Use the isolation strategy matrix (by resource_type x environment)
53	to select the primary isolation method. If preconditions fail, use fallback.
54
55	Isolation Strategy Matrix:
56	- CloudVM: iptables DROP (all envs) \| Fallback: stop_instance
57	- CloudRDS: deny_sg_all_inbound (all envs)
58	- CloudCache: clear_ip_whitelist (all envs)
59	- K8sWorkload: scale_to_zero (all envs)
60	- K8sService: unmatchable_selector (all envs)
61	- K8sCronJob: suspend (all envs)
62	- CloudLoadBalancer: remove_all_backends (all envs)
63	- CloudEIP: unbind (all envs)
64	- K8sConfig: label_isolated + backup (all envs)
65	- ServiceMesh: remove_from_mesh + sidecar_disable (staging/prod) \| remove_from_mesh (dev)
66	- AppConfig: config_snapshot + deactivate (all envs)
67
68	3. Per-Resource Plan Generation: For each candidate, create {run_dir}/analysis/isolation_plan_{resource_id}.json with:
69	- metadata: resource_id, resource_type, entity_type, environment, suspect_level, zombie_score, priority
70	- isolation_strategy: method_id, method_name, description, rationale
71	- isolation_steps: [list of human-executable steps with verification commands]
72	- pre_checklist: [resource-type-specific pre-checks with MUST_PASS/SHOULD_PASS status]
73	- rollback_plan: method_id, method_name, estimated_time, steps
74	- observation_config: observation_period_days, metrics_to_monitor, success_criteria, auto_rollback_triggers
75	- risk_assessment: critical_dependencies, blast_radius_summary, isolation_side_effects, special_warnings
76	- quality_checks: completeness and consistency validation results
77
78	4. Data Validation: Before generating plans, validate:
79	- All candidates have resource_id, resource_type, environment
80	- resource_type is in SUPPORTED_TYPES
81	- suspect_level is high or medium
82	- blast_radius is populated (from deep_scan business.related_resources)
83	- owner_detail is populated (from deep_scan business.owner)
84
85	5. Pre-Checklist Generation: Create resource-type-specific pre-checks:
86	- Universal checks: backup availability, rollback dependencies, no ongoing changes, on-call notification
87	- CloudVM: SSH connectivity, iptables availability, rules backed up, not in Auto Scaling group
88	- CloudRDS: security group modifiable, no ongoing maintenance, backup available
89	- CloudCache: active connections count checked (do not isolate if serving traffic), persistence config verified (RDB/AOF backup status), confirmed not a shared cluster
90	- K8sWorkload: HPA status confirmed, replicas recorded, no PDB conflicts
91	- K8sService: endpoint count checked, headless service verified, external traffic policy recorded
92	- K8sCronJob: active jobs count checked, suspend status verified, concurrency policy recorded
93	- Load balancer / Elastic IP: backend configuration recorded, DNS records checked
94	- K8sConfig: backup created, no active mounts
95	- ServiceMesh: control plane accessibility confirmed, sidecar

People who liked this also viewed

6 picks

Type

isolation-planner

38stars4forks

View on GitHub

How to install isolation-planner?

knoxops/open-devops-skills/isolation-planner

$npx -y skills add KnoxOps/open-devops-skills --skill isolation-planner

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	## Input Parameters
2
3	\| Name \| Type \| Required \| Description \|
4	\|------\|------\|----------\|-------------\|
5	\| run_dir \| string \| Yes \| Workspace root directory for file passing between agents \|
6	\| ssh_key_path \| string \| No \| SSH key path for cloud provider access \|
7	\| environment \| string \| Yes \| Target environment for isolation method selection \|
8
9	## Execution Flow
10
11	### Task Context
12
13	Before starting execution, initialize `task_context.json`:
14
15	```json
16	{
17	"task_id": "<task_id from input>",
18	"current_step": 0,
19	"current_step_id": null,
20	"status": "running",
21	"steps": {
22	"phase3_plan_generation": "pending",
23	"phase3_batch_planning": "pending",
24	"phase3_review_gate": "pending"
25	},
26	"updated_at": "<ISO timestamp>"
27	}
28	```
29
30	Update this file after each step completes. On error, set step status to `"failed"` and overall `status` to `"failed"`.
31
32	### Step 1: phase3_plan_generation
33
34	Type: inline
35	Description: Read Phase 1/2 output and generate per-resource isolation plans
36
37	## Execution
38	Follow these instructions:
39
40	Read Phase 1/2 output files from {run_dir}/analysis/:
41	- suspect_assessment.json
42	- zombie_suspect_{resource_id}.json (per resource, from Phase 1 resource-screener)
43	- deep_scan_{resource_id}.json (per resource, from Phase 2 deep-scanner)
44
45	For each resource with suspect_level in {high, medium}:
46
47	1. Data Extraction:
48	- suspect_level, zombie_score, priority, owner_detail: from zombie_suspect_{resource_id}.json
49	- owner name, team: from deep_scan_{resource_id}.json `business.owner`
50	- related_resources (blast_radius / dependency graph): from deep_scan_{resource_id}.json `business.related_resources`
51
52	2. Method Selection: Use the isolation strategy matrix (by resource_type x environment)
53	to select the primary isolation method. If preconditions fail, use fallback.
54
55	Isolation Strategy Matrix:
56	- CloudVM: iptables DROP (all envs) \| Fallback: stop_instance
57	- CloudRDS: deny_sg_all_inbound (all envs)
58	- CloudCache: clear_ip_whitelist (all envs)
59	- K8sWorkload: scale_to_zero (all envs)
60	- K8sService: unmatchable_selector (all envs)
61	- K8sCronJob: suspend (all envs)
62	- CloudLoadBalancer: remove_all_backends (all envs)
63	- CloudEIP: unbind (all envs)
64	- K8sConfig: label_isolated + backup (all envs)
65	- ServiceMesh: remove_from_mesh + sidecar_disable (staging/prod) \| remove_from_mesh (dev)
66	- AppConfig: config_snapshot + deactivate (all envs)
67
68	3. Per-Resource Plan Generation: For each candidate, create {run_dir}/analysis/isolation_plan_{resource_id}.json with:
69	- metadata: resource_id, resource_type, entity_type, environment, suspect_level, zombie_score, priority
70	- isolation_strategy: method_id, method_name, description, rationale
71	- isolation_steps: [list of human-executable steps with verification commands]
72	- pre_checklist: [resource-type-specific pre-checks with MUST_PASS/SHOULD_PASS status]
73	- rollback_plan: method_id, method_name, estimated_time, steps
74	- observation_config: observation_period_days, metrics_to_monitor, success_criteria, auto_rollback_triggers
75	- risk_assessment: critical_dependencies, blast_radius_summary, isolation_side_effects, special_warnings
76	- quality_checks: completeness and consistency validation results
77
78	4. Data Validation: Before generating plans, validate:
79	- All candidates have resource_id, resource_type, environment
80	- resource_type is in SUPPORTED_TYPES
81	- suspect_level is high or medium
82	- blast_radius is populated (from deep_scan business.related_resources)
83	- owner_detail is populated (from deep_scan business.owner)
84
85	5. Pre-Checklist Generation: Create resource-type-specific pre-checks:
86	- Universal checks: backup availability, rollback dependencies, no ongoing changes, on-call notification
87	- CloudVM: SSH connectivity, iptables availability, rules backed up, not in Auto Scaling group
88	- CloudRDS: security group modifiable, no ongoing maintenance, backup available
89	- CloudCache: active connections count checked (do not isolate if serving traffic), persistence config verified (RDB/AOF backup status), confirmed not a shared cluster
90	- K8sWorkload: HPA status confirmed, replicas recorded, no PDB conflicts
91	- K8sService: endpoint count checked, headless service verified, external traffic policy recorded
92	- K8sCronJob: active jobs count checked, suspend status verified, concurrency policy recorded
93	- Load balancer / Elastic IP: backend configuration recorded, DNS records checked
94	- K8sConfig: backup created, no active mounts
95	- ServiceMesh: control plane accessibility confirmed, sidecar

People who liked this also viewed

6 picks

Type