alibaba-live-ack-rollout-guard

Name: alibaba-live-ack-rollout-guard
Author: Raishin

17stars3forks

How to install alibaba-live-ack-rollout-guard?

raishin/vanguard-frontier-agentic/alibaba-live-ack-rollout-guard

$npx -y skills add Raishin/vanguard-frontier-agentic --skill alibaba-live-ack-rollout-guard

Installs into the current project.

Summary

Gate ACK deployment mutations, node pool scaling, and cluster version upgrades against rollback posture and workload disruption budget. Prevents irreversible cluster version upgrades from proceeding without PodDisruptionBudget verification, node drain confirmation, and explicit o

Files · 1

View on GitHub

SKILL.md

1	# Alibaba Cloud Live ACK Rollout Guard
2
3	## Purpose
4
5	Act as the guarded live Alibaba Cloud operator for alibaba-live-ack-rollout-guard work. Gate ACK deployment mutations, node pool scaling, and cluster version upgrades. Insist on PDB audit and rollback posture evidence before execution, and treat any ambiguous approval or target as a stop condition.
6
7	## When to Use
8
9	Use this skill when:
10
11	- An ACK cluster version upgrade is requested (Kubernetes minor or patch version bump)
12	- A node pool is being scaled up or down (especially when removing nodes)
13	- A Deployment or DaemonSet rollout is being executed against a production workload
14	- Node pool configuration changes are planned (instance type, image version, count)
15	- An operator needs to audit PodDisruptionBudgets before a disruptive node pool operation
16	- An emergency rollback of a broken rollout is required
17
18	## When NOT to Use
19
20	Do not use this skill when:
21
22	- The target is a non-production cluster with no PDB requirements and no live traffic
23	- The task is creating a brand-new cluster (no existing workloads at risk)
24	- The task is purely read-only cluster inspection with no mutation intent
25	- The task involves Function Compute, SAE, or other non-ACK compute
26
27	## Cluster Type Awareness
28
29	ACK supports three cluster types — mutation procedures differ per type:
30
31	- Managed cluster: Control plane managed by Alibaba Cloud. Node pool upgrades and scaling are the primary mutation surface.
32	- Dedicated cluster: Full control plane access. Both control plane and data plane versions must be managed.
33	- Serverless cluster (ASK): No node pool concept. Pod-level scaling only — ECI instances are provisioned on demand. Version upgrades are less common but follow the same approval gate.
34
35	Always confirm cluster type before recommending a mutation path.
36
37	## Pre-Flight Checklist
38
39	Before executing any ACK mutation, verify all of the following:
40
41	1. Cluster identity confirmed — query the ACK API or Alibaba Cloud console to confirm the cluster ID, name, type, and region match the intended target.
42	2. Active RAM principal confirmed — confirm the active identity has the required RAM policy (`AliyunCSFullAccess` scoped to target cluster) for the operation.
43	3. Current cluster version and node pool version captured — document both before proceeding; confirm the target version is available for the cluster type.
44	4. PDB audit complete — run `kubectl get pdb --all-namespaces` and confirm no PDB has `DISRUPTIONS ALLOWED: 0` for workloads running on the affected node pool.
45	5. Node drain posture verified — for scale-in operations, confirm all nodes to be removed can be safely drained (no pods with no toleration for eviction, no local storage).
46	6. Rollback posture acknowledged — cluster version upgrades cannot be downgraded; operator must explicitly acknowledge this is one-way.
47	7. Maintenance window confirmed — confirm the upgrade is within the approved change window.
48	8. Rollout history captured — run `kubectl rollout history deployment/<NAME> -n <NAMESPACE>` to document the pre-change state for Deployment rollouts.
49
50	## Required Confirmation
51
52	The operator must explicitly state all of the following before any mutation is executed:
53
54	- "I confirm the cluster is `<CLUSTER_ID>` (`<CLUSTER_NAME>`) of type `<managed/dedicated/serverless>` in region `<REGION>`."
55	- "I confirm the target version is `<TARGET_VERSION>` and I understand cluster version upgrades cannot be downgraded."
56	- "I have reviewed PDB status for all workloads on this node pool and no disruption-blocking PDB is present."
57	- "I approve this rollout action."
58
59	## Execution Steps
60
61	1. Capture pre-change state: cluster version, node pool version, all PDB states, Deployment rollout history.
62	2. Confirm active RAM principal and policy scope.
63	3. Present the planned change and its blast radius to the operator for explicit approval.
64	4. Execute the mutation via the ACK console, Alibaba Cloud CLI (`aliyun cs`), or kubectl as appropriate.
65	5. Monitor rollout progress: `kubectl rollout status deployment/<NAME> -n <NAMESPACE>` or poll the ACK task status via API.
66	6. Verify all nodes reach `Ready` status and all workloads are running post-upgrade.
67
68	## Rollback Procedure
69
70	- Deployment rollback (reversible): `kubectl rollout undo deployment/<NAME> -n <NAMESPACE>`
71	- Node pool scaling scale-in (partially reversible): New nodes can be added back, but drained workloads need to be rescheduled.
72	- Cluster version upgrade (NOT reversible): A com

People who liked this also viewed

6 picks

Type

alibaba-live-ack-rollout-guard

17stars3forks

View on GitHub

How to install alibaba-live-ack-rollout-guard?

raishin/vanguard-frontier-agentic/alibaba-live-ack-rollout-guard

$npx -y skills add Raishin/vanguard-frontier-agentic --skill alibaba-live-ack-rollout-guard

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Alibaba Cloud Live ACK Rollout Guard
2
3	## Purpose
4
5	Act as the guarded live Alibaba Cloud operator for alibaba-live-ack-rollout-guard work. Gate ACK deployment mutations, node pool scaling, and cluster version upgrades. Insist on PDB audit and rollback posture evidence before execution, and treat any ambiguous approval or target as a stop condition.
6
7	## When to Use
8
9	Use this skill when:
10
11	- An ACK cluster version upgrade is requested (Kubernetes minor or patch version bump)
12	- A node pool is being scaled up or down (especially when removing nodes)
13	- A Deployment or DaemonSet rollout is being executed against a production workload
14	- Node pool configuration changes are planned (instance type, image version, count)
15	- An operator needs to audit PodDisruptionBudgets before a disruptive node pool operation
16	- An emergency rollback of a broken rollout is required
17
18	## When NOT to Use
19
20	Do not use this skill when:
21
22	- The target is a non-production cluster with no PDB requirements and no live traffic
23	- The task is creating a brand-new cluster (no existing workloads at risk)
24	- The task is purely read-only cluster inspection with no mutation intent
25	- The task involves Function Compute, SAE, or other non-ACK compute
26
27	## Cluster Type Awareness
28
29	ACK supports three cluster types — mutation procedures differ per type:
30
31	- Managed cluster: Control plane managed by Alibaba Cloud. Node pool upgrades and scaling are the primary mutation surface.
32	- Dedicated cluster: Full control plane access. Both control plane and data plane versions must be managed.
33	- Serverless cluster (ASK): No node pool concept. Pod-level scaling only — ECI instances are provisioned on demand. Version upgrades are less common but follow the same approval gate.
34
35	Always confirm cluster type before recommending a mutation path.
36
37	## Pre-Flight Checklist
38
39	Before executing any ACK mutation, verify all of the following:
40
41	1. Cluster identity confirmed — query the ACK API or Alibaba Cloud console to confirm the cluster ID, name, type, and region match the intended target.
42	2. Active RAM principal confirmed — confirm the active identity has the required RAM policy (`AliyunCSFullAccess` scoped to target cluster) for the operation.
43	3. Current cluster version and node pool version captured — document both before proceeding; confirm the target version is available for the cluster type.
44	4. PDB audit complete — run `kubectl get pdb --all-namespaces` and confirm no PDB has `DISRUPTIONS ALLOWED: 0` for workloads running on the affected node pool.
45	5. Node drain posture verified — for scale-in operations, confirm all nodes to be removed can be safely drained (no pods with no toleration for eviction, no local storage).
46	6. Rollback posture acknowledged — cluster version upgrades cannot be downgraded; operator must explicitly acknowledge this is one-way.
47	7. Maintenance window confirmed — confirm the upgrade is within the approved change window.
48	8. Rollout history captured — run `kubectl rollout history deployment/<NAME> -n <NAMESPACE>` to document the pre-change state for Deployment rollouts.
49
50	## Required Confirmation
51
52	The operator must explicitly state all of the following before any mutation is executed:
53
54	- "I confirm the cluster is `<CLUSTER_ID>` (`<CLUSTER_NAME>`) of type `<managed/dedicated/serverless>` in region `<REGION>`."
55	- "I confirm the target version is `<TARGET_VERSION>` and I understand cluster version upgrades cannot be downgraded."
56	- "I have reviewed PDB status for all workloads on this node pool and no disruption-blocking PDB is present."
57	- "I approve this rollout action."
58
59	## Execution Steps
60
61	1. Capture pre-change state: cluster version, node pool version, all PDB states, Deployment rollout history.
62	2. Confirm active RAM principal and policy scope.
63	3. Present the planned change and its blast radius to the operator for explicit approval.
64	4. Execute the mutation via the ACK console, Alibaba Cloud CLI (`aliyun cs`), or kubectl as appropriate.
65	5. Monitor rollout progress: `kubectl rollout status deployment/<NAME> -n <NAMESPACE>` or poll the ACK task status via API.
66	6. Verify all nodes reach `Ready` status and all workloads are running post-upgrade.
67
68	## Rollback Procedure
69
70	- Deployment rollback (reversible): `kubectl rollout undo deployment/<NAME> -n <NAMESPACE>`
71	- Node pool scaling scale-in (partially reversible): New nodes can be added back, but drained workloads need to be rescheduled.
72	- Cluster version upgrade (NOT reversible): A com

People who liked this also viewed

6 picks

Type