rhecosystemappeng/ocp-admin

End-to-end OpenShift cluster creation using Red Hat Assisted Installer. Handles Single-Node OpenShift (SNO) and HA multi-node clusters on baremetal, vsphere, oci, nutanix. Use when: - "Create a new OpenShift cluster" - "Install OpenShift on my servers" - "Set up a single-node cluster for edge deployment" - "Deploy a production HA cluster" Complete workflow: cluster definition, ISO generation, host discovery/validation, role assignment, network configuration (VIPs, static networking), installation monitoring, credential retrieval. NOT for: - Listing existing clusters → Use /cluster-inventory skill - Modifying running clusters → Out of scope (Day-2 operations require direct cluster access) - Cluster upgrades (not yet supported)

List and inspect OpenShift clusters across self-managed (OCP, SNO) and managed service (ROSA, ARO, OSD) deployments. Returns cluster name, ID, version, status, platform, and creation date. Use when: - "List all clusters" - "Show cluster status" - "What clusters are available?" - "Get details of cluster [name]" - "Show cluster events for diagnostics" Read-only operations. Does NOT modify clusters.

Generate a consolidated health report across multiple OpenShift clusters. Verifies each kubeconfig context is a genuine OpenShift cluster before reporting. Non-OpenShift contexts are skipped by default. Collects node resources (CPU, memory, GPUs), namespace counts, and pod status into a single comparison view. Use when: - "Show me a report across all clusters" - "Compare cluster health" - "Multi-cluster status overview" - "How are my clusters doing?" - "Include all clusters including non-OpenShift" (override default filter) NOT for single-cluster deep-dives or troubleshooting specific pods.

Validate a CVE against a Red Hat container image using official SBOM attestations, Red Hat VEX data, and CVE metadata from MITRE/OSV.dev.

Validate a CVE against Red Hat Enterprise Linux CoreOS (RHCOS) in a specific OCP release by extracting RPM packages and checking Red Hat VEX data.

Query MITRE, OSV.dev, and Go vulnerability database to produce a structured report of affected packages, ecosystems, and vulnerable version ranges for a CVE.

Fetch container image labels, validate registry ownership, resolve tag/digest via SBOM, and report the SBOM artifact reference for a Red Hat container image.

Design and validate Kubernetes NetworkPolicies following Zero Trust principles (NIST SP 800-207). Two-tier analysis — architecture review then live cluster verification — produces a verified implementation plan with apply-and-verify results. Use when: - "Create NetworkPolicies for my namespace" - "Audit network isolation for this workload" - "Design network segmentation for a new application" - "Verify NetworkPolicies implement Zero Trust" - User mentions "network policy", "microsegmentation", "default-deny" NOT for Admin Network Policy (ANP) cluster-wide rules — those are cluster-admin infrastructure guardrails, not application-level microsegmentation. NOT for CNI plugin configuration or Multus secondary networks.