Repository navigation
Conversation
Agent skill that rotates a Principal's keytab with kubectl krb rotate-keytab: read-only precheck (permissions, Principal, daemons, keytab principal + KVNO), mandatory user approval, then independent verification (every node Minted after the rotation, Ready, expected KVNO, no new KerberosMintFailed events). Never prints key material. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Read-only inspection of Kerberator Tenants and Principals via kubectl-krb. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Vikram Varikooty <189786398+varikooty@users.noreply.github.com>
Signed-off-by: Vikram Varikooty <189786398+varikooty@users.noreply.github.com>
… password Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Vikram Varikooty <189786398+varikooty@users.noreply.github.com>
…T3 and 15 cases Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Vikram Varikooty <189786398+varikooty@users.noreply.github.com>
Signed-off-by: Vikram Varikooty <189786398+varikooty@users.noreply.github.com>
Signed-off-by: Vikram Varikooty <189786398+varikooty@users.noreply.github.com>
…entials CODEOWNERS (on the skills branch only): PRs touching .claude/ now request review from the skills team instead of everything going to the default owner. Everything else is unchanged. .gitignore: never commit keytabs (keytabs/, *.keytab), kubeconfigs (*.kubeconfig) or Kerberos ticket caches (krb5cc_*). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: manasvik06 <manasvi.spc@gmail.com>
Read-only triage for a Principal that can't get a Kerberos ticket. scripts/collect.sh gathers the evidence in one pass: Principal and Tenant realm, the KDC address from krb5.conf, per-node status, daemon pods (and why one isn't running), Kerberos events with untruncated messages, the daemon log lines carrying kinit's own error, every Principal in the namespace, and a SIGNALS summary. SKILL.md classifies from those signals with confidence labels and hands off to DG-03, OP-04, OP-05 or OP-01 instead of fixing anything. references/kinit-errors.md maps kinit errors to likely causes. Tested collect.sh on the team cluster: a failing Principal (key rejected on 2/2 nodes), a healthy one (no false alarm), and a UID given instead of the CR name. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: manasvik06 <manasvi.spc@gmail.com>
…ng-key From review: - collect.sh sections 4, 5 and 7 tested $? after other assignments, so a failed kubectl call never printed UNAVAILABLE. Capture rc=$? immediately after each call. - "Keytab contains no suitable keys" (e.g. a keytab for a different principal) fell through to unrecognized. Add keytab-no-matching-key for it and "Key table entry not found"; enctype errors become their own enctype-unsupported signature. Also: when events have expired or can't be read, fall back to the per-node status message for error_signature instead of reporting none. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: manasvik06 <manasvi.spc@gmail.com>
feat(skills): add kerberator-diagnose-auth-failure skill (DG-06)
Signed-off-by: Anvesha Girish <anveshagirish@gmail.com>
Signed-off-by: Saniya Goyal <saniyagoyal22@gmail.com>
Signed-off-by: Anvesha Girish <anveshagirish@gmail.com>
Signed-off-by: George Sukhotin <sukhotin@wisc.edu>
…; agent runs pending) Signed-off-by: Vikram Varikooty <189786398+varikooty@users.noreply.github.com>
Signed-off-by: Vikram Varikooty <189786398+varikooty@users.noreply.github.com>
Signed-off-by: Vikram Varikooty <189786398+varikooty@users.noreply.github.com>
…own files w instructions for special cases
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Vikram Varikooty <189786398+varikooty@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Vikram Varikooty <189786398+varikooty@users.noreply.github.com>
test(skills): Add automated agent evaluation framework and OP-03 skill
skills: adding create-tenant skill (OP-02)
Add OP-06 configure node targeting skill
Add OP-10 Principal and Tenant removal skill
Added @gsukhotin as a code owner for .claude/ PRs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
A one-paragraph summary. Which component (operator / daemon / cli / shared / docs / chart)? What behavior changes?
Why?
Link the Issue this closes (
Fixes #NNN) or explain the motivation if there's no filed Issue.How was this tested?
make testpasses locallymake integrationpasses locally (envtest)Breaking changes
Docs
README.md,docs/usage.md, or relevant per-component README)CHANGELOG.mdentry added under the next unreleased version headingChecklist
git commit -s)gofmt -smake vetpasses