auth
無料Authentication and authorization patterns for Rossoctl services
日本語の概要は準備中です。原文の説明を表示しています。
Create or edit skills with proper structure, task tracking, and naming conventions
日本語の概要は準備中です。原文の説明を表示しています。
実行スコア 未検証
インストール方法を見るインストールする前に、エージェントに与えられる指示の中身を確認できます。
Create new skills or edit existing ones. Both follow the same checklist and conventions.
All skill work MUST happen in a worktree. Before proceeding, verify you are in a worktree:
git worktree list
If not in a worktree, create one first:
git fetch upstream main
git worktree add .worktrees/skills-<topic> -b docs/skills-<topic> upstream/main
| Action | Steps |
|---|---|
| New skill | Create directory + SKILL.md from template, fill in content, validate |
| Edit skill | Read existing file first, apply changes, re-validate, ensure diagram still matches text |
For edits: always read the skill FIRST, then edit. Never overwrite without reading.
.claude/skills/<category>:<skill-name>/
└── SKILL.md
IMPORTANT: Use colon notation in directory names (e.g., auth:my-skill/). Required for Claude Code skill discovery.
Categories: auth, ci, genai, git, hypershift, istio, k8s, rossoctl, kind, local, openshift, rca, skills, tdd, testing
---
name: category:skill-name
description: One-line description (what it does, not how)
---
Use colon notation in name: field. Directory name must match.
# Skill NameSkills must classify as sandbox or management to determine command format:
| Type | Target | Auto-approve? |
|---|---|---|
| Sandbox | Kind cluster, custom HyperShift hosted cluster | YES |
| Management | Management cluster, AWS resources, git push, destructive ops | NO |
Claude Code auto-approves commands by matching the first token against .claude/settings.json patterns. Chained commands (&&), multiline scripts, heredocs, and for loops break pattern matching.
IMPORTANT: Write each command as a separate code block:
Check pod status:
```bash
kubectl get pods -n rossoctl-system
Check logs:
kubectl logs -n rossoctl-system deployment/mlflow
Do NOT chain: `kubectl get pods && kubectl logs ...`
For HyperShift, prefix each command individually:
```markdown
```bash
KUBECONFIG=~/clusters/hcp/rossoctl-hypershift-custom-$CLUSTER/auth/kubeconfig kubectl get pods -n rossoctl-system
### Management skills: Any format
Commands targeting management clusters or AWS need user approval anyway, so multiline/chained format is acceptable.
### Temporary Files
Skills that download logs, artifacts, or save analysis output should use `/tmp/rossoctl/<skill-category>/` as the working directory:
```bash
mkdir -p /tmp/rossoctl/rca
This path is auto-approved for read/write in .claude/settings.json.
After writing a skill, verify all sandbox commands are covered by .claude/settings.json patterns. If a new command prefix is used, add it:
{
"permissions": {
"allow": [
"Bash(new-command:*)"
]
}
}
See skills:validate for the full pattern reference table.
Workflow skills (skills with phases, decision trees, or routing logic) MUST include:
.mmd template file in the skill directory (for debug mode, TDD skills only)| Category | classDef |
|---|---|
| TDD | classDef tdd fill:#4CAF50,stroke:#333,color:white |
| RCA | classDef rca fill:#FF5722,stroke:#333,color:white |
| CI | classDef ci fill:#2196F3,stroke:#333,color:white |
| Test | classDef test fill:#9C27B0,stroke:#333,color:white |
| Git | classDef git fill:#FF9800,stroke:#333,color:white |
| K8s | classDef k8s fill:#00BCD4,stroke:#333,color:white |
| Deploy | classDef deploy fill:#795548,stroke:#333,color:white |
| Skills | classDef skills fill:#607D8B,stroke:#333,color:white |
| GitHub | classDef github fill:#E91E63,stroke:#333,color:white |
| HyperShift | classDef hypershift fill:#3F51B5,stroke:#333,color:white |
| Playwright | classDef pw fill:#8BC34A,stroke:#333,color:white |
Exempt from diagram requirement: pure index parents that only list sub-skills with no routing logic (e.g., git/, k8s/, auth/)
Every workflow skill (tdd, rca, ci, etc.) MUST include a Task Tracking section. This is the canonical reference for how Claude Code task lists work across all skills.
<worktree> | <PR> | <plan-doc> | <topic> | <phase> | <task description>
mlflow-ci) or rossoctl for main repoPR#569) or nonecalm-toast.md) or ad-hoc if no planKind CI, MLflow init, CodeQL)Examples:
mlflow-ci | PR#569 | calm-toast.md | MLflow init | Phase 2: Fix | Use parameterized SQLmlflow-ci | PR#569 | ad-hoc | Kind CI | | Bind Ollama to 0.0.0.0rossoctl | none | calm-toast.md | skills | Step 1 | Create ci:status skill1. On skill invocation:
- TaskList → check existing tasks for this worktree/PR
- Update completed items
- Create new items for discovered work
2. Task metadata:
- plan: path to plan doc or "ad-hoc" if none
- runner: main-session | subagent | background
3. Dependencies:
- Use addBlockedBy for sequential tasks
- Parallel tasks have no blockers
4. Status reporting - always show plan doc in task name:
| # | Status | Task (includes plan doc) |
|---|--------|-------------------------|
| #26 | in_progress | rossoctl \| none \| calm-toast.md \| skills \| Create \| ci:status |
| #32 | completed | mlflow-ci \| PR#569 \| ad-hoc \| Kind CI \| Fix \| Ollama bind |
Every task should reference its parent planning document:
metadata.plan = "<plan-file-path>"metadata.plan = "ad-hoc"Before committing a new skill:
name and description---
name: category:skill-name
description: Brief description of what this skill does
---
# Skill Name
## When to Use
- Condition 1
- Condition 2
## Workflow
1. Step one
2. Step two
## Workflow Diagram
```mermaid
flowchart TD
START(["/category:skill"]) --> STEP1["Step 1"]:::category
STEP1 --> STEP2["Step 2"]:::category
classDef category fill:#COLOR,stroke:#333,color:white
On invocation:
<worktree> | <PR> | <topic> | <phase> | <task>Symptom: What you see Fix: How to resolve
category:related-skill
## Related Skills
- `skills:validate` - Check skill format compliance
- `skills:retrospective` - Identify skill gaps and improvements
- `meta:write-docs` - Documentation formatting guidelines
まだレビューはありません。使ってみた感想をお寄せください。
ログインなしで書き込めます。使ってみた感想、質問、動かなかった環境などを気軽にどうぞ。
まだコメントはありません。最初のコメントを書いてみませんか。
Authentication and authorization patterns for Rossoctl services
日本語の概要は準備中です。原文の説明を表示しています。
Create confidential OAuth2 clients in Keycloak for server-to-service authentication
日本語の概要は準備中です。原文の説明を表示しています。
Configure MLflow with mlflow-oidc-auth plugin for Keycloak OIDC authentication
日本語の概要は準備中です。原文の説明を表示しています。
Configure OpenTelemetry Collector with OAuth2 authentication for trace export
日本語の概要は準備中です。原文の説明を表示しています。
CI pipeline monitoring, status checks, and PR validation workflows
日本語の概要は準備中です。原文の説明を表示しています。
Monitor running CI jobs, wait for completion, create tasks for results
日本語の概要は準備中です。原文の説明を表示しています。