What is environment-promotion?

A guide to moving applications between separate development, staging, and production environments on Control Plane.

Use it to choose an environment layout, copy images or configure cross-organization access, deploy to production, and reproduce or undo a release.

It clarifies that promotion means applying the same images and configuration again, and addresses the image-access problems that commonly stop deployments.

environment-promotion — Skill for Claude Code and Codex by controlplane-com: A guide to moving applications between separate development, st

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/controlplane-com/ai-plugin/environment-promotion

Any agent

npx skills add controlplane-com/ai-plugin --skill environment-promotion

Clone the repo

git clone --depth 1 https://github.com/controlplane-com/ai-plugin

Made for: Claude Code, Codex.

Or install cpln, the plugin that ships this one along with the rest of its 30 skills, 2 commands, 2 agents, 1 hook, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/controlplane-com/ai-plugin/environment-promotion.svg)](https://agentmods.dev/skills/controlplane-com/ai-plugin/environment-promotion)

Your own site

<a href="https://agentmods.dev/skills/controlplane-com/ai-plugin/environment-promotion"><img src="https://agentmods.dev/badge/skills/controlplane-com/ai-plugin/environment-promotion.svg" alt="Measured on agentmods" height="20"></a>

Per session 46 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,663 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00046	$0.02663
Opus 5	$0.00023	$0.01332
Sonnet 5	$0.00009	$0.00533
Haiku 4.5	$0.00005	$0.00266

Measured 3d ago against content hash 138ef34180a8, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

environment-promotion scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/cpln/skills/environment-promotion/SKILL.md · 144 lines

How it starts

The opening of the file, as written. The whole thing — 144 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Environment Promotion

Tool availability: some MCP tools named here live in the full toolset profile — if one is not advertised on this connection, tell the user to reconnect the MCP server with ?toolsets=full (or use the cpln CLI fallback). Reads work on every profile via the generic list_resources / get_resource tools; delete_resource is on every profile except readonly.

Control Plane has no built-in promote or rollback primitive — promotion is applying the same artifacts (image + manifests) to the next environment. Two topologies exist: org-per-environment (the documented best practice) and GVC-per-environment. The recurring failure is image access: a staging/prod org cannot pull the dev org's images until you either copy the image or wire up a cross-org pull secret.

Choosing a topology

Topology	Isolation	Image sharing	Best for
Org per environment (recommended)	Strongest — policies, secrets, users, audit fully separate	`cpln image copy` or cross-org pull secret	Production, compliance-sensitive teams
GVC per environment (one org)	Weak — shared org policies and access	Same org registry; no pull secret needed	Small teams, rapid iteration

With org-per-environment, GVCs and workloads keep identical names in every org, so the same manifests apply unchanged — no environment suffixes in resource names. Org creation is account-level: Console, or cpln org create --accountId ID --invitee EMAIL.

Promoting manifests

Keep manifests in git and apply them per environment — cpln apply is idempotent (PUT upsert) and resolves resource ordering:

cpln apply --file ./manifests/ --org my-org-staging --gvc my-gvc --ready   # org-per-env: same files, next org
cpln apply --file ./manifests/ --org my-org --gvc staging-gvc --ready     # gvc-per-env: same files, next GVC

Bootstrap manifests from a live environment with cpln <resource> get REF -o yaml-slim (plain yaml output breaks apply).
Environment differences (env vars, scaling, firewall) belong in the manifests per environment — or patch after apply with mcp__cpln__update_workload / mcp__cpln__update_gvc (both PATCH semantics).
For IaC-based promotion, export live resources to Terraform: mcp__cpln__export_terraform (one self link, or bulk by path depth — a whole GVC or org), mcp__cpln__export_terraform_batch (full profile, up to 100 explicit links), mcp__cpln__convert_to_terraform (manifest to HCL, dry-run validated). An unsupported kind is rejected with the supported list.

Read the full file on GitHub · 144 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

3d ago First seen · 144 lines · 46 tokens per session scan A 138ef34180a8

Subscribe to this mod's changes

environment-promotion is a skill published in the GitHub repository controlplane-com/ai-plugin (10 stars, last pushed 10d ago), licensed MIT. It adds 46 tokens to every session and 2,663 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Cloud DevOps and cloud ai ai-agents claude-code cloud-native codex controlplane

higress-openclaw-integration

Deploy and configure Higress AI Gateway for OpenClaw integration. Use when: (1) User wants to deploy Higress AI Gateway, (2) User wants to configure OpenClaw to use more model providers, (3) User mentions 'higress', 'ai gateway', 'model gateway', 'AI网关', (4) User wants to set up model routing or auto-routing, (5) User…

higress-group/higress · 103 tokens

ak-cloud-deploy

Deploy an Agent Kernel project to AWS, Azure, or GCP using Terraform modules, or to any Kubernetes cluster (on-prem, baremetal, EKS) using the official Helm chart. Supports serverless and containerized modes for all three clouds. AWS supports execution modes (restsync, restasync, async, stream), queue-based scalable…

yaalalabs/agent-kernel · 146 tokens

openpitrix

KubeSphere OpenPitrix application management Skill. Use when users ask about KubeSphere App Store, OpenPitrix, Helm/YAML application templates, application repositories, app versions, app releases, categories, review states, repository sync, or troubleshooting application installation and upgrade issues.

kubesphere/kubesphere · 60 tokens

whizard-notification

Use when working with WizTelemetry Notification extension for KubeSphere, including installation, configuration, troubleshooting, notification channel setup, alert routing, and silence management.

kubesphere/kubesphere · 36 tokens

whizard-telemetry-ruler

Use when working with WizTelemetry Ruler extension for KubeSphere, including installation, configuration, alerting rules management.

kubesphere/kubesphere · 31 tokens

kubesphere-openkruise

KubeSphere OpenKruise management Skill. Use when user asks to install or enable OpenKruise, check OpenKruise status, view kruise pods/logs/CRDs, create or update SidecarSet, manage sidecar injection, create or update CloneSet, perform in-place update or batch rollout, uninstall or remove OpenKruise, or troubleshoot…

kubesphere/kubesphere · 99 tokens