Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kouroshez/coding-os --skill terraform-k8sgit clone --depth 1 https://github.com/kouroshez/coding-osWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kouroshez/coding-os/terraform-k8s)<a href="https://agentmods.dev/skills/kouroshez/coding-os/terraform-k8s"><img src="https://agentmods.dev/badge/skills/kouroshez/coding-os/terraform-k8s/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kouroshez/coding-os/terraform-k8s"><img src="https://agentmods.dev/badge/skills/kouroshez/coding-os/terraform-k8s.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00202 | $0.02309 |
| Opus 5 | $0.00101 | $0.01154 |
| Sonnet 5 | $0.00040 | $0.00462 |
| Haiku 4.5 | $0.00020 | $0.00231 |
Grade A, and why
terraform-k8s scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 134 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Terraform & Kubernetes — The Declarative Substrate
A practical guide to provisioning cloud infrastructure with Terraform/OpenTofu and defining workloads as Kubernetes objects, such that the system state lives in version control and a fresh environment is one apply away. Stack-agnostic across cloud providers; recipes target AWS/GCP/Azure providers and vanilla K8s + Helm/Kustomize.
When to Use This Skill
- Writing or reviewing a Terraform/OpenTofu module — inputs, outputs, resource graph.
- Structuring remote state, workspaces/environments, and state locking before a team touches it.
- Reading a
terraform planthat wants to destroy/recreate something and deciding if that is safe. - Authoring K8s manifests (Deployment, Service, Ingress) or a Helm chart / Kustomize overlay.
- Sizing resource requests/limits, wiring liveness/readiness/startup probes, configuring an HPA.
- Managing config and secrets (ConfigMap, Secret, external secret operators) and RBAC.
Skip when: the question is how releases ship (pipeline stages, rollout strategy, versioning, rollback) — that is deployment-cicd. This skill is the infrastructure those releases land on.
Terraform — State Is the Whole Game
Terraform's model: a .tf description of desired state, a state file recording what actually exists, and plan/apply reconciling the two. Everything hard about Terraform is about state.
- Remote, locked state from day one. Never a local
terraform.tfstatefor shared infra — twoapplys race and corrupt it. Use an S3/GCS backend with DynamoDB/native locking. The state file contains secrets in plaintext → encrypt at rest, restrict access. planbefore everyapply, read every line. Especially-/+ destroy and then create: that recreates a resource (new DB, new IP, downtime). A force-new on an attribute you thought was mutable is the classic 2 a.m. outage.- Never edit the state file by hand. Use
terraform state mv/import/rm. Hand-editing JSON state desyncs it from reality. - Pin provider and module versions.
~> 5.0, not unconstrained — an unpinned provider upgrades mid-applyand changes resource behavior under you. - Drift is real. Someone clicks in the console;
plannow wants to "fix" it. Detect drift in CI (planon a schedule, alert on non-empty diff); decide console-vs-code ownership per resource.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 134 lines · 202 tokens per session scan A adbe9ee424f5
terraform-k8s is a skill published in the GitHub repository kouroshez/coding-os (6 stars, last pushed 2d ago), licensed Apache-2.0. It adds 202 tokens to every session and 2,309 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
deploy-gen
Generate deployment configurations (Docker, Kubernetes) for the current project.
kubernetes
Deploy, manage, and debug Kubernetes in production — Deployments, Services, Gateway API, Service Mesh (Istio/Linkerd/Cilium), eBPF observability (Cilium Hubble), security hardening (Pod Security Standards, OPA/Kyverno, seccomp, runtime security with Falco/Tetragon), Helm, HPA, PDB, topology spread, and debugging. Use…
ring:creating-helm-charts
Creating Helm charts to Lerian conventions via ring:helm: standardized chart structure, full env-var coverage from .env.example, security defaults (runAsNonRoot, readOnlyRootFilesystem), ClusterIP-only services, and health probes; validates helm lint and template render. Use when creating, modifying, or reviewing a…
troubleshoot-ssi
Diagnose and fix Single Step Instrumentation (SSI) issues on Kubernetes — SSI automatically instruments applications for APM without code changes. Only use if the agent and SSI are already configured but traces are missing or instrumentation is not working.
infrastructure-validation
Use when working with Terraform (.tf, .tfvars), Ansible (playbooks, roles, inventory), Docker (Dockerfile, docker-compose.yml), Kubernetes (manifests, Helm charts), CloudFormation, or any infrastructure-as-code files. Also use when running terraform plan/apply, building Docker images, writing Helm templates, or when…
staging-deploy
Build, push, migrate, and deploy to staging environment with health check verification. Use when deploying a completed phase to staging.