Skills and memory
TalkOps Kubernetes Agent (k8s-autopilot) combines two mechanisms to adapt to your infrastructure:
- Skills (
SKILL.md) — Modular, step-by-step operational playbooks loaded on demand when a task matches their domain. - Memory (
AGENTS.md) — Persistent cluster conventions, environment mappings, and architectural rules loaded at the start of every session.
Skills
Skills provide structured domain expertise—such as Helm rollback procedures, PromQL query patterns, or Argo Rollouts canary workflows. Using progressive disclosure, k8s-autopilot keeps full skill bodies out of the context window until an operator is invoked for a matching task.
Skill sources
| Source | Scope | Lifecycle |
|---|---|---|
| Built-in operator skills | Scoped to each of the 4 built-in operators (helm-operation, kubernetes-cluster-ops, argocd-gitops, argo-rollout-gitops, traefik-edge-routing, prometheus, alertmanager, opentelemetry, loki, tempo) | Loaded automatically only when that operator is active |
| Agent plugin skills | Scoped to the plugin's custom subagent | Loaded only when the plugin subagent is delegated a task |
| Vertical plugin skills | Bound to the root Supervisor agent | Available across all conversations once the plugin is installed |
SKILL.md format
Each skill lives in a directory containing a SKILL.md file with YAML frontmatter and markdown instructions (plus optional references/, scripts/, and assets/ folders):
---
name: kubernetes-hardening
description: "Audit and enforce Pod Security Standards and NetworkPolicies across Kubernetes namespaces"
tags: [security, kubernetes, compliance]
---
# Kubernetes Hardening Playbook
When auditing or enforcing namespace and workload security:
1. Inspect namespace labels for Pod Security Admission (`pod-security.kubernetes.io/enforce: restricted`).
2. Flag containers running as root (`runAsNonRoot: false`) or with `allowPrivilegeEscalation: true`.
3. Verify each application namespace contains a default-deny ingress `NetworkPolicy`.
4. Check all containers for explicit CPU and memory requests and limits.
5. Output a structured compliance table with remediation manifests.
Installed plugin skills are backed up in the configuration database so they survive container upgrades and redeployments automatically.
Persistent memory (AGENTS.md)
As you collaborate with k8s-autopilot, you can instruct it to remember environment-specific conventions across all future sessions:
Remember that all Helm releases for backend services must use the internal ingress class and include the team=platform label.
The agent persists learned rules to AGENTS.md and loads them at the beginning of every conversation thread:
## Cluster Conventions
- Target the `platform` namespace for shared infrastructure charts unless specified otherwise.
- Use `sealed-secrets` for secret management — never create unencrypted Kubernetes Secrets in Git.
- Prometheus `ServiceMonitor` resources must include the `release: kube-prometheus-stack` label.
## Cluster Contexts
- Staging: `eks-staging-us-east-1`
- Production: `eks-prod-us-east-1` (always verify context before mutating operations)
What to store in AGENTS.md
Recommended for AGENTS.md | Keep out of AGENTS.md |
|---|---|
| Naming conventions, required labels, and ingress classes | API keys, bearer tokens, or credentials (use Settings → Auth & Keys) |
| Cluster context names and environment topology | Ephemeral pod names or one-off debugging logs |
| Approved Helm chart repositories and container registries | Large raw YAML manifests (place templates in a Skill instead) |