harumi-devops-plugin

Harumi DevOps Plugin

DevOps skills for Claude Code and Cursor. Provides infrastructure, Kubernetes, ArgoCD, observability, and cloud operations guidance for harumi's AWS stack.

Installation

Claude Code

Register the marketplace and install the plugin:

/plugin marketplace add [email protected]:harumi-io/harumi-devops-plugin.git
/plugin install harumi-devops-plugin@harumi-devops-marketplace

For local development, register directly from a cloned copy:

/plugin marketplace add /path/to/harumi-devops-plugin
/plugin install harumi-devops-plugin@harumi-devops-marketplace

Cursor

Clone the repository and register the plugin in Cursor Agent chat:

/add-plugin /path/to/harumi-devops-plugin

Configuration

The plugin reads a repo config file from the root of the repository it is installed into.

Preferred: harumi.yaml Legacy fallback: .devops.yaml (backward-compatible — loaded automatically when harumi.yaml is absent)

The session-start hook loads harumi.yaml when present; otherwise it falls back to .devops.yaml. It checks Kubernetes contexts declared in the config against the local kubeconfig and reports their availability. A missing repo config is the only blocking condition — surfaced as ⚠ BLOCKING: in the session context. Kubernetes access state (missing kubectl, unconfigured contexts, unreadable kubeconfig) is reported as informational or a warning; live cluster access is not assumed.

Create a harumi.yaml in your repository root:

# Identity
project: harumi
org: harumi-io

# Repositories managed by this plugin
repos:
  infra: harumi-io/infrastructure
  k8s: harumi-io/harumi-k8s

# AWS
aws:
  account_id: "123456789012"
  region: us-east-1
  account_alias: harumi

# Terraform
terraform:
  version: "1.5.7"
  state_backend: s3
  state_bucket: harumi-terraform
  var_file: prod.tfvars
  modules:
    main: /
    core_infra: /core-infrastructure
    iam: /iam

# Kubernetes
clusters:
  - name: eks-prod
    context: eks-prod
    environment: production
    domain: harumi.io
    registry: 123456789012.dkr.ecr.us-east-1.amazonaws.com
  - name: eks-dev
    context: eks-dev
    environment: development
    domain: dev.harumi.io
    registry: 123456789012.dkr.ecr.us-east-1.amazonaws.com

# ArgoCD / GitOps
argocd:
  gitops_repo: harumi-io/harumi-k8s
  app_of_apps:
    prod: eks/bootstrap/eks-app.yaml
    dev: eks-dev/bootstrap/eks-dev-app.yaml

# CI/CD
cicd:
  platform: github-actions

# Containers
containers:
  runtime: docker
  registry: ecr

# Observability — endpoints reachable via kubectl port-forward or ingress
observability:
  metrics: prometheus
  logs: loki
  traces: tempo
  dashboards: grafana
  endpoints:
    prometheus: http://prometheus.monitoring.svc:9090
    grafana: http://grafana.monitoring.svc:3000
    loki: http://loki.monitoring.svc:3100
    tempo: http://tempo.monitoring.svc:3200
    alertmanager: http://alertmanager.monitoring.svc:9093

# Naming
naming:
  pattern: "{namespace}-{stage}-{name}"
  namespace: harumi
  stage: production

# Docs management
docs:
  generated:
    - docs/architecture/*
    - harumi.yaml
  human_authored:
    - README.md
    - CLAUDE.md
    - AGENTS.md
    - docs/runbooks/*

If no config file exists, the plugin surfaces a message prompting you to create harumi.yaml or .devops.yaml. The sync-docs skill can generate harumi.yaml from your codebase and, where cluster or cloud access is available, live infrastructure state.

Skills

Domain Skills

Skill	Description
infrastructure	Terraform/IaC management for AWS
kubernetes	K8s manifest management, Helm, debugging, RBAC, NetworkPolicy, HPA
argocd	ArgoCD application management, app-of-apps patterns, sync waves, GitOps
observability	PromQL/LogQL/TraceQL authoring, Grafana dashboards, Prometheus alerts, incident investigation
deploy-app	App onboarding for ArgoCD with CI write-back pattern (dev and prod environments)

Operations Commands

Skill	Description
create-iam-user	Create IAM developer/admin/contributor users via Terraform
remove-iam-user	Offboard IAM users — removes Terraform config and runs plan
create-service-account	Create IAM service accounts with optional access keys and Secrets Manager
rotate-access-keys	Rotate IAM access keys with zero-downtime (create new, then deactivate old)
create-vpn-creds	Generate VPN client certificate and export .ovpn config
revoke-vpn-creds	Revoke a VPN client certificate
list-vpn-users	List all VPN certificates and their status

Kubernetes Operations