From hub-cert-tools
Checks hub cluster kube-apiserver certificate configuration and its compatibility with ACM. Detects certificate type, validates configuration, and provides recommendations for both pre-installation and post-installation scenarios.
How this skill is triggered — by the user, by Claude, or both
Slash command
/hub-cert-tools:check-hub-cert-configThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
This skill checks hub cluster kube-apiserver certificate configuration and its impact on ACM. It detects certificate type, validates ACM configuration, and provides tailored recommendations based on your cluster's current state.
This skill checks hub cluster kube-apiserver certificate configuration and its impact on ACM. It detects certificate type, validates ACM configuration, and provides tailored recommendations based on your cluster's current state.
When this skill is invoked:
Parse Arguments
--kubeconfig parameter if providedKUBECONFIG environment variableExecute the automated workflow
bash <skill-dir>/scripts/check-hub-cert-config.sh --kubeconfig <path>Present results to the user
Provide a user-friendly summary After the script output, summarize the key findings using this structure:
Terminology Guidelines:
Presentation Guidelines:
With kubeconfig parameter:
/check-hub-cert-config --kubeconfig /path/to/kubeconfig
Using KUBECONFIG environment variable:
export KUBECONFIG=/path/to/kubeconfig
/check-hub-cert-config
Invoke this skill when you need to:
Step 1: Cluster Information
Step 2: Cluster Kube APIServer Certificates
Step 3: ACM Status and Configuration
Step 4: ACM Certificate Management Analysis
Step 5: Analysis Summary
oc CLI installedopenssl CLI availableCertificate Type Assessment:
Status and Configuration Verification:
| Certificate Type | Pre-Installation | Post-Installation |
|---|---|---|
| OpenShift-Managed | ✅ Safe (don't change cert type later) | ✅ Verify no cert changes planned |
| Red Hat-managed | ✅ Safe with UseSystemTruststore | ✅ Verify UseSystemTruststore |
| Custom - Well-Known CA | ✅ Safe with root CA included | ✅ Verify configuration |
| Custom - Private CA | ✅ Safe with root CA included | ✅ Verify CA bundle config |
KUBECONFIG not persisting:
oc command not found:
Permission denied errors:
npx claudepluginhub stolostron/claude-code --plugin hub-cert-toolsReviews cert-manager PKI configuration for Kubernetes clusters: Issuer/ClusterIssuer scope, CertificateRequestPolicy coverage, certificate SAN/duration risks, trust-manager bundle distribution, and cloud CA auth methods.
Audits Kubernetes RBAC configurations for overly permissive roles, wildcard permissions, dangerous bindings, service account abuse, and privilege escalation using kubectl, rbac-tool, KubiScan, Kubeaudit. For cluster security assessments on EKS, GKE, AKS.
Audits Kubernetes RBAC for overly permissive roles, wildcards, dangerous bindings, service account abuse, and privilege escalation using kubectl, rbac-tool, KubiScan, and Kubeaudit.