> Per AI Blitz Plan §skills.infra. Layer: 1. Repo: devops-infra-helm-charts.

# Skill — `add-infra-tool`

> **Layer:** Layer 1 — agent generates diff(s) and opens PR(s) in this repo and (separately) in the sister repo. Reviewer + Argo CD UI Sync click are the human gates.
> **Scope:** the values-side slice in `devops-infra-helm-charts` plus the matching Argo `Application` slice in `github.com/Meesho/devops-infra-argo-config`.

This skill is the agent-callable form for adding a new infrastructure tool to a target cluster. It parameterises the [onboard-app-to-cluster.md](../../docs/platform/procedures/onboard-app-to-cluster.md) procedure and pairs the values-side PR with a sister-repo PR for the Argo CD `Application`.

For graduating an incubator tool fleet-wide, see [../../docs/platform/schemas/incubator-values-schema.md](../../docs/platform/schemas/incubator-values-schema.md).

---

## When to Use

Triggers like:

- "Add `<tool>` to `<cluster>`."
- "Bring up `<tool>` on `k8s-shared-int-ase1` for trial."
- "Onboard a new infra tool — chart already exists in `helm-templates/`."
- "Land an incubator deploy of `<tool>` on the integration cluster."

Do **not** use this skill for:

- Onboarding a service workload — services live in their own repos, not here.
- Adding a route to an existing tool — see [add-contour-route.md](../../docs/platform/procedures/add-contour-route.md).
- Bumping an existing tool's chart version — use [bump-chart-version.md](bump-chart-version.md).
- Adding a brand-new cluster — use the [onboard-new-cluster.md](../../docs/platform/procedures/onboard-new-cluster.md) procedure.
- Editing observability / alert rules — [diagnose-deployment.md](diagnose-deployment.md) routes to the right procedure.

---

## Input

Required:

```yaml
tool:                <name>                  # e.g. cert-manager, keda, kyverno
target_cluster:      <cluster-folder>        # e.g. k8s-shared-int-ase1
chart_source:        existing | new-vendored # is helm-templates/<tool>/ already present?
release_name:        <name>                  # often == tool
workload_namespace:  <ns>
image_tag:           <pinned-tag>            # NEVER 'latest'
resources:
  cpu_request:       <e.g. 250m>
  memory_request:    <e.g. 512Mi>
  cpu_limit:         <e.g. 1>
  memory_limit:      <e.g. 2Gi>
node_pool_key:       dedicated | cloud.google.com/compute-class
node_pool_value:     <pool-or-cc-name>
```

Optional:

```yaml
incubator:               <bool>              # adds top-of-file comment, disables autoscaling defaults
needs_external_dns:      <bool>
needs_external_secret:   <bool>
needs_compute_class:     <bool>              # GKE Autopilot only
priority_class:          <name-in-manifests/priorityclass/<cluster>/>
persistence:
  enabled:               <bool>
  storage_class:         <name>
  size:                  <e.g. 100Gi>
sister_repo_app_name:    <name>              # default: <release_name>-<target_cluster>
```

---

## Steps

### 1. Verify pre-conditions

```bash
# Chart exists (chart_source: existing)
ls helm-templates/<tool>/Chart.yaml

# Cluster exists
ls helm-overrides/<target_cluster>/

# Tool not already onboarded here
[ ! -d helm-overrides/<target_cluster>/<tool>/ ]

# StorageClass exists if persistence.enabled
ls manifests/storageclass/<storage_class>.yaml

# PriorityClass exists if priority_class set
ls manifests/priorityclass/<target_cluster>/<priority_class>.yaml
```

If `chart_source: new-vendored`, the chart must already be in `helm-templates/<tool>/`. If not, that is a separate (chart-vendoring) PR — fail fast and ask the user to land that first. **Do not** vendor the chart inside this skill.

### 2. Read the cluster's scheduling profile

Sample 3 sibling apps on the **same** cluster:

```bash
for f in $(ls helm-overrides/<target_cluster>/*/custom-values.yaml | grep -v contour | head -3); do
  echo "--- $f ---"
  yq e '.nodeSelector, .tolerations' "$f"
done
```

Confirm `node_pool_key` matches the cluster's actual style (`dedicated:` for standard GKE; `cloud.google.com/compute-class:` for Autopilot — `k8s-central-prd-ase1`, `k8s-dsgpu-prd-ase1`, `k8s-shared-int-ase1`). Mismatch → fail fast.

### 3. Generate `helm-overrides/<target_cluster>/<tool>/custom-values.yaml`

Skeleton:

```yaml
# Incubator: cluster=<target_cluster>, owner=<owner>, graduation-target=<date>   # only if incubator=true

image:
  registry: asia-southeast1-docker.pkg.dev
  repository: meesho-devops-admin-0622/admin/sre/<tool>
  tag: <image_tag>
  pullPolicy: IfNotPresent

replicaCount: 1                              # incubator default; raise after load profile

resources:
  requests:
    cpu: <cpu_request>
    memory: <memory_request>
  limits:
    cpu: <cpu_limit>
    memory: <memory_limit>

nodeSelector:
  <node_pool_key>: <node_pool_value>
tolerations:
  - key: <node_pool_key>
    value: <node_pool_value>
    effect: NoSchedule

# if persistence.enabled:
persistence:
  enabled: true
  storageClass: <storage_class>
  size: <size>
  accessModes: [ReadWriteOnce]

# if priority_class set:
priorityClassName: <priority_class>

serviceAccount:
  create: true
  name: <release_name>
  annotations: {}                            # add iam.gke.io/gcp-service-account if WI binding needed
```

### 4. Sidecar manifests (conditional)

- `needs_compute_class: true` → write `helm-overrides/<target_cluster>/<tool>/computeclass/<node_pool_value>.yaml`. `metadata.name` MUST equal `<node_pool_value>`. See [raw-manifest-sidecar-schema.md §ComputeClass](../../docs/platform/schemas/raw-manifest-sidecar-schema.md).
- `needs_external_dns: true` → write `helm-overrides/<target_cluster>/<tool>/external-dns-services/<svc>.yaml`. **Skip in incubator deploys.** See [raw-manifest-sidecar-schema.md §Service for external-dns binding](../../docs/platform/schemas/raw-manifest-sidecar-schema.md).
- `needs_external_secret: true` → write `helm-overrides/<target_cluster>/external-secrets/<release_name>.yaml`. Reference an existing `SecretStore` / `ClusterSecretStore`.

### 5. Validate

```bash
yamllint helm-overrides/<target_cluster>/<tool>/custom-values.yaml

helm template <release_name> helm-templates/<tool> \
  -f helm-overrides/<target_cluster>/<tool>/custom-values.yaml > /tmp/render.yaml

# Optional: dry-run sidecar manifests
kubectl --context=<ctx> --dry-run=server -f helm-overrides/<target_cluster>/<tool>/computeclass/ apply 2>/dev/null || true
```

`helm template` must succeed.

### 6. Open the values-side PR (this repo)

```bash
git checkout -b add-tool/<tool>-on-<target_cluster>
git add helm-overrides/<target_cluster>/<tool>/
git commit -m "Add <tool> to <target_cluster>"
git push origin add-tool/<tool>-on-<target_cluster>
gh pr create --base main --title "Add <tool> to <target_cluster>"
```

### 7. Open the sister-repo PR (Argo Application)

In `github.com/Meesho/devops-infra-argo-config`, draft an Application:

```yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: <sister_repo_app_name>
  namespace: argocd
spec:
  destination:
    name: <target_cluster>
    namespace: <workload_namespace>
  source:
    repoURL: https://github.com/Meesho/devops-infra-helm-charts.git
    targetRevision: main
    path: helm-overrides/<target_cluster>/<tool>
    helm:
      valueFiles: [custom-values.yaml]
  syncPolicy:
    syncOptions: [CreateNamespace=true]
    # NO automated.{prune,selfHeal} — manual sync per ADR-A5
```

PR-link the values-side PR in the description; PR-link the sister-repo PR back in the values-side PR description.

### 8. Hand off — do NOT Sync from this skill

Argo CD UI Sync is a human gate. The skill stops at "two PRs open with green CI." The user clicks Sync after both merge.

---

## Pattern Reference

- Recent onboardings to compare against: `git log --oneline --grep='Onboard\|Add' -i -- helm-overrides/ | head -10` and inspect the diffs.
- For Contour onboardings (multi-instance, scheduling-heavy): always cross-reference [contour-nodeselector-tolerations-summary.md](../../contour-nodeselector-tolerations-summary.md).
- For incubator-style first deploys: see [../../docs/platform/schemas/incubator-values-schema.md](../../docs/platform/schemas/incubator-values-schema.md).

---

## Gotchas (Layer constraints, common mistakes)

1. **Per-cluster scheduling is non-portable.** Never copy `nodeSelector` / `tolerations` / `computeClass` from another cluster — author from scratch using same-cluster siblings ([SANCTITY_RULES R5](../../docs/global/SANCTITY_RULES.md)).
2. **Vanilla-chart edits are forks.** If `helm-templates/<tool>/` is vanilla upstream, do not edit `templates/` or `values.yaml` to add knobs ([NEVER-DO](../../CLAUDE.md)). Wrap with a Meesho chart or upstream-PR.
3. **Never bypass TruffleHog.** No `--no-verify`, no `git commit -n`, no removing the hook. Real secrets via `ExternalSecret`.
4. **`fullnameOverride` is load-bearing.** Set deliberately or omit; never change later.
5. **`image.tag: latest` is forbidden.** Always pin.
6. **Sister-repo PR is mandatory.** Without an `Application`, the values do nothing on the cluster. Do not "ship just the values."
7. **Manual sync is the default for infra apps** — do not set `automated.{prune,selfHeal}: true` to "make it easier" ([ADR-A5](../../wiki/analyses/ADR-A5-manual-sync-default-for-infra.md)).
8. **`k8s-central-prd-ase1`, `k8s-dsgpu-prd-ase1`, `k8s-shared-int-ase1` are GKE Autopilot** — they use `cloud.google.com/compute-class:` not `dedicated:`.
9. **`db-*` clusters have minimal sibling apps** to compare scheduling against. Confirm with cluster owner before guessing.
10. **No production hostnames** as readiness probes / values URLs ([SANCTITY_RULES R3](../../docs/global/SANCTITY_RULES.md)).

---

## Layer constraint

Layer 1. Open both PRs; do not merge them; do not Sync. Reviewer + Argo CD UI Sync click are the human gates.

---

## Related

- Procedure: [../../docs/platform/procedures/onboard-app-to-cluster.md](../../docs/platform/procedures/onboard-app-to-cluster.md).
- Procedure: [../../docs/platform/procedures/onboard-new-cluster.md](../../docs/platform/procedures/onboard-new-cluster.md) — for brand-new clusters.
- Schema: [../../docs/platform/schemas/custom-values-schema.md](../../docs/platform/schemas/custom-values-schema.md).
- Schema: [../../docs/platform/schemas/incubator-values-schema.md](../../docs/platform/schemas/incubator-values-schema.md).
- Schema: [../../docs/platform/schemas/raw-manifest-sidecar-schema.md](../../docs/platform/schemas/raw-manifest-sidecar-schema.md).
- Skill: [onboard-app.md](onboard-app.md) — the existing peer skill (older variant; this skill supersedes for incubator-aware inputs).
- Boundaries: [../../docs/global/AGENT_BOUNDARIES.md](../../docs/global/AGENT_BOUNDARIES.md).