# Skill Examples Bootstrap

> Create or refresh a skill-examples Space with seed Units covering common Kubernetes resource types — a playground to exercise the other skills against. Use for "set up the skill-examples space", "bootstrap the examples", "give me a Unit to tinker with", "reset the examples". Not for creating real application Spaces (use confighub-core).

- **Type:** Skill
- **Install:** `agentstack add skill-confighub-confighub-skills-skill-examples-bootstrap`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [confighub](https://agentstack.voostack.com/s/confighub)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [confighub](https://github.com/confighub)
- **Source:** https://github.com/confighub/confighub-skills/tree/main/skills/skill-examples-bootstrap

## Install

```sh
agentstack add skill-confighub-confighub-skills-skill-examples-bootstrap
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# skill-examples-bootstrap

Creates a ConfigHub playground Space so users can exercise the other skills against a real, well-formed example.

## When to use

- User asks for a playground / example / sandbox to try ConfigHub against.
- User is new and needs something concrete to tinker with.
- `skill-examples` Space is missing or has been damaged and the user wants it back.
- User says "reset" or "refresh" the examples.

## Do not load for

- Creating real app Spaces (use `confighub-core` + direct `cub space create`).
- Setting up Triggers / policy (use `triggers-and-applygates`).
- Importing existing Helm or Kustomize configs (use `import`).

## What gets created

**Space:** `skill-examples`

**Units in that Space:**

- `hello-ns` — `v1/Namespace` named `hello`, with pod-security labels applied via `set-pod-security-defaults`.
- `hello-app` — `apps/v1/Deployment` + `v1/Service` bundle for a placeholder app listening on port 8080.
- `hello-statefulset` — `apps/v1/StatefulSet` + headless `v1/Service` for a PostgreSQL-like stateful workload with `volumeClaimTemplates`.
- `hello-daemonset` — `apps/v1/DaemonSet` for a node-exporter-style monitoring agent.
- `hello-job` — `batch/v1/Job` for a one-shot database migration.
- `hello-cronjob` — `batch/v1/CronJob` for a scheduled nightly backup.
- `hello-ingress` — `networking.k8s.io/v1/Ingress` with TLS termination.
- `hello-netpol` — `networking.k8s.io/v1/NetworkPolicy` pair: default-deny + explicit allow.
- `hello-rbac` — `v1/ServiceAccount` + `rbac.authorization.k8s.io/v1/Role` + `RoleBinding` bundle.
- `hello-hpa` — `autoscaling/v2/HorizontalPodAutoscaler` targeting `hello-app`.
- `hello-pdb` — `policy/v1/PodDisruptionBudget` protecting `hello-app`.

All workload Units get the defaults chain: `set-container-resources-defaults`, `set-container-probe-defaults`, `set-pod-container-security-context-defaults`, `ensure-namespaces`.

Every mutation call passes `--change-desc` with the user prompt verbatim so the revision history demonstrates provenance end-to-end.

## Preflight gates

1. `cub auth status` succeeds — it contacts the server's `/me` endpoint to confirm the token is still valid (not just local login state). If it fails, ask the user to run `cub auth login` (an interactive browser sign-in an agent cannot complete).
2. Confirm with the user: is this a first-time bootstrap, or a refresh? A refresh preserves the Space but re-runs the recipe against the existing Units.

## The loop

### 1. Detect existing state

```bash
cub space get skill-examples 2>/dev/null
cub unit list --space skill-examples 2>/dev/null
```

Branch:

- **Space missing** → go to step 2 (full bootstrap).
- **Space present, Units missing** → skip space create, go to step 3.
- **Space + Units present** → go to step 4 (re-apply defaults; idempotent).

### 2. Create the Space

```bash
cub space create skill-examples
```

`cub space create` does not accept `--change-desc`; Spaces aren't versioned data.

### 3. Upload example Units

Example YAML files are stored in `skills/skill-examples-bootstrap/examples/`. Each file maps to one Unit:

| File                     | Unit slug           | Contents                                |
| ------------------------ | ------------------- | --------------------------------------- |
| `hello-ns.yaml`          | `hello-ns`          | Namespace                               |
| `hello-app.yaml`         | `hello-app`         | Deployment + Service bundle             |
| `hello-statefulset.yaml` | `hello-statefulset` | StatefulSet + headless Service          |
| `hello-daemonset.yaml`   | `hello-daemonset`   | DaemonSet                               |
| `hello-job.yaml`         | `hello-job`         | Job                                     |
| `hello-cronjob.yaml`     | `hello-cronjob`     | CronJob                                 |
| `hello-ingress.yaml`     | `hello-ingress`     | Ingress with TLS                        |
| `hello-netpol.yaml`      | `hello-netpol`      | default-deny + allow NetworkPolicy pair |
| `hello-rbac.yaml`        | `hello-rbac`        | ServiceAccount + Role + RoleBinding     |
| `hello-hpa.yaml`         | `hello-hpa`         | HorizontalPodAutoscaler                 |
| `hello-pdb.yaml`         | `hello-pdb`         | PodDisruptionBudget                     |

Upload each:

```bash
for slug in hello-ns hello-app hello-statefulset hello-daemonset hello-job \
            hello-cronjob hello-ingress hello-netpol hello-rbac hello-hpa hello-pdb; do
  cub unit create --space skill-examples "$slug" \
    "skills/skill-examples-bootstrap/examples/${slug}.yaml" \
    --merge-external-source "confighub-skills/skills/skill-examples-bootstrap/examples/${slug}.yaml" \
    --change-desc "Seed ${slug} for the skill-examples playground.

User prompt: 
Clarifications: "
done
```

### 4. Apply the defaults chain

Each function call is hermetic and idempotent, so re-running on an already-seeded Space produces no-op revisions (and no noise in the history if nothing changes).

On workload Units (`hello-app`, `hello-statefulset`, `hello-daemonset`, `hello-job`, `hello-cronjob`):

```bash
for slug in hello-app hello-statefulset hello-daemonset hello-job hello-cronjob; do
  for fn in set-container-resources-defaults set-container-probe-defaults \
            set-pod-container-security-context-defaults ensure-namespaces; do
    cub function set --space skill-examples --unit "$slug" \
      --change-desc "Apply $fn to $slug.

User prompt: 
Clarifications: " \
      -- "$fn"
  done
done
```

On `hello-ns`:

```bash
cub function set --space skill-examples --unit hello-ns \
  --change-desc "Apply pod-security labels to hello namespace.

User prompt: 
Clarifications: " \
  -- set-pod-security-defaults
```

On non-workload Units that have namespaced resources (`hello-ingress`, `hello-netpol`, `hello-rbac`, `hello-hpa`, `hello-pdb`):

```bash
for slug in hello-ingress hello-netpol hello-rbac hello-hpa hello-pdb; do
  cub function set --space skill-examples --unit "$slug" \
    --change-desc "Apply ensure-namespaces to $slug.

User prompt: 
Clarifications: " \
    -- ensure-namespaces
done
```

On `hello-rbac`, also disable auto-mounted service account tokens:

```bash
cub function set --space skill-examples --unit hello-rbac \
  --change-desc "Disable automountServiceAccountToken on hello-rbac ServiceAccount.

User prompt: 
Clarifications: " \
  -- set-automount-service-account-token-false
```

### 5. Show the user what to do next

Point them at the GUI and the other skills:

- `cub unit list --space skill-examples` — overview of all seeded Units.
- `cub unit get hello-app --space skill-examples --web` — inspect the final literal YAML.
- `cub revision list hello-app --space skill-examples --web` — see the provenance chain.
- Suggest a concrete next move: "Try `cub-mutate` to bump the image tag", "Try `cub-query` to find all Deployments in `skill-examples`", "Set up `triggers-and-applygates` against `skill-examples` to see an ApplyGate in action", "Use `kubernetes-resources` to create a new resource — it'll pull from these examples."

## Tool boundary

- Allowed: `cub` read + create/update + `function do` (per frontmatter).
- Not allowed: `cub * delete *` (users who want to clean up should do it explicitly), any mutating `kubectl`, any `helm`/`kustomize`.

## Stop conditions

- User is not authenticated (`cub auth status` fails). Tell them to run `cub auth login`.
- User lacks permission to create Spaces in the current organization.

## Verify chain

1. `cub space get skill-examples` — Space exists.
2. `cub unit list --space skill-examples` — all 11 Units present.
3. `cub unit get hello-app --space skill-examples -o yaml` — YAML contains `resources.requests`, all three probes, `securityContext`, and `namespace: confighubplaceholder`.
4. `cub unit get hello-statefulset --space skill-examples -o yaml` — StatefulSet has `volumeClaimTemplates` and headless Service has `clusterIP: None`.
5. `cub revision list hello-app --space skill-examples` — revision history includes the defaults functions with user-prompt-bearing change descriptions.

## Evidence

- `cub space get skill-examples --web` — Space overview.
- `cub unit get hello-app --space skill-examples --web` — literal Unit YAML.
- `cub revision list hello-app --space skill-examples --web` — provenance chain.

## References

- `references/cub-cli.md` — CLI discipline + Read/Write permission sets.
- `references/yaml-patterns.md` — what makes the scaffolded YAML "good" literal YAML.
- `references/functions-catalog.md` — defaults functions used.
- Companion skill: `confighub-core` — the doctrine this recipe demonstrates.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [confighub](https://github.com/confighub)
- **Source:** [confighub/confighub-skills](https://github.com/confighub/confighub-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-confighub-confighub-skills-skill-examples-bootstrap
- Seller: https://agentstack.voostack.com/s/confighub
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.