chore(deps): update agent skills (plugins/gitops-kubernetes/skills/gitops-cluster-debug)

.claude-plugin/marketplace.json

@@ -15,7 +15,7 @@
     {
       "name": "gitops-kubernetes",
       "description": "Flux CD debugging, knowledge, and tenant onboarding — skills plus the Flux MCP server and a read-only Flux troubleshooter agent for live-cluster debugging",
-      "version": "1.0.3",
+      "version": "1.0.4",
       "source": "./plugins/gitops-kubernetes"
     },
     {

.github/plugin/marketplace.json

@@ -15,7 +15,7 @@
     {
       "name": "gitops-kubernetes",
       "description": "Flux CD debugging, knowledge, and tenant onboarding — skills plus the Flux MCP server and a read-only Flux troubleshooter agent for live-cluster debugging",
-      "version": "1.0.3",
+      "version": "1.0.4",
       "source": "./plugins/gitops-kubernetes"
     },
     {

plugins/gitops-kubernetes/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "gitops-kubernetes",
   "description": "Flux CD debugging, knowledge, and tenant onboarding — skills plus the Flux MCP server and a read-only Flux troubleshooter agent for live-cluster debugging",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "author": {
     "name": "devantler-tech",
     "url": "https://github.com/devantler-tech"

plugins/gitops-kubernetes/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog — `gitops-kubernetes`
 
+## 1.0.4 — 2026-10-27
+
+**Changed** — sync `gitops-cluster-debug` from `https://github.com/fluxcd/agent-skills` at `refs/tags/v0.4.0`.
+
 ## 1.0.3 — 2026-10-24
 
 **Added** — `resources/THIRD-PARTY-NOTICES.md` records the upstream license, copyright notice

plugins/gitops-kubernetes/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "gitops-kubernetes",
   "description": "Flux CD debugging, knowledge, and tenant onboarding — skills plus the Flux MCP server and a read-only Flux troubleshooter agent for live-cluster debugging",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "author": {
     "name": "devantler-tech",
     "url": "https://github.com/devantler-tech"

plugins/gitops-kubernetes/skills/gitops-cluster-debug/assets/schemas/alert-notification-v1.fields.txt

@@ -0,0 +1,19 @@
+# schema source: Flux v2.10.0 https://github.com/fluxcd/flux2
+apiVersion <string> enum=notification.toolkit.fluxcd.io/v1
+kind <string> enum=Alert
+metadata.name <string> (required)
+metadata.namespace <string> (required)
+spec <object>	# AlertSpec defines an alerting rule for events involving a list of objects.
+spec.eventMetadata <map[string]string>	# EventMetadata adds metadata to events. Sources, from lowest to highest precedence: `event.toolkit.fluxcd.io/` annotations on the involved object, Alert `.spec.eventMetadata`, and controller-defined `<controller group>.toolkit.fluxcd.io/` event metadata. Higher precedence wins; conflicts produce an info log and a Warning Event. See the Alert API docs (Event metadata section).
+spec.eventSeverity <string> enum=info|error default="info"	# EventSeverity specifies how to filter events based on severity. If set to 'info' no events will be filtered.
+spec.eventSources <[]object> (required)	# EventSources specifies how to filter events based on the involved object kind, name and namespace.
+spec.eventSources[].apiVersion <string>	# API version of the referent
+spec.eventSources[].kind <string> (required) enum=Bucket|GitRepository|Kustomization|HelmRelease|HelmChart|HelmRepository|ImageRepository|ImagePolicy|ImageUpdateAutomation|OCIRepository|ArtifactGenerator|ExternalArtifact|FluxInstance|ResourceSet|ResourceSetInputProvider	# Kind of the referent
+spec.eventSources[].matchLabels <map[string]string>	# MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. MatchLabels requires the name to be set to `*`.
+spec.eventSources[].name <string> (required) min=1 max=253	# Name of the referent If multiple resources are targeted `*` may be set.
+spec.eventSources[].namespace <string> min=1 max=253	# Namespace of the referent
+spec.exclusionList <[]string>	# ExclusionList specifies a list of Golang regular expressions to be used for excluding messages.
+spec.inclusionList <[]string>	# InclusionList specifies a list of Golang regular expressions to be used for including messages.
+spec.providerRef <object> (required)	# ProviderRef specifies which Provider this Alert should use.
+spec.providerRef.name <string> (required)	# Name of the referent.
+spec.suspend <boolean>	# Suspend tells the controller to suspend subsequent events handling for this Alert.

plugins/gitops-kubernetes/skills/gitops-cluster-debug/assets/schemas/alert-notification-v1beta3.fields.txt

@@ -1,5 +1,5 @@
-# schema source: Flux v2.9.4 https://github.com/fluxcd/flux2
-apiVersion <string> enum=notification.toolkit.fluxcd.io/v1beta3
+# schema source: Flux v2.10.0 https://github.com/fluxcd/flux2
+apiVersion <string> enum=notification.toolkit.fluxcd.io/v1beta3 (deprecated)	# v1beta3 Alert is deprecated, upgrade to v1
 kind <string> enum=Alert
 metadata.name <string> (required)
 metadata.namespace <string> (required)

plugins/gitops-kubernetes/skills/gitops-cluster-debug/assets/schemas/artifactgenerator-source-v1beta1.fields.txt

@@ -1,4 +1,4 @@
-# schema source: Flux v2.9.4 https://github.com/fluxcd/flux2
+# schema source: Flux v2.10.0 https://github.com/fluxcd/flux2
 apiVersion <string> enum=source.extensions.fluxcd.io/v1beta1
 kind <string> enum=ArtifactGenerator
 metadata.name <string> (required)
@@ -8,15 +8,32 @@ spec.artifacts <[]object> (required) min=1 max=1000	# OutputArtifacts is a list
 spec.artifacts[].copy <[]object> (required) min=1	# Copy defines a list of copy operations to perform from the sources to the generated artifact. The copy operations are performed in the order they are listed with existing files being overwritten by later copy operations.
 spec.artifacts[].copy[].exclude <[]string> max=100	# Exclude specifies a list of glob patterns to exclude files and dirs matched by the 'From' field. Patterns are matched against paths relative to the source alias root or to the non-glob prefix of 'From'. Patterns without a separator (e.g. "*.md") match the file name at any depth.
 spec.artifacts[].copy[].from <string> (required) pattern="^@([a-z0-9]([a-z0-9_-]*[a-z0-9])?)/(.*)$" min=1 max=1024	# From specifies the source (by alias) and the glob pattern to match files. The format is "@<alias>/<glob-pattern>". When pathPattern is set, the path may use capture placeholders such as "{app}".
+spec.artifacts[].copy[].optional <boolean>	# Optional, when set to true, allows the copy operation to silently skip when the source path or glob pattern matches no files. When false (default), the reconciliation fails with an error if no files are matched.
 spec.artifacts[].copy[].strategy <string> enum=Overwrite|Merge|Extract	# Strategy specifies the copy strategy to use. 'Overwrite' will overwrite existing files in the destination. 'Merge' is for merging YAML files using Helm values merge strategy. 'Extract' is for extracting the contents of tarball archives (.tar.gz, .tgz) When using glob patterns, non-tarball files are silently skipped. For single file sources, the file must be a tarball or an error is returned. Directories are not supported. If not specified, defaults to 'Overwrite'.
 spec.artifacts[].copy[].to <string> (required) pattern="^@artifact/([^/]{0,1}|[^./][^/]|[.][^./]|[^/]{3,})(/([^/]{0,1}|[^./][^/]|[.][^./]|[^/]{3,}))*$" min=1 max=1024	# To specifies the destination path within the artifact. The format is "@artifact/path", the alias "artifact" refers to the root path of the generated artifact. When pathPattern is set, the path may use capture placeholders such as "{app}".
-spec.artifacts[].name <string> (required) min=1 max=253	# Name is the name of the generated artifact. When pathPattern is set, this field may use capture placeholders such as "{app}".
+spec.artifacts[].inputsFrom <string> pattern="^@([a-z0-9]([a-z0-9_-]*[a-z0-9])?)/(.*)$" min=1 max=1024	# InputsFrom specifies a source path to a YAML file whose contents are exported in the ExternalArtifact .status.exportedInputs field. The format is "@<alias>/<path>", where <alias> references a source or "artifact" for the generated artifact itself. When pathPattern is set, the path may use capture placeholders such as "{module}".
+spec.artifacts[].name <string> (required) max=1024	# Name is the name of the generated artifact. When pathPattern is set, this field may use capture placeholders such as "{app}". The maximum length accommodates capture placeholders; the effective limits are enforced by the CEL validation when pathPattern is not set.
+spec.artifacts[].namespace <string> max=1024	# Namespace is the namespace of the generated artifact. If not provided, defaults to the same namespace as the ArtifactGenerator. When pathPattern is set, this field may use capture placeholders such as "{app}". The credentials used to reconcile the artifact are described in .spec.serviceAccountName: an explicit ServiceAccount applies to every generated artifact, while the --default-service-account flag only applies to artifacts in a namespace other than the ArtifactGenerator namespace. The maximum length accommodates capture placeholders; the effective limits are enforced by the CEL validation when pathPattern is not set.
 spec.artifacts[].originRevision <string> pattern="^@([a-z0-9]([a-z0-9_-]*[a-z0-9])?)$" max=64	# OriginRevision is used to set the 'org.opencontainers.image.revision' annotation on the generated artifact metadata. If specified, it must point to an existing source alias in the format "@<alias>". If the referenced source has an origin revision (e.g. a Git commit SHA), it will be used to set the annotation on the generated artifact. If the referenced source does not have an origin revision, the field is ignored.
 spec.artifacts[].revision <string> pattern="^@([a-z0-9]([a-z0-9_-]*[a-z0-9])?)$" max=64	# Revision is the revision of the generated artifact. If specified, it must point to an existing source alias in the format "@<alias>". If not specified, the revision is automatically set to the digest of the artifact content.
 spec.commonMetadata <object>	# CommonMetadata specifies the common labels and annotations that are applied to all resources. Any existing label or annotation will be overridden if its key matches a common one.
 spec.commonMetadata.annotations <map[string]string>	# Annotations to be added to the object's metadata.
 spec.commonMetadata.labels <map[string]string>	# Labels to be added to the object's metadata.
+spec.managedNamespaces <object>	# ManagedNamespaces defines how the controller manages the namespaces targeted by the generated artifacts. When omitted, the target namespaces are unmanaged: they must already exist and are left untouched.
+spec.managedNamespaces.allowedNames <[]string> (required) min=1	# AllowedNames is a list of CEL expressions that define the set of namespaces the ArtifactGenerator agrees to manage. Each expression receives the namespace name through the 'ns' string variable and must return a boolean. A namespace is managed only when at least one expression returns true. The 'default', 'kube-system', 'kube-public' and 'flux-system' namespaces are always rejected, regardless of the expressions.
+spec.managedNamespaces.metadata <object>	# Metadata defines how the metadata of the desired namespaces is built, on top of .spec.commonMetadata.
+spec.managedNamespaces.metadata.from <[]object>	# From is a list of metadata operations applied in order to the desired namespaces, on top of .spec.commonMetadata and .fromSource.
+spec.managedNamespaces.metadata.from[].annotations <map[string]string>	# Annotations to be applied to the namespace.
+spec.managedNamespaces.metadata.from[].labels <map[string]string>	# Labels to be applied to the namespace.
+spec.managedNamespaces.metadata.from[].namespace <string> (required) pattern="^(\\*|[a-z0-9]([-a-z0-9]*[a-z0-9])?)$" max=63	# Namespace is the name of the desired namespace the metadata applies to, or '*' to apply the metadata to all desired namespaces.
+spec.managedNamespaces.metadata.from[].strategy <string> (required) enum=Reset|Override|Merge	# Strategy specifies how the labels and annotations are applied. 'Reset' clears all the existing labels and annotations before applying the ones defined in the operation (fields that are not set clear the corresponding metadata), 'Override' merges the ones defined in the operation into the existing values, overriding existing keys, while 'Merge' merges only the absent keys, preserving existing values.
+spec.managedNamespaces.metadata.fromSource <object>	# FromSource sources namespace metadata from a NamespaceMetadata file inside a source artifact.
+spec.managedNamespaces.metadata.fromSource.allowedAnnotations <map[string]string>	# AllowedAnnotations is a schema for the annotations that the NamespaceMetadata file is allowed to set. Each key is an annotation key and each value is a CEL expression that receives the annotation value through the 'value' string variable and must return a boolean. Annotations whose key is not present in this map are ignored, while annotations whose value does not satisfy the respective expression are rejected. The expressions are compiled, so a malformed expression or one that does not return a boolean fails validation at the start of the reconciliation.
+spec.managedNamespaces.metadata.fromSource.allowedLabels <map[string]string>	# AllowedLabels is a schema for the labels that the NamespaceMetadata file is allowed to set. Each key is a label key and each value is a CEL expression that receives the label value through the 'value' string variable and must return a boolean. Labels whose key is not present in this map are ignored, while labels whose value does not satisfy the respective expression are rejected. The expressions are compiled, so a malformed expression or one that does not return a boolean fails validation at the start of the reconciliation.
+spec.managedNamespaces.metadata.fromSource.path <string> (required) pattern="^@([a-z0-9]([a-z0-9_-]*[a-z0-9])?)/(.*)$" min=1 max=1024	# Path is the path to the NamespaceMetadata file inside a source artifact, in the format "@<alias>/<path>". When pathPattern is set, the path may use capture placeholders such as "{namespace}". Only namespace-level captures are allowed, so that every artifact targeting a namespace resolves to the same file.
+spec.managedNamespaces.prune <boolean> (required)	# Prune specifies whether the controller deletes managed namespaces that are no longer targeted by any generated artifact, or when the ArtifactGenerator is deleted.
 spec.pathPattern <string> pattern="^@([a-z0-9]([a-z0-9_-]*[a-z0-9])?)/(.*)$" max=1024	# PathPattern specifies a directory traversal pattern to match within the sources. The format is "@<alias>/<pattern>". Named captures in the pattern (e.g. "{app}") can be used as placeholders in OutputArtifacts fields.
+spec.serviceAccountName <string> pattern="^[a-z0-9]([-a-z0-9]*[a-z0-9])?$" min=1 max=63	# ServiceAccountName is the name of the ServiceAccount used to authorize the reconciliation of the generated ExternalArtifacts and the managed Namespaces. The name is resolved in the ArtifactGenerator namespace. When specified, the controller checks this ServiceAccount with SubjectAccessReview for every namespace targeted by the generated ExternalArtifacts, including the ArtifactGenerator namespace, and its RBAC bindings determine the namespaces in which they can be created, updated and deleted. When not specified, the controller uses its own credentials for ExternalArtifacts in the ArtifactGenerator namespace, and the ServiceAccount configured with the --default-service-account flag (when set) for artifacts targeting another namespace. Namespace management (.spec.managedNamespaces) always requires a ServiceAccount for authorization, so either this field or the --default-service-account flag must be set; otherwise the reconciliation fails with a terminal error. The controller performs the namespace operations with its own credentials.
 spec.sources <[]object> (required) min=1 max=1000	# Sources is a list of references to the Flux source-controller resources that will be used to generate the artifact.
 spec.sources[].alias <string> (required) pattern="^[a-z0-9]([a-z0-9_-]*[a-z0-9])?$" max=63	# Alias of the source within the ArtifactGenerator context. The alias must be unique per ArtifactGenerator, and must consist of lower case alphanumeric characters, underscores, and hyphens. It must start and end with an alphanumeric character.
 spec.sources[].kind <string> (required) enum=Bucket|GitRepository|OCIRepository|HelmChart|ExternalArtifact	# Kind of the source.
@@ -30,10 +47,11 @@ status.conditions[].observedGeneration <integer> format=int64 min=0	# observedGe
 status.conditions[].reason <string> (required) pattern="^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$" min=1 max=1024	# reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
 status.conditions[].status <string> (required) enum=True|False|Unknown	# status of the condition, one of True, False, Unknown.
 status.conditions[].type <string> (required) pattern="^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$" max=316	# type of condition in CamelCase or in foo.example.com/CamelCase.
-status.inventory <[]object>	# Inventory contains the list of generated ExternalArtifact references.
-status.inventory[].digest <string> (required)	# Digest of the referent artifact.
-status.inventory[].filename <string> (required)	# Filename is the name of the artifact file.
-status.inventory[].name <string> (required)	# Name of the referent artifact.
-status.inventory[].namespace <string> (required)	# Namespace of the referent artifact.
+status.inventory <[]object>	# Inventory contains the list of objects managed by the ArtifactGenerator, such as the generated ExternalArtifacts and the managed Namespaces.
+status.inventory[].digest <string> (required)	# Digest of the referent object. For generated artifacts this is the artifact content digest; for managed namespaces this is a digest of the metadata applied by the controller.
+status.inventory[].filename <string>	# Filename is the name of the artifact file.
+status.inventory[].kind <string> enum=ExternalArtifact|Namespace	# Kind is the kind of the referent object.
+status.inventory[].name <string> (required)	# Name of the referent object.
+status.inventory[].namespace <string>	# Namespace of the referent object. Empty for cluster-scoped objects.
 status.lastHandledReconcileAt <string>	# LastHandledReconcileAt holds the value of the most recent reconcile request value, so a change of the annotation value can be detected.
 status.observedSourcesDigest <string>	# ObservedSourcesDigest is a hash representing the current state of all the sources referenced by the ArtifactGenerator.