permissions-capabilities

What problem does it solve?

This skill reduces the risk of incorrect Kubernetes RBAC behavior by ensuring permission checks, capability descriptors, diagnostics, and UI action availability stay consistent across backend and frontend.

Core Features & Use Cases

• RBAC capability enforcement: Implement permission-gated backend and action services so mutating operations (delete, edit, scale, restart, suspend, YAML changes) only run when allowed.
• Concrete-object permission modeling: Validate that permission checks correctly use injected catalog-backed GVK/GVR/scope resolution rather than guessing resources from kinds.
• Permission-denied diagnostics: Keep permission-denied refresh domains visible in diagnostics and provide stable, feature-keyed permission reporting to help users understand why actions are blocked.
• Frontend action availability parity: Mirror backend capability rules in the UI via permission feature keys and an object action permission matrix, including derived action IDs that reuse backend mutations.
• Testing and safety: Add tests that cover allowed, denied, and resolution-error cases, including degraded visibility for restricted-RBAC behavior.

Quick Start

Use the permissions-capabilities skill to implement or update the backend permission gates and capability descriptors, then verify that the UI action availability and diagnostics reflect the same denied reasons across snapshot and refresh flows.