A structured YAML prompt that acts as a senior SRE. It turns a short description of your service into user-centric SLIs and SLOs, error budget math, multi-window burn-rate alerts, and an error budget policy, all returned as YAML you can drop into a repo.
1role: >2 You are a senior Site Reliability Engineer who designs Service Level Objectives3 (SLOs) that match what users actually experience. You favor a few meaningful4 objectives over many vanity metrics, and you turn every SLO into an error5 budget policy and alerts a team can act on.67task: >8 Design user-centric SLIs, SLOs, error budgets, burn-rate alerts, and an error9 budget policy for the service described in the inputs. Then return the result10 in the exact YAML output schema below....+85 more lines
Opinionated conventions for writing, reviewing and applying Terraform infrastructure as code safely.
# Terraform taste of a cloud platform engineer - Pin the Terraform version and every provider version, and commit .terraform.lock.hcl. Confidence: 0.95 - Store state remotely with locking enabled, for example S3 with DynamoDB or Terraform Cloud. Confidence: 0.95 - Split state per environment and per system so one apply never touches everything. Confidence: 0.90 - Use separate directories per environment instead of Terraform workspaces for prod and staging. Confidence: 0.75 - Keep modules small and focused on one concern, such as a network or a database. Confidence: 0.85 - Pin module sources to a tag or version, never to a moving branch. Confidence: 0.90 - Give every variable a type and a description, and add validation blocks for risky inputs. Confidence: 0.85 - Expose only the outputs that other stacks actually consume. Confidence: 0.70 - Name resources in snake_case and avoid repeating the resource type in the name. Confidence: 0.75 - Apply a shared tag set (owner, environment, cost center) through provider default_tags. Confidence: 0.85 - Prefer for_each over count so adding or removing an item does not reshuffle addresses. Confidence: 0.90 - Use moved blocks for refactors instead of manual terraform state mv. Confidence: 0.85 - Bring existing resources in with import blocks that are reviewed in a pull request. Confidence: 0.80 - Run terraform fmt, validate and tflint in CI on every pull request. Confidence: 0.90 - Post the terraform plan output as a pull request comment for review. Confidence: 0.85 - Apply only from CI using the reviewed plan file, never from a laptop. Confidence: 0.85 - Authenticate CI to the cloud with OIDC instead of long-lived access keys. Confidence: 0.90 - Never put secrets in tfvars; read them from a secrets manager at apply time. Confidence: 0.90 - Use prevent_destroy on stateful resources like databases and buckets. Confidence: 0.80 - Scan configurations with a policy tool such as checkov or tfsec before merging. Confidence: 0.75 - Avoid provisioners and local-exec; hand configuration off to images or config tools. Confidence: 0.80 - Run a scheduled plan to detect drift and alert when it is not empty. Confidence: 0.75 - Keep data sources for lookups and avoid hardcoding IDs or ARNs. Confidence: 0.80
Opinionated conventions for deploying, securing and operating workloads on Kubernetes clusters.
# Kubernetes taste of a platform team - Deploy everything through GitOps (Argo CD or Flux); nobody runs kubectl apply against production by hand. Confidence: 0.90 - Package shared services with Helm or Kustomize, but keep per-environment overlays small and readable. Confidence: 0.80 - Set CPU and memory requests on every container, and set a memory limit equal to the request. Confidence: 0.90 - Avoid CPU limits on latency-sensitive services; rely on requests and node sizing to prevent throttling. Confidence: 0.70 - Give every Deployment a readiness probe; add a liveness probe only when the app can truly deadlock. Confidence: 0.85 - Use a startup probe for slow-booting apps instead of a long initialDelaySeconds on liveness. Confidence: 0.80 - Run at least two replicas behind a PodDisruptionBudget for anything users depend on. Confidence: 0.90 - Spread replicas across zones with topologySpreadConstraints. Confidence: 0.80 - Pin images by digest or an immutable version tag, never latest. Confidence: 0.95 - Run containers as non-root with a read-only root filesystem and all capabilities dropped. Confidence: 0.90 - Enforce the restricted Pod Security Standard on application namespaces. Confidence: 0.80 - Start every namespace with a default-deny NetworkPolicy and open only the flows you need. Confidence: 0.80 - Give each workload its own ServiceAccount and disable token automount when it never calls the API server. Confidence: 0.85 - Keep secrets out of Git; sync them from a secret manager with External Secrets or use Sealed Secrets. Confidence: 0.90 - Use one namespace per team or per app, with a ResourceQuota and a LimitRange. Confidence: 0.80 - Apply the standard app.kubernetes.io labels to every resource. Confidence: 0.75 - Handle SIGTERM and add a short preStop sleep so in-flight requests drain before shutdown. Confidence: 0.85 - Scale stateless services with the HorizontalPodAutoscaler on CPU or a real request-rate metric. Confidence: 0.75 - Run databases on a managed cloud service rather than StatefulSets unless there is a strong reason. Confidence: 0.80 - Validate manifests in CI with kubeconform and a policy engine such as Kyverno or OPA Gatekeeper. Confidence: 0.80 - Keep clusters within two minor versions of the latest Kubernetes release and upgrade on a schedule. Confidence: 0.75 - Expose HTTP services through one shared ingress or Gateway API controller, not a LoadBalancer per service. Confidence: 0.75
