Agentic skill pack for Red Hat OpenShift

Automation capabilities for OpenShift Container Platform cluster management, workload orchestration, security validation...

Module: ocp-admin · v0.1.0 · OpenShift Administrator, Security Engineer, DevSecOps

Categories: Red Hat, Openshift, Administration, Management, Security, Container Security, Vulnerability Management

Overview

The ocp-admin collection covers Assisted Installer cluster creation, multi-cluster discovery across self-managed and managed
OpenShift, kubeconfig-backed fleet health reporting, and security validation for Red Hat container images and CoreOS using
official SBOMs and VEX data. Use AGENTS.md intent routing to pick the right skill.

MCP

Server Role
openshift-self-managed Assisted Installer API for self-managed cluster lifecycle (OCP, SNO).
openshift-ocm-managed OpenShift Cluster Manager API for managed service clusters (ROSA, ARO, OSD).
openshift-administration Kubernetes/OpenShift operations for multi-context fleet reports; read-only where applicable.

Configure servers through mcps.json; skills must be invoked instead of calling MCP tools directly from the agent.

Quick Start

Deploy and use

Note: This skill pack is released as Developer Preview. Developer Preview features provide early access to functionality in advance of possible inclusion in a Red Hat product offering. For more information about the support scope of Red Hat Developer Preview features, see Developer Preview Support Scope.

Prerequisites

Step 1: Install the skill pack

# Add the Red Hat Agentic marketplace (one-time setup)
lola market add rh-agentic-plugins https://raw.githubusercontent.com/RHEcosystemAppEng/agentic-catalog/main/marketplace/rh-agentic-collection.yml

# Install the ocp-admin pack (replace claude-code with your AI assistant)
# Valid targets: claude-code, copilot-cli, copilot-vscode, cursor, opencode
lola install ocp-admin -a claude-code

This installs the skills, the instructions file, and the MCP server definitions into your project.

Verify the installation:

lola list

Step 2: Configure environment variables

The pack uses three MCP servers, each requiring specific credentials passed as environment variables. Never hardcode tokens or paths — always use environment variables.

For cluster creation and inventory (openshift-self-managed, openshift-ocm-managed):

  1. Go to https://cloud.redhat.com/openshift/token
  2. Click Load token → Copy to clipboard
  3. Export it:
export OFFLINE_TOKEN="<your-token>"

For cluster operations and reporting (openshift-administration):

export KUBECONFIG="/path/to/your/kubeconfig"

Step 3: Use the skills

The pack provides 7 skills. See the ocp-admin README for the full list with descriptions and usage examples.

Uninstall

Remove the skill pack from your project:

lola uninstall ocp-admin

To also remove the marketplace registry:

lola market rm rh-agentic-plugins

Skills

Evaluation coverage: 2 of 8 skills evaluated (25.0%)
Moderate confidence - based on 6 trials.
Last evaluated: 2026-05-12T11:05:34.424536Z

The pack provides eight skills for cluster lifecycle, fleet visibility, security validation, and network
security on OpenShift, using Assisted Installer and OCM APIs for cluster management, read-only cluster APIs
for consolidated reports, Python helper scripts for CVE/SBOM/VEX-based security validation, and MCP-based
NetworkPolicy design with live cluster verification.

Skills

  1. /cluster-creator - End-to-end OpenShift cluster creation using Red Hat Assisted Installer (SNO and HA; bare metal, vSphere, OCI, Nutanix).

    Create and install OpenShift clusters through Assisted Installer with validation, host networking, and progress monitoring.
    Use when:
    - "Create a new OpenShift cluster"
    - "Install OpenShift on my servers"
    - "Set up a single-node cluster"
    What it does:
    - Drives Assisted Installer flows with explicit approval for VIPs, host roles, and install triggers.
    - Surfaces installation events and validation errors until the cluster reaches ready state.

    View SKILL.md →
  2. /cluster-inventory - List and inspect OpenShift clusters across self-managed (OCP, SNO) and managed service (ROSA, ARO, OSD) deployments.

    List clusters, versions, platforms, and status from OCM and Assisted Installer contexts using a single offline token workflow.
    Use when:
    - "List all clusters"
    - "Show cluster status"
    - "What clusters are available?"
    What it does:
    - Returns identifiers, versions, platforms, and creation metadata for fleet visibility.
    - Separates self-managed versus managed-service clusters for the right API path.

    This skill performed 9.1% better than vanilla Claude Sonnet 4.6 across 3 evaluation runs.
    ✓PASSLOW confidence
    3 of 8 scenarios tested (37.5%)
    Last evaluated: 105d ago (stale)Model: Claude Sonnet 4.6 (vertex_ai)
    ✓ Latest verified execution
    PASS - reward 0.91 - 105d ago
    ocp-admin-cluster-inventory__NKpHW3U
    View execution detailsRaw report (JSON)
    Technical evaluation detailsCoverage, experiments, reproducibility, and raw evaluation artifactsCoverage 3 / 8Pass rate 100%Reward 0.85Improvement +9.1%Confidence Low

    Coverage

    3 / 8

    scenarios tested (37.5%)

    Pass rate (treatment)

    100%

    3 pass · 0 fail

    Reward (treatment)

    0.85

    mean reward

    Improvement vs baseline

    +9.1%

    (+0.09 reward)

    Statistical significance

    Low

    (insufficient data)

    Comparison (mean reward)

    Treatment
    0.85
    Baseline (control)
    0.76

    Experiment

    • Trials: 3/3 (treatment/control)
    • Treatment: 3 pass / 0 fail
    • Control: 3 pass / 0 fail
    • Statistical significance: low (insufficient data)
    ✓ Latest verified execution
    PASS - reward 0.91 - 105d ago
    ocp-admin-cluster-inventory__NKpHW3U
    View execution detailsRaw report (JSON)
    Reproducibility
    PipelineCommitGeneratedRelated PR
    abevalflow-dqzcra4449e2a 🔗2026-05-08T09:32:05.288688Z#28 🔗
    View SKILL.md →
  3. /cluster-report - Consolidated health report across kubeconfig contexts, skipping non-OpenShift contexts by default.

    Aggregate node, namespace, and workload signals across contexts that resolve to real OpenShift clusters.
    Use when:
    - "Health report across clusters"
    - "Fleet summary from kubeconfig"
    - "Compare resource usage between contexts"
    What it does:
    - Verifies each context is OpenShift before collecting metrics to avoid kube API errors.
    - Summarizes capacity, GPU presence, and pod health for operations review.

    This skill performed 63.6% better than vanilla Claude Sonnet 4.6 across 3 evaluation runs.
    ✓PASSLOW confidence
    3 of 8 scenarios tested (37.5%)
    Last evaluated: 101d ago (stale)Model: Claude Sonnet 4.6 (vertex_ai)
    ✓ Latest verified execution
    PASS - reward 0.91 - 101d ago
    ocp-admin-cluster-report__qSvNkzV
    View execution detailsRaw report (JSON)
    Technical evaluation detailsCoverage, experiments, reproducibility, and raw evaluation artifactsCoverage 3 / 8Pass rate 100%Reward 0.91Improvement +63.6%Confidence Low

    Coverage

    3 / 8

    scenarios tested (37.5%)

    Pass rate (treatment)

    100%

    3 pass · 0 fail

    Reward (treatment)

    0.91

    mean reward

    Improvement vs baseline

    +63.6%

    (+0.64 reward)

    Statistical significance

    Low

    (insufficient data)

    Comparison (mean reward)

    Treatment
    0.91
    Baseline (control)
    0.27

    Experiment

    • Trials: 3/3 (treatment/control)
    • Treatment: 3 pass / 0 fail
    • Control: 1 pass / 2 fail
    • Statistical significance: low (insufficient data)
    ✓ Latest verified execution
    PASS - reward 0.91 - 101d ago
    ocp-admin-cluster-report__qSvNkzV
    View execution detailsRaw report (JSON)
    Reproducibility
    PipelineCommitGeneratedRelated PR
    abevalflow-s7fp50f448e0a 🔗2026-05-12T11:05:34.424536Z#3 🔗
    View SKILL.md →
  4. /container-cve-validator - Container image CVE validation using official SBOMs, Red Hat VEX data, and MITRE/OSV.dev metadata.

    Full CVE validation pipeline for Red Hat container images with SBOM attestation extraction, VEX matching,
    version comparison, newer image scanning, and VEX data gap detection.
    Use when:
    - "Is this CVE a real issue in my container image?"
    - "Validate RHSA against my image"
    - "Batch scan CVEs from a CSV file"
    What it does:
    - Extracts official SBOMs, checks VEX product status, performs version comparison, and scans for patched images.

    View SKILL.md →
  5. /coreos-cve-validator - CoreOS (RHCOS) CVE validation for specific OCP releases with RHEL EUS stream awareness.

    CVE validation for Red Hat Enterprise Linux CoreOS in specific OCP releases.
    Use when:
    - "Does this CVE affect CoreOS in OCP 4.20?"
    - "Check CVE against RHCOS"
    What it does:
    - Extracts RPM list from CoreOS images, validates against VEX with RHEL EUS CPE matching.

    View SKILL.md →
  6. /cve-recon - CVE reconnaissance from MITRE, OSV.dev, and Go vulnerability database.

    Structured CVE metadata lookup with affected packages, version ranges, and CVSS scores.
    Use when:
    - "What packages does this CVE affect?"
    - "Look up CVE details"
    What it does:
    - Queries three data sources and returns merged results with cross-references.

    View SKILL.md →
  7. /image-inspect - Container image metadata inspection with SBOM reference and registry ownership validation.

    Fetch image labels, validate registry ownership, resolve tag/digest via SBOM.
    Use when:
    - "Inspect this container image"
    - "What SBOM does this image have?"
    What it does:
    - Extracts labels, validates ownership, resolves SBOM artifact OCI reference.

    View SKILL.md →
  8. /network-policy-architect - Zero Trust NetworkPolicy design and live cluster verification following NIST SP 800-207.

    Two-tier NetworkPolicy architecture analysis and live cluster verification for Kubernetes workloads.
    Use when:
    - "Create NetworkPolicies for my namespace"
    - "Audit network isolation for this workload"
    - "Design network segmentation following Zero Trust"
    What it does:
    - Tier 1: Maps pod types, services, communication flows, and special networking cases from source and manifests.
    - Tier 2: Validates draft rules against a running cluster via MCP tools with temporary apply-and-verify.
    - Produces verified implementation plan with default-deny, per-pod rules, and NIST alignment.

    View SKILL.md →

Skills Decision Guide

User requestSkill to useReason

"Create cluster" or "install OpenShift with Assisted Installer"

/cluster-creator

Provisions SNO or HA clusters and monitors install through completion.

"List clusters" or "cluster status in OCM/ROSA"

/cluster-inventory

Inventory across managed and self-managed targets with consistent fields.

"Fleet health" or "multi-cluster report from kubeconfig"

/cluster-report

Read-only aggregation after OpenShift context verification.

"Validate CVE against container image" or "Is this CVE a false positive?"

/container-cve-validator

Full validation pipeline using SBOM attestations, Red Hat VEX data, and newer image scanning.

"Check CVE against CoreOS in OCP 4.20" or "Validate RHSA against RHCOS"

/coreos-cve-validator

Extracts CoreOS RPM list, validates against VEX with RHEL EUS stream awareness.

"What packages does this CVE affect?" or "Look up CVE details"

/cve-recon

Quick CVE metadata lookup from MITRE, OSV.dev, and Go vulnerability database.

"Inspect this container image" or "What SBOM does this image have?"

/image-inspect

Fetches image labels, registry ownership, and SBOM artifact reference.

"Create NetworkPolicies" or "Audit network isolation" or "Design network segmentation"

/network-policy-architect

Two-tier Zero Trust NetworkPolicy design with architecture analysis and live cluster verification.

References

  • OpenShift documentation - Platform guides for administrators installing and operating OpenShift.
  • agentic-plugins repository - Source repository for these packs, skills, and catalog metadata.
  • Red Hat Security Data - Official Red Hat VEX/CSAF data, security advisories, and CVE information.
  • MITRE CVE API - Authoritative CVE metadata source used for vulnerability reconnaissance.
  • OSV.dev - Open Source Vulnerability database with cross-references to Go, PyPI, npm ecosystems.

MCP Server Integrations

Assisted Installer MCP (self-managed)
By Red Hat - Container
OCM MCP (managed clusters)
By Red Hat - Container
OpenShift MCP Server (administration)
By Red Hat - Container

Sample Workflows

Assisted install then verify

User: "Create an HA cluster on bare metal and tell me when it is ready"
- /cluster-creator walks prerequisites, manifests, and installation monitoring with approvals at critical steps
- /cluster-inventory confirms version and state once the API shows the new cluster

Fleet visibility

User: "List everything in my Red Hat account and flag stale check-ins"
- /cluster-inventory returns self-managed and managed clusters with metadata for triage

Multi-cluster health

User: "Summarize node and pod health for every OpenShift context in my kubeconfig"
- /cluster-report skips non-OpenShift contexts and aggregates signals for operators

Container CVE validation

User: "Is CVE-2024-45490 a real issue in registry.redhat.io/ubi9/ubi:latest?"
- /container-cve-validator extracts SBOM, checks VEX, confirms true/false positive with remediation

CoreOS vulnerability check

User: "Does CVE-2025-61726 affect CoreOS in OCP 4.20.16?"
- /coreos-cve-validator extracts RPMs, finds affected package, checks VEX under OCP and RHEL EUS CPEs

Zero Trust NetworkPolicy design

User: "Create NetworkPolicies for the qtodo namespace following Zero Trust"
- /network-policy-architect maps communication flows, drafts per-pod rules, verifies on live cluster with temporary apply-and-verify

https://github.com/RHEcosystemAppEng/agentic-plugins