agentsclimarketplace
Sign in

Techtide oci certificates issuer review

Skill TechTideOhio/techtide-harness-kit/skills/oci/techtide-oci-certificates-issuer-review

Use this skill when reviewing OCI Certificates Service issuer configurations for cert-manager on OKE. Trigger on any request to audit OCI CA hierarchy, issuance rules, OKE Workload Identity vs Instance Principal auth, IAM policy scope, OCSP reachability, or certificate version management.From its SKILL.md

Install
npx -y skills add TechTideOhio/techtide-harness-kit --skill techtide-oci-certificates-issuer-review

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.7 KB, 462 tokens by cl100k_base, as published. Nobody here has run it

OCI Certificates Issuer Review

Purpose

Review Oracle Cloud Infrastructure (OCI) Certificates Service configurations used as cert-manager issuers on OKE (Oracle Kubernetes Engine). Identify CA hierarchy misconfigurations (root vs subordinate), missing issuance rules, overly broad IAM policies, Instance Principal authentication scope risks, OCSP reachability gaps, and certificate version accumulation. Output severity-labeled findings with evidence and remediation steps.

Lean operating rules

  • Flag any OCI issuer that references a ROOT CA directly as CRITICAL - only a SUBORDINATE CA should be used for cert-manager issuance. The ROOT CA must be offline (disabled after subordinate creation) or kept entirely out of the Certificates Service.
  • Check whether OCI issuance rules are configured on the subordinate CA: flag missing validity caps (>90d) and missing key algorithm restrictions (RSA <2048 or EC <P-256) as MEDIUM.
  • Identify the authentication method used by cert-manager to call OCI APIs: flag Instance Principal auth as HIGH - any pod on the OKE node can call the OCI Certificates API via instance metadata. Correct method is OKE Workload Identity (SA-bound, pod-level).
  • Review the OCI IAM policy for cert-manager: flag manage certificate-authorities (grants delete/update CA) as HIGH. Minimum required: use certificate-authorities with request.permission='CREATE_CERTIFICATE_REQUEST'.
  • Check OCSP reachability from OKE worker nodes to ocsp.pki.oraclecloud.com. Flag unreachable OCSP endpoint as MEDIUM (soft-fail revocation = revoked certs accepted by most TLS stacks).
  • Review certificate version count; flag high version accumulation (> 10 versions per cert) as LOW (storage cost and management overhead).
  • Label all findings as live evidence, documentation-based, or inference.

References

Load these only when needed:

Response minimum

  • Severity-labeled findings list (CRITICAL / HIGH / MEDIUM / LOW)
  • Evidence source for each finding
  • Specific resource name, CA OCID, or IAM policy statement that caused the finding
  • Recommended remediation with example OCI CLI command or IAM policy snippet
  • Overall OCI PKI trust posture verdict

What ships with it: 2 files

7.4 KB alongside SKILL.md

references/

Keep looking

Skills are one crate of 326,144. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.