Generate and validate controller-resource dependency graph artifacts for Kamera coverage strategy v2. Use this when extracting triggers/reads/writes from Kubernetes control planes, assigning resource roles, and producing contract-compliant dependency-graph.json plus schema-map.json outputs.
Use this skill when you need to analyze a Kubernetes control-plane codebase and produce dependency artifacts consumed by Kamera v2 input generation.
The graph artifact is valid only if it satisfies:
docs/design/dependency-graph-contract.mdValidation command:
scripts/validate-dependency-graph.sh \
--graph dependency-graph.json \
--schema-map schema-map.json
If validation fails, do not proceed downstream. Fix or regenerate artifacts.
For each analyzed project, produce:
dependency-graph.json (contract-compliant)schema-map.json (must include every graph resource ID)analysis-notes.md (human evidence summary for reviewers)SetupWithManager, .For, .Watches,
.Owns, NewController).internal/, controllers/,
pkg/reconciler/, pkg/controllers/, cmd/).triggers edges:.For(...) -> trigger=primary.Watches(...) -> trigger=secondary.Owns(...) -> trigger=ownstrigger=manualGet, List, lister/cache readsCreate, Update, Patch, Delete, Status().Update/Patchsurface to one of: spec, status, metadata, anygroup/version/kindcoreresource.id == resource.gvkuser-facing: top-level fuzzed API inputssupporting: harness/support objects, non-user top-level fuzz inputsbuiltin: Kubernetes built-in resourcesRole assignment heuristics (required):
writes patterns).api/, config/crd/, comments, godoc)examples/, config/samples/,
tutorials, quickstarts)For roots vs derived resources)user-facing:
supporting and record uncertainty in
analysis-notes.md.Decision cues:
user-facing when docs/examples/CLI workflows instruct users to create or
update the resource directly.supporting when resource mostly exists for controller internals, plumbing,
or simulation scaffolding.builtin for Kubernetes built-in API groups (for example core, apps,
batch, rbac.authorization.k8s.io).dependency-graph.json using contract field names and enums.schema-map.json with complete resource-key coverage.Use this template when delegating artifact creation to an LLM:
Analyze
<project-path>and producedependency-graph.json,schema-map.json, andanalysis-notes.md.Requirements:
dependency-graph.jsonMUST satisfydocs/design/dependency-graph-contract.mdexactly.- Use contract field names/enums exactly (
nodes,edges,id,gvk,role,kind=triggers|reads|writes,trigger,surface).- Verify controller registration from entrypoints, not grep-only discovery.
- Traverse reconcile helper call chains for read/write extraction.
- Assign explicit
roleto every resource node.- For ambiguous role assignments, run web search against official project docs and include citations in
analysis-notes.md.- Ensure every graph resource ID exists in
schema-map.json.Reject output if any required field is missing, any edge endpoint is dangling, any controller lacks
primarytrigger, any role decision lacks evidence, or schema-map coverage is incomplete.
# one-command gate
scripts/validate-dependency-graph.sh \
--graph dependency-graph.json \
--schema-map schema-map.json
# role evidence sanity check (should list each resource role rationale)
rg "role rationale" analysis-notes.md
# resource coverage spot-check (should be empty)
comm -23 \
<(jq -r '.nodes[] | select(.kind=="resource") | .id' dependency-graph.json | sort -u) \
<(jq -r '.mapping | keys[]' schema-map.json | sort -u)