/ftl:rhdp-lab-validator
Generate runtime-automation/module-N/{solve,validation,setup}.yml playbooks for RHDP showroom labs using the Zero Touch (nookbag) grading system. Works for OCP tenant, OCP dedicated+bastion, RHEL VM+bastion, and AAP labs.
Different from
/ftl:lab-validator— that skill generates external FTL grader containers (grade_lab/solve_lab). This skill generates inline runtime-automation playbooks that run inside the showroom runner sidecar, powering the Solve/Validate buttons in the nookbag UI.
Workflow Overview
2. OCP dedicated — student has cluster-admin, lab has a bastion VM
3. RHEL VM — bastion + node VMs, runner runs ON the bastion
This determines runner location, SSH patterns, kubernetes.core vs shell.
= Title per .adoc) for module count and labels.Generate:
ui-config.yml · verify site.yml nookbag v0.0.3 · runtime-automation/module-N/ stubsCommit + push. Do NOT order yet.
workloads: only — is the FTL ZT role present?Missing → offer to create branch and add it
Once both scaffold + AgV ready:
"Order the lab from integration.demo.redhat.com"
💡 /rename ZT grading — <lab-name> to resume after wait
.sh scripts or playbooks — module by module.Claude reads them and auto-generates matching validation tasks.
Nothing → generate from scratch in Step 5.
oc login <api-url> --token <admin-token> --insecure-skip-tls-verifyClaude verifies: zt-runner SA · kubeconfig Secret · RoleBindings
RHEL VM (type 3):
Share bastion host / port / password → Claude SSHes to check runner
Confirm
/runner/api/config returns module list.
Auto-detect manual steps (browser/GitHub) → ⚠️ warning pattern.
Generate
solve.yml + validation.yml — multi-task ✅/❌ mandatory.STOP. Give curl commands immediately.
curl -sk https://<showroom>/runner/api/module-N/solvecurl -s http://localhost:8501/api/module-N/solve✅ Module N passes → proceed to Module N+1 (back to Step 5)
modules?
Lab Types Supported
| Lab Type | Config | Validation Pattern | Key Extravar |
|---|---|---|---|
| OCP Tenant | config: namespace | kubernetes.core.k8s_info in student namespace | student_ns, k8s_kubeconfig |
| OCP Dedicated | config: openshift-workloads | k8s admin + bastion bash script + oc --as developer | bastion_host, k8s_kubeconfig |
| RHEL VM + Bastion | config: cloud-vms-base | SSH via /app/.ssh/config to bastion + nodes | bastion_host, bastion_port |
| AAP | any | ansible.builtin.uri against AAP Controller API | aap_controller_url, aap_token |
What It Creates
runtime-automation/
├── module-01/
│ ├── setup.yml # debug stub
│ ├── solve.yml # creates resources / runs scripts
│ └── validation.yml # ✅/❌ per-task output
├── module-02/
│ ├── solve-module2.sh # bash script (if applicable)
│ ├── validate-module2.sh # bash script (if applicable)
│ └── ...
Plus ui-config.yml snippet and AgV workload vars snippet.
Handling Existing Scripts
When developers already have bash scripts (like .sh or .sh.j2 from Ansible roles), the skill wraps them automatically:
Scripts in the showroom repo → ansible.builtin.script (copies to bastion + runs):
- ansible.builtin.script:
executable: /bin/bash
cmd: "/solve-module1.sh"
Scripts already on the bastion → ansible.builtin.shell (runs in-place):
- ansible.builtin.shell: /home/lab-user/scripts/solve-module1.sh
The skill reads the solve script content to generate a matching validation.yml automatically.
Tips: Getting the Most from This Skill
/renameyour session — provisioning takes 15-60 min. Rename with/rename ZT grading — my-laband resume anytime.oc loginas admin — Claude can then inspect namespaces, check zt-runner SA, read pod logs directly.- Share bastion SSH upfront (RHEL labs) — Claude SSHes to check runner logs and curl jobs without copy-paste.
- Paste failing job output — Claude diagnoses and fixes inline.