🔌

secure-boot-cert-rotation

🔌Plugin

air-gapped/skills

Installation

Add marketplace in Claude Code:

$/plugin marketplace add air-gapped/skills

Step 2. Install plugin:

$/plugin install secure-boot-cert-rotation@air-gapped-marketplace

What it does

Secure Boot certificate-rotation suite — triage and remediate the Microsoft Secure Boot 2011→2023 UEFI CA rotation (CAs expiring 2026) across Dell PowerEdge / iDRAC9 bare metal, Ubuntu/Linux servers, and Harvester HCI / KubeVirt guest VMs: the PK→KEK→db trust chain, per-platform fixes (iDRAC BIOS-staged keys applied on reboot, self-authenticating manual `db` append via the existing 2011 KEK, the Harvester OVMF v1.6.0 floor with ephemeral-vs-persistent NVRAM triage), and audit via mokutil / efi-readvar / racadm bioscert / Redfish.

🏪

Part of

air-gapped/skills

infrastructure

AddedJul 16, 2026

View on GitHub Back to Plugins

More from this repository10

🎯

helm🎯Skill

Skill

🎯

open-webui-embeddings🎯Skill

Skill

🎯

vllm-speculative-decoding🎯Skill

Skill

🎯

rancher-upgrade🎯Skill

Skill

🎯

vllm-deployment🎯Skill

Skill

🎯

prometheus-mimir-grafana🎯Skill

Skill

🎯

jira-best-practices🎯Skill

Skill

🔌

harvester🔌Plugin

Harvester HCI operator suite — controlled, community-edition Harvester upgrades off an EOL line up to latest stable: the no-skip minor ladder (1.5→1.6→1.7→1.8 carrying embedded RKE2 / KubeVirt / Longhorn / SLE-Micro together), external-Rancher + Harvester UI-extension pairing and ordering, air-gapped version detection, controlling the node-by-node upgrade flow (serial interlock, the v1.7+ pause-map, and the PodDisruptionBudget + VMI-readinessProbe native gate for 1.5/1.6), keeping VM-hosted self-managed RKE2 control planes quorate via anti-affinity spread and live-migration-vs-clean-shutdown tradeoffs (busy-etcd non-convergence, auto-converge, dedicated migration network), per-hop breaking changes (wicked→NetworkManager, Intel NIC rename, DHCP churn), the enforced pre-flight health gates, and the no-downgrade backup/rollback reality. Companion to the k8s suite's k8s-components-checker (Harvester↔Rancher↔RKE2 pairing registry) and rancher-upgrade (the external Rancher's own chain).

🔌

observability🔌Plugin

Observability suite — Prometheus, Grafana Mimir, and Grafana reference for agents querying metrics, writing PromQL, building and fixing dashboards, and reasoning about SLOs, KPIs, and burn-rate alerting.

🎯

secure-boot-cert-rotation🎯Skill

Skill