Deploy and troubleshoot multihome networking on OCI Kubernetes Engine using existing GVA secondary VNIC node pools, Multus thick plugin, OCI CNI/IPAM, NetworkAttachmentDefinitions, and test pods.
SkillScore77Maintained
Automatic
◆DevOps & SRE pack
Last verified 9/26/2026
What it changes
Passed 15 of 19 test cases with the skill, and 3 of 19 without it.
Without skill14%
With skill77%
Checks it passed that the model alone missed
The ping command sets the timeout with -W 2.
The secondary interface default path is enp2s0.
The required OKE CNI mode is OCI_VCN_IP_NATIVE.
and 18 more in the full report
14 fixed3 passed either way5 still failing0 broke
Pass-rate lift
+64 pp
Tokens
+50%
Agent turns
0%
Response time
-54%
Model gemini-3.6-flashMeasured 9/26/2026v117 of 22 cases passed with skill · 19 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 14 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 14
Prompt
We are running `scripts/discover-oke-multihome.py` using `--cluster-id` and region `us-ashburn-1` to output data for our pipeline. Which CLI flag formats the discovery output into clean JSON?
What was checked, without and with the skill
Checked
Without skill
With skill
The discovery command includes the --pretty flag.
Missed
Passed
case-21 · gemini-3.6-flash · 9/26/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md134 lines5 filesincludes scripts
OKE Multihome Deployer
Scope
Use this skill after an OKE node pool already has GVA secondary VNIC profiles attached. This skill deploys and verifies Multus-based pod multihoming; it does not create or update GVA node pools.
If the user needs to create or update the node pool secondary VNIC profiles, use oke-gva-deployer first, then return here.
Supporting references:
validation-report-template.md — standard final validation report structure.
Core Workflow
Confirm target cluster/context and auth.
Prefer explicit OCI_CLI_PROFILE and OCI_CLI_AUTH; when using OCI security-token auth, pass --auth security_token or set OCI_CLI_AUTH=security_token.
If kubectl fails with exec: executable oci failed, ask the user to refresh the OCI session before applying anything.
Auto-discover cluster, node pool, and subnet data before generating YAML.
Use scripts/discover-oke-multihome.py.
Prefer --cluster-id when the user provides it; otherwise try --context, then --cluster-name with --compartment-id.
The discovery script queries OKE node pools and fetches all referenced placement and secondary VNIC subnets.
Use the discovered node names for --pod NAME=NODE_NAME entries.
Verify prerequisites from Kubernetes and node-side checks.
OKE CNI must be OCI_VCN_IP_NATIVE.
Worker nodes must expose secondary VNIC interfaces. Treat enp1s0 and enp2s0 as common defaults, then confirm the actual interface names from discovery or node-side evidence before applying manifests.
OCI CNI binaries should exist on nodes: oci-ipam, oci-ipvlan, oci-ptp.
The standard ipvlan CNI binary is needed when using a plain ipvlan secondary NAD.
Install Multus thick plugin if absent.
Upstream manifest used in this workflow:
https://raw.githubusercontent.com/k8snetworkplumbingwg/multus-cni/master/deployments/multus-daemonset-thick.yml
TODO(live validation): pin this manifest to a tested Multus release tag after validating it against the target OKE Kubernetes version. Keep using the repo's current manifest reference until that live validation is complete.
Generate or edit the deployment manifest.
Use scripts/generate-multihome-manifest.py for repeatable YAML.
Default network NAD: kube-system/gva-default-network, using oci-ipvlan on the first secondary VNIC path.
Secondary NAD: workload namespace scoped, using ipvlan on the second secondary VNIC path with oci-ipam.
Apply and verify.
Use fully qualified images such as docker.io/nicolaka/netshoot:v0.13; CRI-O may reject short image names.
Check pod annotation k8s.v1.cni.cncf.io/network-status.
Exec ip -br addr in each pod and ping the peer net1 IP both directions.
Use validation-report-template.md for the final validation report, whether
validation passed, failed, or remains incomplete.