Finalize Your Dapr Skill

Using my dapr-deployment skill, deploy Dapr 1.14 on a fresh Kubernetes cluster.
Show me the Helm commands and how to verify all control plane pods are running.

# Add Dapr Helm repo
helm repo add dapr https://dapr.github.io/helm-charts/
helm repo update

# Install Dapr control plane
helm upgrade --install dapr dapr/dapr \
  --version=1.14.0 \
  --namespace dapr-system \
  --create-namespace \
  --wait

# Verify installation
kubectl get pods -n dapr-system

Using my dapr-deployment skill, add state management to my FastAPI app.
I need to save and retrieve task objects using Redis as the backend.
Show me the component YAML and Python code.

apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
  name: statestore
spec:
  type: state.redis
  version: v1
  metadata:
    - name: redisHost
      value: redis-master.default.svc.cluster.local:6379

from dapr.clients import DaprClient
import json

with DaprClient() as client:
    # Save state
    client.save_state(
        store_name='statestore',
        key='task-123',
        value=json.dumps({'title': 'Buy groceries', 'status': 'pending'})
    )

    # Get state
    state = client.get_state(store_name='statestore', key='task-123')
    task = json.loads(state.data) if state.data else None

Using my dapr-deployment skill, set up pub/sub messaging for my FastAPI service.
I need to publish task events and subscribe to them in another service.

apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
  name: pubsub
spec:
  type: pubsub.redis
  version: v1
  metadata:
    - name: redisHost
      value: redis-master.default.svc.cluster.local:6379

from dapr.clients import DaprClient
import json

with DaprClient() as client:
    client.publish_event(
        pubsub_name='pubsub',
        topic_name='task-events',
        data=json.dumps({'event_type': 'task.created', 'task_id': 'task-123'}),
        data_content_type='application/json'
    )

from fastapi import FastAPI
from dapr.ext.fastapi import DaprApp

app = FastAPI()
dapr_app = DaprApp(app)

@dapr_app.subscribe(pubsub='pubsub', topic='task-events')
async def handle_task_event(event_data: dict):
    print(f"Received: {event_data}")
    return {"status": "SUCCESS"}

Using my dapr-deployment skill, schedule a recurring cleanup job that runs
every hour to remove completed tasks older than 7 days.

from dapr.clients import DaprClient

with DaprClient() as client:
    # Schedule recurring job
    client.start_workflow(
        workflow_component='dapr',
        workflow_name='cleanup-job',
        input={'retention_days': 7}
    )

POST http://localhost:3500/v1.0/jobs/cleanup-old-tasks
Content-Type: application/json

{
  "schedule": "@every 1h",
  "data": {"retention_days": 7}
}

Using my dapr-deployment skill, configure my FastAPI service to retrieve
API keys from Kubernetes secrets instead of environment variables.

apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
  name: kubernetes-secrets
spec:
  type: secretstores.kubernetes
  version: v1
  metadata: []

from dapr.clients import DaprClient

with DaprClient() as client:
    secret = client.get_secret(
        store_name='kubernetes-secrets',
        key='api-credentials'
    )
    api_key = secret.secret.get('api-key')

## Safety: NEVER

- **Call Dapr before sidecar is ready** - Your app will get connection refused errors. Always wait for sidecar health check.

- **Hardcode component names** - Use configuration or environment variables. Component names may differ between environments.

- **Skip error handling for Dapr API calls** - Dapr calls can fail (sidecar not ready, component misconfigured, backend unavailable). Always wrap in try/except.

- **Store sensitive data in state without encryption** - State stores are not encrypted by default. Use secrets component for credentials, or enable encryption at the component level.

- **Expose Dapr HTTP/gRPC ports externally** - Dapr's sidecar ports (3500, 50001) are for internal pod communication only. External access bypasses mTLS.

- **Use `dapr.io/app-port` for gRPC apps without specifying protocol** - If your app uses gRPC, set `dapr.io/app-protocol: "grpc"` or Dapr will send HTTP to your gRPC server.

## Safety: ALWAYS

- **Wait for sidecar readiness** before making Dapr calls:
  ```python
  import httpx
  import asyncio

  async def wait_for_sidecar(timeout: int = 30):
      """Wait for Dapr sidecar to be ready."""
      async with httpx.AsyncClient() as client:
          for _ in range(timeout):
              try:
                  response = await client.get("http://localhost:3500/v1.0/healthz")
                  if response.status_code == 204:
                      return True
              except httpx.ConnectError:
                  pass
              await asyncio.sleep(1)
          raise RuntimeError("Dapr sidecar not ready")

---

## Common Errors Reference

Add this error table to your skill. When something breaks, this is the first place you'll look.

```markdown
## Common Errors

| Error | Cause | Fix |
|-------|-------|-----|
| `ERR_STATE_STORE_NOT_FOUND` | State component not configured or not in same namespace | Apply component YAML: `kubectl apply -f components/statestore.yaml` |
| `ERR_PUBSUB_NOT_FOUND` | Pub/sub component not configured | Apply component YAML: `kubectl apply -f components/pubsub.yaml` |
| `connection refused :3500` | Sidecar not ready when app starts | Add startup probe or wait for `/v1.0/healthz` before Dapr calls |
| `ERR_DIRECT_INVOKE` | Target app-id not found | Check target has `dapr.io/app-id` annotation and is running |
| `DEADLINE_EXCEEDED` | Request timeout | Increase timeout or check if target service is overloaded |
| `sidecar not found` | Sidecar injection not enabled | Check `dapr.io/enabled: "true"` annotation and namespace has injection enabled |
| `ERR_SECRET_STORE_NOT_FOUND` | Secrets component not configured | Apply secrets component YAML |
| `ERR_PUBSUB_FORBIDDEN` | App not in component's scope | Add app-id to component's `scopes` list |

Using my dapr-deployment skill, generate a complete Dapr setup for:
- A FastAPI service that saves tasks to state store
- Publishes events to pub/sub when tasks are created
- Calls a notification service via service invocation
- Schedules a daily cleanup job
- Gets API keys from Kubernetes secrets

Show all component YAMLs, Python code, and Kubernetes deployment manifest.

.claude/skills/
+-- skill-creator/
+-- fetching-library-docs/
+-- fastapi-agent-api/       # Chapter 70
+-- docker-deployment/       # Chapter 79
+-- kubernetes-deployment/   # Chapter 80
+-- helm-chart/              # Chapter 81
+-- kafka-events/            # Chapter 82
+-- dapr-deployment/         # This chapter - COMPLETE

Review my dapr-deployment skill. Does it cover all 6 building blocks from
Chapter 83?

The building blocks are:
1. State Management
2. Pub/Sub Messaging
3. Service Invocation
4. Bindings (input and output)
5. Secrets Management
6. Jobs API

For each building block, tell me:
- Is it covered in my skill? (Yes/No)
- Is the coverage complete? (Component YAML + Python code + common patterns)
- What's missing?

[Paste your SKILL.md content here]

I've added safety guardrails to my dapr-deployment skill. Review them and tell me:

1. Are my NEVER rules comprehensive? What production mistakes am I still vulnerable to?
2. Are my ALWAYS rules actionable? Can someone follow them without additional research?
3. What guardrails do experienced Dapr operators add that I'm missing?

Current guardrails:

NEVER:
- Call Dapr before sidecar is ready
- Hardcode component names
- Skip error handling
- Store secrets in state
- Expose Dapr ports externally

ALWAYS:
- Wait for sidecar readiness
- Use secretKeyRef for credentials
- Enable mTLS in production
- Configure retry policies
- Set sidecar resource limits

Test my dapr-deployment skill by generating a complete Dapr-enabled microservice
from scratch. The service should:

- Accept HTTP requests to create orders
- Save order state with ETag-based optimistic concurrency
- Publish order.created events to pub/sub
- Call inventory-service to check stock via service invocation
- Retrieve Stripe API keys from secrets
- Schedule order cleanup job for midnight daily

Generate all YAMLs, Python code, and Kubernetes manifests.

After generating, evaluate: Did my skill produce production-ready output?
What was missing or incorrect?