EXTENSIONS

Datadog RBAC — role, permission, user, and restriction query analysis via the Datadog RBAC API (v2). Answers "who can access what data?" by resolving the full chain: user → roles → permissions + restriction queries → effective access. Supports all Datadog sites (us1, us3, us5, eu1, ap1, us1-fed).

Datadog Teams — team management, memberships, and permissions

Manage FreeIPA sudo, HBAC, RBAC, privilege, and CA-ACL policy over the JSON-RPC API: find/show read-only snapshots plus idempotent ensureSudoRule/ensureHbacRule/ensureRole/ensurePrivilege/ensureCaAcl, fan-out member/option/privilege/permission/certprofile methods, enable/disable toggles, read-only privilege/permission/CA-ACL discovery, and confirm-guarded deletes, each mutation with an audit trail.

Control-plane administration of a Garage (S3-compatible object store) cluster via its Admin API v2 (bearer token). Read/audit of cluster health, buckets, access keys, and the full key×bucket permission matrix; plus management — create /update/delete buckets, manage aliases, create/import/update/rotate/delete access keys, and grant/revoke read/write/owner permissions. Never touches S3 object data; destructive verbs verify the target by id first.

Kubernetes operational toolkit — 15 model types covering pods, deployments, services, RBAC, storage, networking, autoscaling, batch jobs, and more. Includes 14 ready-to-run workflows for namespace debugging, security audits, RBAC analysis, cluster health, and operational diagnostics.

Non-destructive PostgreSQL administration over a direct TCP connection (node-postgres). Read/audit of databases, roles, permissions, tables, connections, and extensions; plus data-safe admin DDL — create database/role, grant/revoke, rotate passwords, and an idempotent app_provision composite. Never reads or writes table rows; never DROP/TRUNCATE; no arbitrary-SQL passthrough.