Agent skill · NVIDIA
doca-flow-grpc-server
PLAINTEXT-ONLY: the shipped `doca_flow_grpc` server uses `grpc::InsecureServerCredentials()` with NO TLS / mTLS / token-auth knob on the binary — transport security must come from external infrastructure (e.g. an mTLS proxy / sidecar) on a trusted segment. Use this skill when bringing up, configuring, hardening, or debugging `doca_flow_grpc` — the DOCA-shipped gRPC remote-control surface in front of `doca-flow` that lets non-C++ clients (Python, Go, Rust, Java) program Flow pipes and entries over RPC instead of linking `libdoca_flow.so` directly. Trigger even when the user doesn't say 'doca-flow-grpc-server' or 'gRPC' — e.g. 'program Flow rules from Python on another host', 'remotely configure pipes on the BlueField', 'client times out connecting to the Flow server', 'where is the .proto for Flow', 'UNAUTHENTICATED / FAILED_PRECONDITION on a Flow RPC'. Route elsewhere for the underlying doca-flow API, generic gRPC tooling (protoc, language bindings), or DOCA install / BFB bring-up.
What it needs
About 9k tokens when loaded.
What this skill does
DOCA Flow gRPC Server (docaflowgrpc) CRITICAL transport-security correction (Run-12 + R13). The shipped docaflowgrpc / docaflowgrpcclient binaries hard-code the gRPC plaintext credentials surface: the server uses grpc::InsecureServerCredentials() (the C++ gRPC server-side API in tools/flowgrpcserver/server/); the C++ client uses grpc::InsecureChannelCredentials() (the C++ gRPC client-side API; the client lives in libs/docaflow/grpc/client/, compiled into the docaflow library, NOT under tools/flowgrpcclient/); the Python client uses grpc.aio.insecurechannel(...). Do NOT cite the server-side string as grpc::InsecureChannelCredentials() — that is the client-side API name and a Grep-against-source verification will fail. There is no TLS, no mTLS, and no token-auth knob on the shipped control plane today. Any prose below (or in CAPABILITIES.md / TASKS.md) that frames "mTLS / token auth / TLS posture" as a configurable knob on this server is the bundle's previous aspirational framing and is wrong against the shipped source. Treat the server as plaintext-on-a-trusted-segment only: it MUST be bound on a control-plane-only network segment behind an external proxy, sidecar, or VPN that itself enforces TLS + identity. Any "TLS / mTLS / token- auth" discussion below is about the operator's external hardening layer, NOT a knob on this binary. Routing for an TLS / identity design discussion must stay on the selected external proxy, sidecar, or VPN; never route it to a shipped-today binary knob. Where to start: This is a tool skill for standing up and operating docaflowgrpc, the DOCA-shipped gRPC remote- control surface for doca-flow. Open TASKS.md and start at ## configure to decide whether a remote control plane is the right answer at all (vs talking to libdocaflow.so directly), then ## run for the start → bind → one-client-smoke sequence, then test for the smoke-before-bulk loop that gates any RPC that mutates Flow / dataplane state. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills NVIDIA/doca-flow-grpc-server