Skip to main content
Glama

update_stack

Update an existing deployed stack on the cluster. The stack object uses the same shape as create_stack and stack.name selects the stack to update. By default the update is PARTIAL: members present in the spec are added or updated and omitted members are preserved. Set replace_missing=true to replace the whole stack, removing members missing from the spec. Dependency order is carried by each member's parents: a member added here with no parents deploys in PARALLEL with everything else, so give any member that needs a namespace, Secret, ConfigMap, CRD, operator, or database from this stack a parent for it ({"name": "", "kind": "addon" or "manifest"}, kind lowercase). On an existing member, OMITTING parents preserves its current edges and passing [] CLEARS them - restate the full parent list whenever you re-send a member that has dependencies. Use this tool to add the missing edges to a stack that was created without them. Deployment of the changed members starts immediately and the change is pushed to the cluster's GitOps repository when one is connected. NEVER pass raw secret values - use ${SECRET_SLOT:} sentinels; raw secret-looking values are refused. Manifests carrying cluster-scoped or cluster-critical kinds (CustomResourceDefinition, ClusterRole, webhook configurations, PersistentVolume, ...), documents in protected namespaces (kube-, ankra-), or bindings to cluster-admin are refused by policy unless semantically unchanged from the deployed stack - manage those through the UI.

Input Schema

NameRequiredDescriptionDefault
stackYesThe stack specification: name selects the stack; addons and manifests carry the members to add or update, with the parents that order them. agents_md records durable operational learnings beside a member in GitOps (omit to preserve, empty string to clear).
cluster_idYesAnkra cluster id (UUID) the call targets. Discover ids with list_clusters.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changed
    • addedInput schema / properties / stack / properties / addons / items / properties / configuration / properties / encrypted_paths / description
      Added value: +"Extra keys to seal with SOPS when the stack is committed to GitOps, e.g. \"stringData.password\" or \"auth.password\" (sops matches the last key name at any depth). A key holding a ${SECRET_SLOT:<id>} sentinel is sealed automatically and needs no entry; list a key here only to seal a value that is not a sentinel."
    • addedInput schema / properties / stack / properties / manifests / items / properties / encrypted_paths / description
      Added value: +"Extra keys to seal with SOPS when the stack is committed to GitOps, e.g. \"stringData.password\" or \"auth.password\" (sops matches the last key name at any depth). A key holding a ${SECRET_SLOT:<id>} sentinel is sealed automatically and needs no entry; list a key here only to seal a value that is not a sentinel."
  2. First observed

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With annotations present the bar is lower, and this description goes well past them: partial-vs-full update semantics, immediate deployment side effects, GitOps push behavior, parent-edge preserve/clear rules, parallel-deploy default for parentless members, and two hard refusal policies (raw secrets, cluster-critical kinds). Note a mild tension with destructiveHint=false, since replace_missing=true removes members, but removals are explicitly opt-in, so this is not a contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Long (~350 words) but front-loaded: purpose and the partial-update default come first, then dependency rules, then refusal policies. Several sentences restate schema text verbatim (parents omit/preserve, secret sentinels, encrypted_paths), so it is not maximally tight, but almost every sentence is operationally load-bearing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers the hard parts of a deeply nested, mutating tool: dependency ordering, secret handling, and policy refusals. However it instructs the agent to 'Set replace_missing=true' while the schema exposes no such parameter, and it says nothing about response shape or whether the call blocks until the changed members finish deploying (no output schema exists to cover that).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description earns more by adding operational meaning the schema lacks, notably that a member with no parents deploys in parallel and that omitting vs passing [] parents differs. It also references a replace_missing flag that does not exist anywhere in the input schema, which weakens the mapping between prose and parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Update an existing deployed stack on the cluster') and immediately scopes it against create_stack by saying the stack object shares its shape. An agent can distinguish it from create_stack, redeploy_stack and apply_stack_changes from the first sentence alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete when-to-use ('Use this tool to add the missing edges to a stack that was created without them') and when-not ('manage those through the UI' for cluster-scoped/critical kinds). It never names a sibling alternative, so an agent must still infer whether update_stack or apply_stack_changes/update_stack_profile is the right entry point.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources