[READ] List jobs (name, namespace, completions, succeeded/failed, age).

Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[READ] Return detail for a single job by name.

Args: name: Job name (see job_list). namespace: Namespace; omit for the target's default namespace. target: k8s target name from config.

[READ] List cronjobs (name, namespace, schedule, suspend, active, age).

Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[READ] Return detail for a single cronjob by name.

Args: name: CronJob name (see cronjob_list). namespace: Namespace; omit for the target's default namespace. target: k8s target name from config.

[WRITE][risk=high] Delete a job and its pods. HIGH RISK — no undo.

Pass dry_run=True to preview without deleting.

Args: name: Job name. namespace: Namespace; omit for the target's default namespace. dry_run: If True, preview without deleting. target: k8s target name from config.

[READ] Friendly cluster health summary: server version, node/ns counts.

Args: target: k8s target name from config; omit to use the default.

[READ] List available API groups and their versions.

Args: target: k8s target name from config; omit to use the default.

[READ] List configmaps (name, namespace, key count, age).

Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[READ] Return a configmap's data (keys + values — config, not secrets).

Args: name: ConfigMap name (see configmap_list). namespace: Namespace; omit for the target's default namespace. target: k8s target name from config.

[READ] List secrets — names, types, and key NAMES only (values redacted).

Secret VALUES are never returned. Use this to discover which secrets and keys exist, then mount/reference them via the kubeconfig-authorized workload.

Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[READ] List statefulsets (name, namespace, desired/ready/current, age).

Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[READ] Return detail for a single statefulset by name.

Args: name: StatefulSet name (see statefulset_list). namespace: Namespace; omit for the target's default namespace. target: k8s target name from config.

[READ] List daemonsets (name, namespace, desired/ready/available, age).

Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[READ] Return detail for a single daemonset by name.

Args: name: DaemonSet name (see daemonset_list). namespace: Namespace; omit for the target's default namespace. target: k8s target name from config.

[READ] List replicasets (name, namespace, desired/ready, age).

Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[WRITE][risk=medium] Scale a statefulset to replicas. Inverse: restore previous count.

Pass dry_run=True to preview without scaling (no undo is recorded for a preview).

Args: name: StatefulSet name. replicas: Desired replica count. namespace: Namespace; omit for the target's default namespace. dry_run: If True, preview without scaling. target: k8s target name from config.

[READ] Describe a pod: status, conditions, container states, recent events.

The fastest single call to diagnose why a pod is not Ready (CrashLoopBackOff, ImagePullBackOff, scheduling failures).

Args: name: Pod name (see pod_list). namespace: Namespace; omit for the target's default namespace. target: k8s target name from config.

[READ] Scan pods for CrashLoopBackOff, image-pull failures, OOMKilled, unschedulable Pending pods, and high restart counts.

Returns worst-first findings, each citing the reason string / restart count that tripped it plus a concrete kubectl action. Omit namespace to scan all.

Args: namespace: Namespace to scope to; omit for all namespaces. label_selector: Optional label selector, e.g. "app=web". target: k8s target name from config; omit to use the default.

[READ] Scan Deployments/StatefulSets/DaemonSets for ready-vs-desired shortfalls, zero-ready outages, and rollout-stuck conditions.

Returns worst-first findings, each citing the measured ready/desired ratio or the failing condition reason plus a concrete kubectl action.

Args: namespace: Namespace to scope to; omit for all namespaces. target: k8s target name from config; omit to use the default.

[WRITE][risk=medium] Scale a deployment to replicas. Inverse: restore previous count.

Returns previous_replicas so the change can be undone. Pass dry_run=True to preview without changing anything (no undo is recorded for a preview).

Args: name: Deployment name. replicas: Desired replica count. namespace: Namespace; omit for the target's default namespace. dry_run: If True, preview without scaling. target: k8s target name from config.

[WRITE][risk=medium] Trigger a rolling restart of a deployment. No clean undo.

Pass dry_run=True to preview without restarting.

Args: name: Deployment name. namespace: Namespace; omit for the target's default namespace. dry_run: If True, preview without restarting. target: k8s target name from config.

[WRITE][risk=medium] Delete a pod. No undo — a controller usually recreates it.

Pass dry_run=True to preview without deleting.

Args: name: Pod name. namespace: Namespace; omit for the target's default namespace. dry_run: If True, preview without deleting. target: k8s target name from config.

[WRITE][risk=high] Delete a deployment and its pods. HIGH RISK — no undo.

Pass dry_run=True to preview without deleting.

Args: name: Deployment name. namespace: Namespace; omit for the target's default namespace. dry_run: If True, preview without deleting. target: k8s target name from config.

[READ] CPU/memory usage per node (requires metrics-server).

Returns available: False with a clear message when metrics-server is not installed.

Args: target: k8s target name from config; omit to use the default.

[READ] CPU/memory usage per pod (requires metrics-server).

Returns available: False with a clear message when metrics-server is not installed.

Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[READ] List namespaces (name, phase, age).

Args: target: k8s target name from config; omit to use the default.

[WRITE][risk=medium] Create a namespace. Inverse: delete_namespace.

Pass dry_run=True to preview without creating.

Args: name: Namespace name to create. dry_run: If True, preview without creating. target: k8s target name from config.

[WRITE][risk=high] Delete a namespace and EVERYTHING in it. HIGH RISK — no undo.

Pass dry_run=True to preview without deleting.

Two namespaces are refused. The cluster's control-plane namespaces (kube-system, kube-public, kube-node-lease) need confirm=True — deleting one takes DNS and pod networking with it. The namespace holding this target's own ServiceAccount credential is refused outright and confirm does NOT override it: that delete revokes the credential it is running on. Both refusals are raised on the dry_run path too, so a preview never shows a green wouldDelete for a delete that would be rejected.

Args: name: Namespace name to delete. dry_run: If True, preview without deleting. confirm: Acknowledge deleting a protected control-plane namespace. target: k8s target name from config.

[READ] List ingresses (name, namespace, class, hosts, age).

Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[READ] Return detail for a single ingress, including path→backend rules.

Args: name: Ingress name (see ingress_list). namespace: Namespace; omit for the target's default namespace. target: k8s target name from config.

[READ] List endpoints (name, namespace, ready addresses, ports, age).

Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[READ] List cluster nodes (name, status, roles, version, schedulable, age).

Args: target: k8s target name from config; omit to use the default.

[READ] Describe a node: capacity, allocatable, conditions, taints.

Args: name: Node name (see node_list). target: k8s target name from config.

[WRITE][risk=medium] Mark a node unschedulable (no new pods land). Inverse: uncordon_node.

Pass dry_run=True to preview without cordoning.

Args: name: Node name (see node_list). dry_run: If True, preview without cordoning. target: k8s target name from config.

[WRITE][risk=medium] Mark a node schedulable again. Inverse: cordon_node.

Pass dry_run=True to preview without uncordoning.

Args: name: Node name (see node_list). dry_run: If True, preview without uncordoning. target: k8s target name from config.

[WRITE][risk=high] Cordon a node and evict its pods. HIGH RISK — no full undo.

DaemonSet-managed and mirror pods are skipped (like kubectl drain). The cordon is reversible (uncordon_node); the evictions are not. Pass dry_run=True to preview without draining.

Args: name: Node name (see node_list). dry_run: If True, preview without cordoning or evicting. target: k8s target name from config.

[READ] Rollout status: desired/updated/available/unavailable + paused.

Args: name: Deployment name. namespace: Namespace; omit for the target's default namespace. target: k8s target name from config.

[READ] List a deployment's rollout revisions (from its replicasets).

Args: name: Deployment name. namespace: Namespace; omit for the target's default namespace. target: k8s target name from config.

[WRITE][risk=high] Roll a deployment back to a prior revision. HIGH RISK.

Defaults to the immediately previous revision. No clean automatic inverse — re-deploy the intended image/revision to move forward again. Pass dry_run=True to preview without rolling back.

Args: name: Deployment name. namespace: Namespace; omit for the target's default namespace. to_revision: Specific revision to roll back to (0 = previous). dry_run: If True, preview without rolling back. target: k8s target name from config.

[WRITE][risk=medium] Pause a deployment's rollout. Inverse: rollout_resume.

Pass dry_run=True to preview without pausing.

Args: name: Deployment name. namespace: Namespace; omit for the target's default namespace. dry_run: If True, preview without pausing. target: k8s target name from config.

[WRITE][risk=medium] Resume a paused deployment's rollout. Inverse: rollout_pause.

Pass dry_run=True to preview without resuming.

Args: name: Deployment name. namespace: Namespace; omit for the target's default namespace. dry_run: If True, preview without resuming. target: k8s target name from config.

[WRITE][risk=medium] Update a deployment container's image. Inverse: restore previous.

Returns previous_image so the change can be undone. Pass dry_run=True to preview without changing anything (no undo is recorded for a preview).

Args: name: Deployment name. container: Container name within the pod template (see deployment_get). image: New image reference (e.g. "nginx:1.27"). namespace: Namespace; omit for the target's default namespace. dry_run: If True, preview without updating the image. target: k8s target name from config.

[READ] List persistent volume claims (name, status, capacity, class, age).

Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[READ] Return detail for a single PVC by name.

Args: name: PVC name (see pvc_list). namespace: Namespace; omit for the target's default namespace. target: k8s target name from config.

[READ] List persistent volumes (name, capacity, status, claim, class, age).

Args: target: k8s target name from config; omit to use the default.

[READ] List storage classes (name, provisioner, reclaim policy, default).

Args: target: k8s target name from config; omit to use the default.

[READ] List recorded, not-yet-applied undo tokens (most recent first).

Each entry names the original tool, the inverse tool that undo_apply would run, and a human note. Use the undoId with undo_apply.

Returns {"undos": [...], "returned": N, "limit": L, "truncated": bool}. truncated is measured (one extra row is fetched), not guessed from a length coincidence: when it is true there are MORE tokens than shown, so re-run with a higher limit rather than reporting the list as complete.

Each entry carries effectVerified. False means the original write lost its response, so the change it reverses is PROBABLE, not confirmed — check the live state before applying, and do not report the result as a restore of a state that may never have been reached.

Args: limit: Max rows to return (default 50, capped at 500). target: Unused (undo state is host-local); accepted for CLI uniformity.

[WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool.

The inverse runs through its own governed tool, so it is audited and labelled with its own risk tier there. Pass dry_run=True to preview the inverse call without executing it. A token can only be applied once.

Args: undo_id: The undoId from undo_list (or an _undo_id in a write result). dry_run: If True, preview the inverse tool + params without running it. target: Passed through to the inverse tool when it accepts a target.

[READ] List pods (name, namespace, phase, ready, restarts, node, age).

Omit namespace to list across all namespaces. Use pod_get for full detail.

Args: namespace: Namespace to scope to; omit for all namespaces. label_selector: Optional label selector, e.g. "app=web". target: k8s target name from config; omit to use the default.

[READ] Return detail for a single pod by name.

Args: name: Pod name (see pod_list). namespace: Namespace; omit to use the target's default namespace. target: k8s target name from config.

[READ] Return the most recent log lines for a pod (default 100).

Args: name: Pod name. namespace: Namespace; omit for the target's default namespace. tail_lines: Number of trailing log lines to return. container: Container name (required only for multi-container pods). target: k8s target name from config.

[READ] List deployments (name, namespace, desired/ready/available, age).

Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[READ] Return detail for a single deployment by name.

Args: name: Deployment name (see deployment_list). namespace: Namespace; omit for the target's default namespace. target: k8s target name from config.

[READ] List services (name, namespace, type, cluster IP, ports).

Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[READ] List recent events (type, reason, object, message, age).

Useful for diagnosing why a pod is not starting (FailedScheduling, etc.).

Returns {"events": [...], "returned": N, "limit": L, "truncated": bool}. When truncated is true there are MORE events than shown — re-run with a higher limit instead of reporting the shown set as complete.

Args: namespace: Namespace; omit for all namespaces. limit: Maximum number of events to return. target: k8s target name from config.