List or fetch K8s resources, returning summarized key fields per resource.

Read-only: runs kubectl get -o json only — never creates, mutates, or deletes anything, and is safe to call repeatedly (idempotent). Requires a kubeconfig with read/list access to the target kind/namespace; raises on kubectl failure (e.g. NotFound, Forbidden, unreachable cluster). Output is summarized (not raw spec) to keep tokens low; Secret/ConfigMap values are never included. For deeper detail (events, conditions, container info), use k8s_describe.

Args: kind: Resource kind. Common: pod, svc, deploy, sts, ds, cm, secret, ns, node, ingress, gateway, virtualservice, destinationrule, hpa, pvc. namespace: Target namespace; omit to scan all namespaces. name: Specific resource name; omit to list multiple. selector: K8s label selector, e.g. "app=foo,env=prod". context: kubeconfig context to use; defaults to current context.

Describe a single K8s resource (text output from kubectl describe).

Read-only: runs kubectl describe only — never mutates the cluster, idempotent. Requires read access to the resource; raises on kubectl failure (e.g. NotFound, Forbidden). Returns human-readable TEXT (not JSON), truncated to ~30 KB. Use when k8s_get isn't enough — describe shows events, conditions, container details, volume mounts, image pull state, etc.

Args: kind: Resource kind. name: Resource name (required). namespace: Target namespace. context: kubeconfig context.

Fetch logs from a pod.

Read-only: runs kubectl logs only — never mutates the cluster, idempotent. Requires read access to pod logs; raises on kubectl failure (e.g. pod NotFound, container not yet started, Forbidden). Output is truncated to ~50 KB.

Args: pod: Pod name (required). namespace: Target namespace. container: Container name in multi-container pods. tail: Lines from the tail (default 100, hard max 1000). since: Look-back window like "5m", "1h"; only logs newer than this. previous: If True, fetch the previous container instance's logs (post-crash). context: kubeconfig context.

List recent K8s events, most recent first.

Read-only: lists events only — never mutates the cluster, idempotent. Requires read access to events; raises on kubectl failure. Use this to surface scheduling failures, image pull problems, OOMKilled, network issues, etc. Filter by namespace and/or involved object.

Args: namespace: Target namespace; omit for cluster-wide. kind: Filter by involvedObject.kind (e.g. "Pod"). name: Filter by involvedObject.name (use with kind). since: Look-back window (default "30m"). Format: "Ns", "Nm", "Nh", "Nd". context: kubeconfig context.

⭐ Start here for cluster diagnostics. Single call returns: problem pods, recent warning events, unhealthy nodes, and stale deployments.

Read-only: fans out several kubectl get calls only — never mutates the cluster, idempotent. Requires read access cluster-wide (or to the given namespace); individual sub-queries that are Forbidden/absent are skipped rather than aborting. Use this as the FIRST tool for broad questions like "what's wrong with this cluster", "anything broken", or "give me a health summary", then dig deeper with k8s_describe / k8s_logs / k8s_events.

Args: namespace: Limit scope to a single namespace; omit for cluster-wide. since: Event recency window (default "1h"). Format: "Ns", "Nm", "Nh", "Nd". context: kubeconfig context.

⭐ One-shot comprehensive cluster snapshot. Use for documentation, audits, or any task that needs broad visibility — replaces ~50 individual k8s_get calls.

Read-only: fans out many kubectl get -o json calls only — never mutates the cluster, idempotent. Requires broad read access (or read on the given namespace); kinds that are Forbidden/absent are skipped silently rather than failing the whole call. Pods are excluded from the payload (counts only).

Modes:

• "full" (default): expand each namespaced item to its summarized form (deployment images, service ports, etc.). Use for documentation or audits.

• "overview": skip per-item expansion. Each namespace entry carries only a by_kind_counts map. ~10-20× smaller payload. Use to scan cluster shape before drilling in with namespace-scoped follow-up calls.

By default, ConfigMap and Secret lists are EXCLUDED — they are typically the largest noise-to-signal source in cluster-wide inventories. Set include_config_resources=True to include them in by_kind_counts and the per-namespace breakdown. ConfigMap data and Secret values are NEVER returned — only metadata.

Pods are NOT included in the snapshot (potentially huge); only per-namespace pod counts are surfaced. Use k8s_triage for pod health, k8s_get pod for specifics.

Istio CRDs (Gateway / VirtualService / DestinationRule) are auto-included when present; absent CRDs are silently skipped. Set include_istio=False to skip.

Args: namespace: Limit scope to a single namespace; omit for cluster-wide. mode: "full" (default, expand items) or "overview" (counts only). include_config_resources: Include ConfigMaps and Secrets (default False). include_istio: Auto-detect and include Istio CRDs (default True). context: kubeconfig context.