Show which signal providers (metrics-server/probe, Prometheus, Datadog, Splunk) are configured and reachable, and what each can answer. Read-only.

List namespaces this hub may inspect. Read-only.

Deployments/StatefulSets/DaemonSets/Jobs/CronJobs in a namespace with ready counts, restarts, images, and age. Start here when you do not know what runs where.

Service -> pods -> workload graph plus inferred dependencies (from env/ConfigMap references to Service names, and from probe-observed connections if include_connections=true). Flags Services with no ready endpoints.

One-call digest for a service: replicas, pod problems, recent warning events, usage vs requests/limits, golden signals if available. The first tool to call for 'is X healthy?'.

Pod phases, container states and waiting/terminated reasons (CrashLoopBackOff, OOMKilled, ImagePullBackOff...), restart counts, exit codes, unschedulable conditions. Give a service, a pod, or neither for the whole namespace.

Kubernetes events, warnings first, deduplicated with counts. Filter by object name prefix.

Sanitized, size-capped container logs for a service (up to 10 pods) or a pod. Use previous=true for the crashed container. grep accepts a substring or /regex/i.

Groups ERROR (and optionally WARN) log lines by signature (Java stack traces by exception + first app frame) with counts, first/last seen, and one redacted sample each. Read this instead of raw logs.

Resolved configuration of a workload: env (secret-sourced values shown as references, credential-looking keys redacted), ConfigMap previews, probes, resources, mounts, security context, plus findings (secrets in env, missing probes, JVM heap vs limit...).

Deployment revisions with image/env/resource diffs between them. Answers 'what changed in the last deploy?'.

One timeline of rollouts, scaling, HPA actions, ConfigMap updates, restarts, and notable events in a window. The first question in any incident.

CPU/memory usage vs requests and limits per container, CFS throttling ratio when known, OOM kills, restarts, with findings.

Is one replica the outlier? Per-pod usage, restarts, node, revision hash; flags hot pods, leaks, stuck rollouts, and no node spread.

Node conditions (Memory/Disk/PID pressure), allocatable vs requested vs used, overcommit, taints, cordons.

HorizontalPodAutoscalers: current/target metrics, at-max, unable-to-scale conditions.

Request rate, error rate, latency percentiles (and per endpoint) from the best available provider: Prometheus (windowed) or Actuator via the probe (cumulative).

Escape hatch: raw PromQL range query against the configured Prometheus, compacted (first/last/min/max/avg + 12 samples per series).

Slowest traces for a service from the tracing provider (none configured yet: returns guidance).

Critical-path view of one trace (needs a tracing provider).

Service -> EndpointSlice: matching pods, ready endpoints, targetPort vs containerPort mismatches. Catches the classic 'selector matches nothing'.

NetworkPolicies in a namespace, decoded; whether a given workload's ingress/egress is restricted; flags 'no policy = wide open'.

Ingress hosts/paths -> Services, TLS coverage, dangling backends.

[probe] Established connections by destination (resolved to Services/pods), socket state counts (TIME_WAIT/CLOSE_WAIT storms), listening ports - from /proc/net inside the pod's network namespace. Passive.

[probe] What the application actually binds (vs what the Service targets).

[probe, ACTIVE] Resolve a name from inside the pod (its resolv.conf, search domains, ndots). Requires DIAG_ALLOW_ACTIVE_CHECKS.

[probe, ACTIVE] TCP connect from inside the pod to host:port with latency and a diagnosis of the failure mode. Requires DIAG_ALLOW_ACTIVE_CHECKS.

[probe] RSS, threads, file descriptors vs limit, state, uptime per process (needs shareProcessNamespace on the pod to see the app).

[probe] Heap used/committed/max vs container limit, GC pause count/total/max, threads, classes, CPU seen by the JVM - from Actuator on localhost.

[probe] Actuator threaddump reduced to: threads by state, pool busy/total, lock contention, DEADLOCK detection, top stack signatures. Never the raw dump.

[probe] HikariCP active/idle/pending/max, acquire and usage times, timeouts. Pool exhaustion is the #1 Java+DB slowness cause.

[probe/Prometheus] Per-endpoint request rate, error rate, and latency (http.server.requests).

[probe] Latency/error rate per downstream target from http.client.requests: which dependency is slow, from the caller's view.

[probe] Actuator /health with component detail (db, diskSpace, redis, custom indicators).

Effective JVM flags and Spring env from the pod spec (redacted) with heap-vs-limit and GC findings; Actuator /info if a probe exists.

[probe] nginx stub_status per pod: active/reading/writing/waiting, accepts vs handled (drops).

[probe] Proxy access log aggregated: status classes, top paths with p50/p95, per-upstream latency and 504s, 499s (clients giving up), proxy-vs-upstream gap, scanner-like paths, sensitive data in the log. Never raw lines.

Parses the nginx config from the workload's ConfigMap: upstreams, locations, timeouts, buffering, gzip, cache headers for assets vs index.html, security headers, rate limits - with findings.

[probe] Served frontend build: JS/CSS/image bytes, largest files, hashed vs unhashed chunks, source maps shipped.

[ACTIVE] GET a URL from the hub and report missing security headers, version disclosure, cookie flags, HTTP->HTTPS redirect. Requires DIAG_ALLOW_ACTIVE_CHECKS.

[probe RUM] Core Web Vitals p75/p95 per route (LCP, INP, CLS, FCP, TTFB) with good/needs-improvement/poor ratings.

[probe RUM] Most visited routes, entry routes, sessions, device split.

[probe RUM] Navigation Timing phases per route (dns, connect, tls, ttfb, download, domInteractive, DCL, load) with a diagnosis of where full-page loads spend time.

[probe RUM] Browser-observed latency per API endpoint and slowest assets; compare with service-side and proxy-side numbers to localize slowness.

[probe RUM] JavaScript errors grouped by signature with counts, first/last seen, routes.

Static security findings with severity for workloads: privileged/root/host namespaces/capabilities/seccomp/rootfs, secrets in env, unpinned images, no limits, SA token automount, missing NetworkPolicy, over-privileged RBAC. No Secret contents are read.

What is reachable from outside: LoadBalancer/NodePort Services, Ingress routes (TLS or not), hostNetwork pods, management paths exposed.

Effective RBAC of the workload's ServiceAccount, with an over-privilege verdict.

Which Secrets are referenced by which workloads and how (env vs volume). Names/keys only, never values.

Ingress TLS coverage; with host (+port) and active checks enabled, performs a TLS handshake and reports expiry, issuer, protocol, chain trust.

Scans recent logs for PII (emails, cards with Luhn, SSNs, phones) and secrets (JWTs, cloud keys, Bearer/Basic, connection strings, PEM). Returns counts and masked samples only.

[probe] Where a pod currently talks to, classified (cluster service/pod, private, PUBLIC INTERNET, cloud metadata). Exfil and unexpected-dependency signal.

Images, registries, tags, running digests per workload with unpinned/latest/moved-tag findings. Input for a CVE scanner.

RUNBOOK: status -> events -> resources/throttling -> OOM/crash -> endpoints -> JVM/pool/downstreams -> log errors -> golden signals -> recent changes. Returns ranked hypotheses with evidence and the next tool to run. Start here for 'why is X broken/slow?'.

RUNBOOK for latency: per-endpoint latency, throttling, GC, connection pool, thread pool/locks, downstreams, proxy timeouts (pass proxy_service for the user-facing view).

RUNBOOK for a slow frontend route: vitals -> TTFB vs render split -> bundle/caching -> browser API latency -> service metrics. Pass proxy_service (nginx workload) and api_service.

RUNBOOK 'Monday morning' digest for a namespace: unhealthy pods, restarts, warnings, resource pressure, HPA at max, node pressure, endpoint problems, missing NetworkPolicies, security findings, TLS gaps, with suggested actions.