ingress2gateway-aws-mcp
This server is a conversational migration tool that converts Nginx Ingress configurations to AWS Gateway API (ALB/NLB) resources for Kubernetes clusters.
check_prerequisites: Verify that the target EKS environment meets all AWS Gateway API migration requirements, including AWS Load Balancer Controller version, Gateway API CRDs, feature gates, and ACM certificate coverage for TLS hostnames.analyze_ingress: Parse and analyze Nginx Ingress YAML to produce a structured report covering annotation compatibility, route type distribution (L4/L7), TLS hosts, cross-namespace references, and cost estimates. Supports TCP/UDP services ConfigMaps.convert_to_gateway_api: Run the full conversion pipeline from Nginx Ingress YAML tokubectl apply-ready AWS Gateway API YAML, including GatewayClass injection, TLS fixup, L4/L7 splitting, Gateway merging, and generation of AWS-specific CRDs (LoadBalancerConfiguration,TargetGroupConfiguration,ListenerRuleConfiguration). Supports customizable scheme, namespace, gateway grouping strategy, and health check parameters.generate_migration_report: Produce a comprehensive Markdown report covering summary, cost impact, DNS changes, annotation analysis, health check reminders, ACM certificate checklist, step-by-step migration checklist, and a rollback plan.validate_output: Offline-validate generated Gateway API YAML against schema rules and AWS LBC constraints, checking for required fields, L4/L7 mixing issues, impropercertificateRefsusage,parentRefconsistency, experimental channel requirements, and cross-namespace reference coverage.
Checks ACM certificate prerequisites for TLS hostnames during the migration process.
Provides tools for migrating Nginx Ingress to AWS Gateway API (ALB/NLB), including conversion, validation, and generation of migration reports.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@ingress2gateway-aws-mcpconvert the ingress file to AWS Gateway API YAML"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ingress2gateway-aws-mcp
MCP Server:将 Nginx Ingress 转换为 AWS Gateway API(ALB / NLB)资源的对话式迁移工具。
背景
Ingress-NGINX 已于 2026 年 3 月退役,AWS Load Balancer Controller v2.14+ 正式支持 Kubernetes Gateway API。本工具封装社区官方转换器 ingress2gateway,在其基础上叠加 AWS 专属后处理,提供对话式迁移体验。
Related MCP server: ARC Config MCP Server
工具列表
工具 | 功能 |
| 检查 LBC 版本、Gateway API CRD、feature gate、ACM 证书 |
| 分析 Nginx Ingress 注解分布、路由类型、成本预估 |
| 完整转换管道 → 生成可 |
| 输出 Markdown 迁移报告(成本/DNS/健康检查/Checklist) |
| 离线校验生成的 Gateway API YAML |
安装
方式一:本地 pip
pip install .需要 Python 3.11+。可选:安装 ingress2gateway Go 二进制以获得官方转换器覆盖;AWS LBC 不支持的能力仍会由本工具报告为 warning/error(不安装时自动使用内置转换器):
go install github.com/kubernetes-sigs/ingress2gateway@v1.1.0方式二:Docker
docker build -t ingress2gateway-aws-mcp .
docker run --rm -i ingress2gateway-aws-mcp连接到 AI 客户端
Kiro
Kiro CLI:
kiro-cli mcp add --name ingress2gateway-aws-mcp \
--scope global \
--command python3 \
--args "/path/to/ingress2gateway-aws-mcp/src/server.py"Kiro IDE(工作区:.kiro/settings/mcp.json,全局:~/.kiro/settings/mcp.json):
{
"mcpServers": {
"ingress2gateway-aws-mcp": {
"command": "python3",
"args": ["/path/to/ingress2gateway-aws-mcp/src/server.py"]
}
}
}Kiro IDE 支持热重载,修改 mcp.json 后无需重启,下次空闲时自动生效。
Claude
Claude Code CLI:
claude mcp add ingress2gateway-aws-mcp python3 /path/to/ingress2gateway-aws-mcp/src/server.pyClaude Desktop(~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"ingress2gateway-aws-mcp": {
"command": "python3",
"args": ["/path/to/ingress2gateway-aws-mcp/src/server.py"]
}
}
}EKS 集群前置要求
目标集群必须满足以下条件,生成的 YAML 才能成功 apply:
项目 | 要求 |
AWS LBC 版本 | ≥ v2.14.0(L7)/ ≥ v2.13.3(L4) |
LBC feature gate |
|
Gateway API standard channel | v1.5.0+(HTTPRoute / GRPCRoute / ReferenceGrant) |
Gateway API experimental channel | 仅当有 TCP/UDP/TLSRoute 或 BackendTLSPolicy 时需要 |
AWS 定制 CRD |
|
ACM 证书 | 每个 TLS hostname 在同 Region 有对应证书 |
Subnet 标签 |
|
快速搭建满足上述条件的集群,参见 infra/cluster.yaml。
使用示例
你:帮我分析一下这个 Ingress 文件
<粘贴 ingress.yaml 内容>
AI 调用 analyze_ingress →
返回注解兼容性报告、路由类型分布、成本预估
你:转换成 Gateway API YAML
AI 调用 convert_to_gateway_api → 返回可直接 apply 的 YAML
你:生成完整迁移报告
AI 调用 generate_migration_report → 返回 Markdown 报告示例输入文件见 examples/input/,对应转换结果见 examples/output/。
目录结构
转换管道概览
Ingress YAML
│
▼ converter.run() ← ingress2gateway 二进制 / 内置 Python 转换器
│
▼ gateway.inject() ← 注入 aws-alb / aws-nlb GatewayClass
▼ gateway.fix_tls() ← 移除 certificateRefs,改 hostname → ACM 自动发现
▼ gateway.split() ← L4/L7 强制分离,重写 parentRefs
▼ gateway.merge() ← 按策略合并 Gateway,控制 ALB/NLB 数量
│
▼ crd.generate_for_resources() ← LoadBalancerConfiguration(每个 Gateway)
▼ crd.generate_for_routes() ← TargetGroupConfiguration(每个 Service / 健康检查 / stickiness)
▼ crd.generate_for_ingresses() ← ListenerRuleConfiguration(OIDC / 源 IP)
▼ crd.attach_listener_rule_configs() ← 通过 HTTPRoute ExtensionRef 绑定认证 / 源 IP 条件
│
▼ 可 kubectl apply 的 Gateway API YAML文档
文档 | 内容 |
模块职责、转换管道数据流、AWS 资源模型、关键设计决策 | |
Nginx 注解兼容性速查表(auto / partial / warning / error 分类) | |
部署手册(本地/Docker/Kiro+Claude 接入、EKS 前置条件)+ 故障排查 |
开发
pip install -e ".[dev]"
pytest tests/ -vLicense
MIT - see the LICENSE file for details.
免责声明
本项目仅供学习与技术参考,不构成生产部署方案。
使用本工具生成的 Gateway API YAML 在 apply 到集群前,请结合实际业务进行安全评估与调整。
部署过程中会在 AWS 上创建 EKS 集群、ALB/NLB 及相关资源并产生费用,请在实验结束后及时清理。
作者不对因使用本项目产生的任何费用或损失承担责任。
本项目与 Amazon Web Services 及 Kubernetes SIGs 无官方关联,相关服务的可用性与定价以各方官方文档为准。
Available Tools
5 toolsanalyze_ingressA
Analyze Nginx Ingress configuration and return a structured summary. Reports annotation compatibility, route type distribution, TLS hosts, cross-namespace refs, and cost estimate.
Args: ingress_yaml: Nginx Ingress YAML content (multi-document supported) or file path. tcp_services_yaml: Optional tcp-services ConfigMap YAML for L4 TCP routes. udp_services_yaml: Optional udp-services ConfigMap YAML for L4 UDP routes.
| Name | Required | Description | Default |
|---|---|---|---|
| ingress_yaml | Yes | ||
| tcp_services_yaml | No | ||
| udp_services_yaml | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It states the tool analyzes and returns a summary but does not disclose whether it modifies anything, requires network access, or has rate limits. As an analysis tool, it is likely read-only, but this is not explicitly stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with a clear structure: a brief purpose paragraph followed by parameter details. Every sentence adds value, and the information is front-loaded. No redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool's purpose and parameters are well-covered. The description lists output components, and an output schema exists (though not shown). Missing behavioral context (e.g., error handling, idempotency) but adequate for the complexity. Could mention it is a static analysis tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description compensates excellently with an 'Args' bullet that explains each parameter's meaning, format (e.g., multi-document supported, file path), and optionality. This adds significant value beyond the schema's type and title.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool analyzes Nginx Ingress configuration and returns a structured summary listing specific aspects (annotation compatibility, route type distribution, etc.). However, it does not differentiate from sibling tools like check_prerequisites or convert_to_gateway_api, missing an explicit statement of its unique role.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. There is no mention of prerequisites, workflow positioning, or exclusions. The sibling tool names offer context, but the description itself lacks any usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_prerequisitesA
Check if the target environment meets AWS Gateway API migration prerequisites.
Args: lbc_version: AWS Load Balancer Controller version (e.g. "2.14.1"). Leave empty to skip. needs_l4: Set true if migration includes TCP/UDP/TLS routes (requires experimental channel). tls_hostnames: Comma-separated TLS hostnames to check ACM certificate coverage.
| Name | Required | Description | Default |
|---|---|---|---|
| needs_l4 | No | ||
| lbc_version | No | ||
| tls_hostnames | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavioral traits. It only lists parameters and their meanings, but does not describe what happens when prerequisites fail, whether the tool makes any changes, or other side effects. This is insufficient for a tool with no annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: one sentence for purpose followed by a parameter list. Every sentence adds value, and the structure is front-loaded with the main purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While an output schema exists (so return values are covered), the description lacks contextual completeness regarding behavior, side effects, or error handling. With no annotations, more detail is needed for a fully adequate description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema description coverage, the description provides clear, meaningful explanations for all three parameters (lbc_version, needs_l4, tls_hostnames), including default behaviors like 'Leave empty to skip' and conditions for setting needs_l4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Check if the target environment meets AWS Gateway API migration prerequisites.' It uses a specific verb ('Check') and resource ('prerequisites'), and distinguishes from sibling tools like convert_to_gateway_api.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage as a preliminary step for AWS Gateway API migration and explains parameter usage (e.g., 'Leave empty to skip' for lbc_version). However, it does not explicitly state when to use this tool versus alternatives or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
convert_to_gateway_apiA
Convert Nginx Ingress YAML to AWS Gateway API resources (full pipeline).
Steps: base conversion → GatewayClass injection → TLS fixup → L4/L7 split → Gateway merge → LoadBalancerConfiguration → TargetGroupConfiguration → ListenerRuleConfiguration
Args: ingress_yaml: Nginx Ingress YAML content or file path. tcp_services_yaml: Optional tcp-services ConfigMap YAML for TCP routes. udp_services_yaml: Optional udp-services ConfigMap YAML for UDP routes. scheme: ALB scheme — "internet-facing" or "internal". namespace: Default namespace if not specified in resources. alb_gateway_class: Name for the ALB GatewayClass (default: aws-alb). nlb_gateway_class: Name for the NLB GatewayClass (default: aws-nlb). gateway_grouping: Gateway consolidation strategy: "by-class-scheme" (default) | "by-namespace" | "by-host" | "single" health_check_path: TargetGroupConfiguration health check path. health_check_interval: TargetGroupConfiguration health check interval seconds. healthy_threshold: TargetGroupConfiguration healthy threshold count. unhealthy_threshold: TargetGroupConfiguration unhealthy threshold count.
| Name | Required | Description | Default |
|---|---|---|---|
| scheme | No | internet-facing | |
| namespace | No | default | |
| ingress_yaml | Yes | ||
| gateway_grouping | No | by-class-scheme | |
| alb_gateway_class | No | aws-alb | |
| health_check_path | No | / | |
| healthy_threshold | No | ||
| nlb_gateway_class | No | aws-nlb | |
| tcp_services_yaml | No | ||
| udp_services_yaml | No | ||
| unhealthy_threshold | No | ||
| health_check_interval | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It outlines the pipeline steps but does not disclose error handling, idempotency, or whether the tool is destructive (likely it returns converted YAML without side effects).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a summary line, pipeline steps, and parameter list. It front-loads the purpose. While slightly lengthy, the parameter list is justified due to low schema coverage.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (12 parameters, 0% schema coverage) and presence of output schema, the description covers the conversion pipeline and parameter meanings well. It lacks mention of error conditions or output format, but output schema may address that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description adds value by explaining most parameters, e.g., 'ingress_yaml: Nginx Ingress YAML content or file path' and 'gateway_grouping: Gateway consolidation strategy...'. However, some health-check parameters are only named without detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Convert Nginx Ingress YAML to AWS Gateway API resources (full pipeline)', with a specific verb and resource. It distinguishes from sibling tools like analyze_ingress and validate_output by being the actual conversion step.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for converting Nginx Ingress to AWS Gateway API but does not explicitly state when to use vs alternatives like check_prerequisites or generate_migration_report. No when-not guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_migration_reportB
Generate a complete Markdown migration report. Includes: summary, cost impact, DNS changes, annotation analysis, health check reminders, ACM checklist, migration checklist, and rollback plan.
Args: ingress_yaml: Nginx Ingress YAML content or file path. tcp_services_yaml: Optional tcp-services ConfigMap YAML. udp_services_yaml: Optional udp-services ConfigMap YAML. scheme: ALB scheme — "internet-facing" or "internal". gateway_grouping: Gateway consolidation strategy. lbc_version: AWS LBC version for pre-flight checks (optional). health_check_path: TargetGroupConfiguration health check path. health_check_interval: TargetGroupConfiguration health check interval seconds. healthy_threshold: TargetGroupConfiguration healthy threshold count. unhealthy_threshold: TargetGroupConfiguration unhealthy threshold count.
| Name | Required | Description | Default |
|---|---|---|---|
| scheme | No | internet-facing | |
| lbc_version | No | ||
| ingress_yaml | Yes | ||
| gateway_grouping | No | by-class-scheme | |
| health_check_path | No | / | |
| healthy_threshold | No | ||
| tcp_services_yaml | No | ||
| udp_services_yaml | No | ||
| unhealthy_threshold | No | ||
| health_check_interval | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description lacks any behavioral traits such as whether the tool is read-only, requires specific permissions, or has side effects. It only describes the output content, not the operational behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a bullet list of report contents and a clear parameter list. It is front-loaded with the purpose, and every sentence provides value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (10 parameters, output schema exists), the description covers the report contents and parameter roles. It lacks behavioral context and prerequisites, but is otherwise complete for a report generation tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description adds meaningful parameter explanations for most parameters (e.g., ingress_yaml, scheme, health check fields). Some parameters like gateway_grouping lack detailed meaning, but overall it compensates well.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it generates a comprehensive Markdown migration report and lists its contents. However, it does not explicitly differentiate from sibling tools like analyze_ingress or convert_to_gateway_api, which are more specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It implies a comprehensive use case but does not state when to prefer it or when to use sibling tools instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
validate_outputA
Validate Gateway API YAML against schema rules and AWS LBC constraints. Checks: required fields, L4/L7 mixing, certificateRefs misuse, parentRef consistency, experimental channel requirements, and cross-namespace reference coverage.
Args: yaml_content: Gateway API YAML content to validate, or file path.
| Name | Required | Description | Default |
|---|---|---|---|
| yaml_content | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden. It lists checks but does not disclose whether the tool is read-only, requires authentication, or has side effects. It does not describe the output format or error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with the main purpose stated first, followed by a bullet list of checks. Every sentence adds value without unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has only one parameter and uses an output schema, the description covers the key aspects: what the tool does, what it checks, and the parameter's dual nature. It is sufficient for a single-parameter validation tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, but the description adds meaning by clarifying that yaml_content can be either actual YAML content or a file path. This goes beyond the schema's type definition.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool validates Gateway API YAML against schema rules and AWS LBC constraints, listing specific checks like required fields, L4/L7 mixing, etc. This distinguishes it from siblings such as analyze_ingress or convert_to_gateway_api.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for validation but does not explicitly state when to use this tool versus alternatives. No exclusions or when-not-to-use guidance is provided; the sibling tools are not compared.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.1.0- First observed
analyze_ingress - First observed
check_prerequisites - First observed
convert_to_gateway_api - First observed
generate_migration_report - First observed
validate_output
TDQS
Scored across 5 tools
Each tool serves a distinct step in the migration pipeline: analysis, prerequisites check, conversion, validation, and report generation. No overlapping purposes.
All tools follow a consistent verb_noun pattern (e.g., analyze_ingress, check_prerequisites), with clear and specific verbs appropriate to the action.
5 tools cover the essential migration workflow without excess or deficiency. Each tool has a clear role and sufficient parameters.
The toolset covers the full migration lifecycle from analysis to validation and reporting, including prerequisites checking and rollback planning in the report. No obvious gaps.
Maintenance
Related MCP Connectors
Deploy, monitor, and manage your OpenClaw AI assistants via natural language.
Build, version, review, and export websites, web apps, and games from a conversation.
Fail-closed policy guardrails for AI agents running kubectl, terraform, helm, and argocd.
Convert Revit files to XKT, IFC, or DWG and query BIM data via natural language.
Related MCP Servers
- AlicenseNot gradedqualityNot gradedmaintenanceProvides a chat interface with natural language processing to deploy and manage AWS resources through an integrated Model Context Protocol (MCP) server.2-
- FlicenseNot gradedqualityCmaintenanceEnables natural language management of GitHub Actions Runner Controller (ARC) in Kubernetes clusters. Supports automated installation, scaling, monitoring, and troubleshooting of GitHub Actions runners through conversational AI commands.-
- AlicenseNot gradedqualityCmaintenanceEnables AI assistants to interact with Argo CD applications, managing clusters, applications, and resources through natural language.Apache 2.0
- AlicenseAqualityCmaintenanceExposes a Kubernetes cluster to MCP-compatible AI clients, enabling read-only and optional write operations on cluster resources like pods, deployments, and namespaces through natural language.91MIT