k8s AIops

[READ] List deployments (name, namespace, desired/ready/available, age). Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[WRITE][risk=high] Cordon a node and evict its pods. HIGH RISK — no full undo. DaemonSet-managed and mirror pods are skipped (like ``kubectl drain``). The cordon is reversible (uncordon_node); the evictions are not. Pass dry_run=True to preview without draining. Args: name: Node name (see node_list). dry_run: If True, preview without cordoning or evicting. target: k8s target name from config.

[READ] List endpoints (name, namespace, ready addresses, ports, age). Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[READ] List recent events (type, reason, object, message, age). Useful for diagnosing why a pod is not starting (FailedScheduling, etc.). Returns {"events": [...], "returned": N, "limit": L, "truncated": bool}. When ``truncated`` is true there are MORE events than shown — re-run with a higher ``limit`` instead of reporting the shown set as complete. Args: namespace: Namespace; omit for all namespaces. limit: Maximum number of events to return. target: k8s target name from config.

[READ] Return detail for a single ingress, including path→backend rules. Args: name: Ingress name (see ingress_list). namespace: Namespace; omit for the target's default namespace. target: k8s target name from config.

[READ] List ingresses (name, namespace, class, hosts, age). Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[READ] Return detail for a single job by name. Args: name: Job name (see job_list). namespace: Namespace; omit for the target's default namespace. target: k8s target name from config.

[READ] List jobs (name, namespace, completions, succeeded/failed, age). Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[READ] List namespaces (name, phase, age). Args: target: k8s target name from config; omit to use the default.

[READ] Describe a node: capacity, allocatable, conditions, taints. Args: name: Node name (see node_list). target: k8s target name from config.

[READ] List cluster nodes (name, status, roles, version, schedulable, age). Args: target: k8s target name from config; omit to use the default.

[READ] CPU/memory usage per node (requires metrics-server). Returns ``available: False`` with a clear message when metrics-server is not installed. Args: target: k8s target name from config; omit to use the default.

[READ] Describe a pod: status, conditions, container states, recent events. The fastest single call to diagnose why a pod is not Ready (CrashLoopBackOff, ImagePullBackOff, scheduling failures). Args: name: Pod name (see pod_list). namespace: Namespace; omit for the target's default namespace. target: k8s target name from config.

[READ] Return detail for a single pod by name. Args: name: Pod name (see pod_list). namespace: Namespace; omit to use the target's default namespace. target: k8s target name from config.

[READ] Scan pods for CrashLoopBackOff, image-pull failures, OOMKilled, unschedulable Pending pods, and high restart counts. Returns worst-first findings, each citing the reason string / restart count that tripped it plus a concrete kubectl action. Omit namespace to scan all. Args: namespace: Namespace to scope to; omit for all namespaces. label_selector: Optional label selector, e.g. "app=web". target: k8s target name from config; omit to use the default.

[READ] List pods (name, namespace, phase, ready, restarts, node, age). Omit namespace to list across all namespaces. Use pod_get for full detail. Args: namespace: Namespace to scope to; omit for all namespaces. label_selector: Optional label selector, e.g. "app=web". target: k8s target name from config; omit to use the default.

[READ] Return the most recent log lines for a pod (default 100). Args: name: Pod name. namespace: Namespace; omit for the target's default namespace. tail_lines: Number of trailing log lines to return. container: Container name (required only for multi-container pods). target: k8s target name from config.

[READ] CPU/memory usage per pod (requires metrics-server). Returns ``available: False`` with a clear message when metrics-server is not installed. Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[READ] List persistent volumes (name, capacity, status, claim, class, age). Args: target: k8s target name from config; omit to use the default.

[READ] Return detail for a single PVC by name. Args: name: PVC name (see pvc_list). namespace: Namespace; omit for the target's default namespace. target: k8s target name from config.

[READ] List persistent volume claims (name, status, capacity, class, age). Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[READ] List replicasets (name, namespace, desired/ready, age). Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[READ] List a deployment's rollout revisions (from its replicasets). Args: name: Deployment name. namespace: Namespace; omit for the target's default namespace. target: k8s target name from config.

[WRITE][risk=medium] Pause a deployment's rollout. Inverse: rollout_resume. Pass dry_run=True to preview without pausing. Args: name: Deployment name. namespace: Namespace; omit for the target's default namespace. dry_run: If True, preview without pausing. target: k8s target name from config.

[WRITE][risk=medium] Trigger a rolling restart of a deployment. No clean undo. Pass dry_run=True to preview without restarting. Args: name: Deployment name. namespace: Namespace; omit for the target's default namespace. dry_run: If True, preview without restarting. target: k8s target name from config.

[WRITE][risk=medium] Resume a paused deployment's rollout. Inverse: rollout_pause. Pass dry_run=True to preview without resuming. Args: name: Deployment name. namespace: Namespace; omit for the target's default namespace. dry_run: If True, preview without resuming. target: k8s target name from config.

[READ] Rollout status: desired/updated/available/unavailable + paused. Args: name: Deployment name. namespace: Namespace; omit for the target's default namespace. target: k8s target name from config.

[WRITE][risk=high] Roll a deployment back to a prior revision. HIGH RISK. Defaults to the immediately previous revision. No clean automatic inverse — re-deploy the intended image/revision to move forward again. Pass dry_run=True to preview without rolling back. Args: name: Deployment name. namespace: Namespace; omit for the target's default namespace. to_revision: Specific revision to roll back to (0 = previous). dry_run: If True, preview without rolling back. target: k8s target name from config.

[WRITE][risk=medium] Scale a deployment to ``replicas``. Inverse: restore previous count. Returns ``previous_replicas`` so the change can be undone. Pass dry_run=True to preview without changing anything (no undo is recorded for a preview). Args: name: Deployment name. replicas: Desired replica count. namespace: Namespace; omit for the target's default namespace. dry_run: If True, preview without scaling. target: k8s target name from config.

[WRITE][risk=medium] Scale a statefulset to ``replicas``. Inverse: restore previous count. Pass dry_run=True to preview without scaling (no undo is recorded for a preview). Args: name: StatefulSet name. replicas: Desired replica count. namespace: Namespace; omit for the target's default namespace. dry_run: If True, preview without scaling. target: k8s target name from config.

[READ] List secrets — names, types, and key NAMES only (values redacted). Secret VALUES are never returned. Use this to discover which secrets and keys exist, then mount/reference them via the kubeconfig-authorized workload. Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[READ] List services (name, namespace, type, cluster IP, ports). Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[WRITE][risk=medium] Update a deployment container's image. Inverse: restore previous. Returns ``previous_image`` so the change can be undone. Pass dry_run=True to preview without changing anything (no undo is recorded for a preview). Args: name: Deployment name. container: Container name within the pod template (see deployment_get). image: New image reference (e.g. "nginx:1.27"). namespace: Namespace; omit for the target's default namespace. dry_run: If True, preview without updating the image. target: k8s target name from config.

[READ] Return detail for a single statefulset by name. Args: name: StatefulSet name (see statefulset_list). namespace: Namespace; omit for the target's default namespace. target: k8s target name from config.

[READ] List statefulsets (name, namespace, desired/ready/current, age). Args: namespace: Namespace; omit for all namespaces. target: k8s target name from config.

[READ] List storage classes (name, provisioner, reclaim policy, default). Args: target: k8s target name from config; omit to use the default.

[WRITE][risk=medium] Mark a node schedulable again. Inverse: cordon_node. Pass dry_run=True to preview without uncordoning. Args: name: Node name (see node_list). dry_run: If True, preview without uncordoning. target: k8s target name from config.

[WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool. The inverse runs through its own governed tool, so it is audited and labelled with its own risk tier there. Pass dry_run=True to preview the inverse call without executing it. A token can only be applied once. Args: undo_id: The undoId from undo_list (or an ``_undo_id`` in a write result). dry_run: If True, preview the inverse tool + params without running it. target: Passed through to the inverse tool when it accepts a target.

[READ] List recorded, not-yet-applied undo tokens (most recent first). Each entry names the original tool, the inverse tool that ``undo_apply`` would run, and a human note. Use the ``undoId`` with ``undo_apply``. Returns {"undos": [...], "returned": N, "limit": L, "truncated": bool}. ``truncated`` is *measured* (one extra row is fetched), not guessed from a length coincidence: when it is true there are MORE tokens than shown, so re-run with a higher ``limit`` rather than reporting the list as complete. Each entry carries ``effectVerified``. False means the original write lost its response, …

[READ] Scan Deployments/StatefulSets/DaemonSets for ready-vs-desired shortfalls, zero-ready outages, and rollout-stuck conditions. Returns worst-first findings, each citing the measured ready/desired ratio or the failing condition reason plus a concrete kubectl action. Args: namespace: Namespace to scope to; omit for all namespaces. target: k8s target name from config; omit to use the default.