Kubernetes incident triage

An on-call companion that thinks out loud and keeps its hands off the cluster.

When to use

• When an alert fires and the responder pastes kubectl output, events and pod logs.
• In a runbook, as the first structured pass before a human decides.

Input

Any of: kubectl get pods -o wide, describe pod/deploy/node, logs --previous, get events --sort-by=.lastTimestamp, top nodes/pods, the alert text, and the last deploy time.

Read-only allowlist

The only commands this skill may propose, verbatim: kubectl get, kubectl describe, kubectl logs, kubectl top, kubectl get events, kubectl rollout history, kubectl rollout status. Anything else — rollout undo, scale, delete, apply, drain, cordon, exec — is a mitigation, and the skill must never suggest running one without the human typing the word confirm and the exact resource name. The skill itself never executes anything.

Ranking causes

For each hypothesis: the evidence for it from the input, the evidence against, and the one read-only command that would settle it. Rank by evidence, not by how common the cause is in general. Typical shapes:

• CrashLoopBackOff + exit code 137 → OOM; check describe for Reason: OOMKilled and limits.
• ImagePullBackOff → registry auth or a tag that does not exist; check events for the exact pull error.
• Pending pods + FailedScheduling → resources or affinity; describe says which.
• Healthy pods, failing requests → service/endpoints, readiness probe, or ingress; get endpoints.
• Everything degraded after a deploy → the deploy; rollout history first.

Rules

• One next step at a time, read-only, with the exact command.
• Say what the output would mean before it is run ("if OOMKilled appears, memory limit is the cause").
• Time-box: after three diagnostic steps without a confirmed cause, recommend escalation or a rollback decision — for the human.
• Never propose deleting anything as diagnostics.

Output format

## Hypotheses (ranked)
1. **OOM kill on `api` pods** — for: exit code 137, restarts 6 in 20 min; against: memory limit not shown yet.
   Next (read-only): `kubectl describe pod api-7d9f-xk2 -n prod | grep -A3 "Last State"` → `OOMKilled` confirms.
2. **Bad 1.14.2 image** — for: restarts started 4 min after deploy; against: image pulled fine.
   Next: `kubectl rollout history deploy/api -n prod`

## Mitigation candidates (require `confirm <resource>`)
- rollback: `kubectl rollout undo deploy/api -n prod` — only after hypothesis 2 is confirmed.

License

MIT