kubernetes-safety-workflow

name	Kubernetes Safety Workflow
description	Safe operating workflow for Kubernetes MCP tasks: read-only evidence first, no direct production mutation without approval, and verification after any approved change.

Kubernetes Safety Workflow

Use this skill for any Kubernetes work done through MCP tools.

When to use

• The user asks to diagnose, inspect, restart, scale, patch, roll back, or verify Kubernetes workloads.
• A Studio pipeline uses Kubernetes MCP tools.
• The target cluster, namespace, workload, or environment matters.

Mandatory workflow

1. Start with read-only inventory or workload inspection.
2. Resolve the exact cluster/context, namespace, workload kind, and workload name before any action.
3. Treat diagnosis as read-only unless the user explicitly asks for remediation.
4. For any mutation, require a separate approval-gated workflow with target, reason, blast radius, rollback plan, and verification.
5. Verify after approved mutations using read-only tools.
6. Report uncertainty instead of guessing a namespace, context, or workload.

Hard rules

• Never run raw kubectl apply, delete, exec, port-forward, or node debug through a generic MCP tool.
• Never mutate production workloads from a diagnosis draft.
• Never restart, scale, patch, label, annotate, cordon, or drain without approval and prior read-only evidence.
• Never use a cluster-admin kubeconfig as the default execution credential.
• Prefer GitOps or provider-native workflows for planned production changes.

Diagnosis Draft Shape

1. Manual trigger.
2. Read-only MCP call such as kubernetes_describe_workload.
3. Analysis step over the read-only output.
4. Report output with target, findings, confidence, and next safe checks.

Reporting

The final report should state:

• cluster/context, namespace, workload kind, and workload name
• evidence used for the diagnosis
• likely causes and confidence
• blast radius and affected owner/team when known
• safe next checks
• whether any remediation requires a separate approved workflow