Menü
kubectl tools for inspecting and operating on Kubernetes clusters
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Basierend auf der SOC-Berufsklassifikation
Safe wrappers for common Unix utilities
Safe wrappers for common Unix utilities
Allow nerf tools without prompting (supports glob patterns like nerf-git-*)
Allow/deny nerf tools by threat profile (read/write ceiling)
Deny nerf tools entirely (supports glob patterns like nerf-git-*)
List nerf tool permissions across all scopes
| name | nerf-kubectl |
| description | kubectl tools for inspecting and operating on Kubernetes clusters |
| targets | ["*"] |
These tools are available as scripts within this plugin. Call them using the absolute paths shown in each usage line.
Tools for inspecting and operating on Kubernetes clusters. All tools are template-mode wrappers, so the agent can only pass the parameters declared here -- no arbitrary kubectl flags, no connection overrides, no short-flag stacks. Output is always JSON where applicable; pipe through jq for advanced extraction. kubectl-get refuses Secrets; use kubectl-get-secrets, which scrubs .data / .stringData / the last-applied-configuration annotation. Use az-aks-get-credentials to populate ~/.kube/config first, then kubectl-config-use-context to switch between configured clusters.
Show kubectl client and server version.
Usage: ${CLAUDE_PLUGIN_ROOT}/skills/nerf-kubectl/scripts/nerf-kubectl-version
Maps to: kubectl version --output json
No arguments.
List configured kubectl contexts.
Usage: ${CLAUDE_PLUGIN_ROOT}/skills/nerf-kubectl/scripts/nerf-kubectl-config-get-contexts
Maps to: kubectl config get-contexts
No arguments.
Show the currently active kubectl context.
Usage: ${CLAUDE_PLUGIN_ROOT}/skills/nerf-kubectl/scripts/nerf-kubectl-config-current-context
Maps to: kubectl config current-context
No arguments.
Switch to a different kubectl context. Marked admin because activating an admin-account context (e.g. one fetched via az-aks-get-credentials-admin) gives every subsequent kubectl call cluster-admin powers; the threat marker on this tool has to be at least as strict as the credential fetch that wrote the context. The harness should default-deny this tool whenever it default- denies az-aks-get-credentials-admin.
Usage: ${CLAUDE_PLUGIN_ROOT}/skills/nerf-kubectl/scripts/nerf-kubectl-config-use-context <context>
Maps to: kubectl config use-context <context>
Arguments:
<context> (required): Context name (from kubectl-config-get-contexts). must match ^[a-zA-Z0-9_]([a-zA-Z0-9._-]*[a-zA-Z0-9_])?$Show cluster info (API server URL, addons).
Usage: ${CLAUDE_PLUGIN_ROOT}/skills/nerf-kubectl/scripts/nerf-kubectl-cluster-info
Maps to: kubectl cluster-info
No arguments.
Get kubernetes resources. Returns JSON; pipe through jq for extraction. Refuses Secrets -- use kubectl-get-secrets instead, which redacts .data and .stringData.
Usage: ${CLAUDE_PLUGIN_ROOT}/skills/nerf-kubectl/scripts/nerf-kubectl-get [--all-namespaces|-A] [--show-labels] [--namespace|-n <namespace>] [--selector|-l <selector>] [--field-selector <field_selector>] <resource> [<name>]
Maps to: kubectl get <resource> <name> <namespace> <all_namespaces> <selector> <field_selector> <show_labels> --output json
Switches:
--all-namespaces, -A: List across all namespaces--show-labels: Include labels in the outputOptions:
--namespace|-n (optional): Namespace. must match ^[a-z0-9-]+$--selector|-l (optional): Label selector (e.g. app=foo,env!=prod)--field-selector (optional): Field selector (e.g. status.phase=Running)Arguments:
<resource> (required): Resource type (e.g. pods, services, deployments) or "kind/name". must match ^[a-z][a-zA-Z0-9.-]*(/[a-zA-Z0-9._-]+)?$<name> (optional): Specific resource name (optional). must match ^[a-zA-Z0-9._-]+$List Secret metadata with .data, .stringData, and ALL metadata.annotations removed. Cannot reveal secret values. Annotations are dropped wholesale because kubectl apply stores the rendered manifest (including .data) in the last-applied-configuration annotation, and operator-injected annotations may carry sensitive content. Labels are preserved. For secret values, go through az-keyvault or the secret-syncing source.
Usage: ${CLAUDE_PLUGIN_ROOT}/skills/nerf-kubectl/scripts/nerf-kubectl-get-secrets [--all-namespaces|-A] [--namespace|-n <namespace>] [--selector|-l <selector>] [<name>]
Switches:
--all-namespaces, -A: List across all namespacesOptions:
--namespace|-n (optional): Namespace. must match ^[a-z0-9-]+$--selector|-l (optional): Label selectorArguments:
<name> (optional): Specific secret name (optional). must match ^[a-z0-9.-]+$Describe a kubernetes resource. Refuses Secrets because "kubectl describe" prints the metadata.annotations section verbatim, and any Secret created via "kubectl apply" carries a kubectl.kubernetes.io/last-applied-configuration annotation containing the original (base64-encoded) .data, which would bypass kubectl-get-secrets' redaction.
Usage: ${CLAUDE_PLUGIN_ROOT}/skills/nerf-kubectl/scripts/nerf-kubectl-describe [--namespace|-n <namespace>] <resource> <name>
Maps to: kubectl describe <resource> <name> <namespace>
Options:
--namespace|-n (optional): Namespace. must match ^[a-z0-9-]+$Arguments:
<resource> (required): Resource type (e.g. pod, deployment). must match ^[a-z][a-zA-Z0-9.-]*$<name> (required): Resource name. must match ^[a-zA-Z0-9._-]+$Fetch pod logs (no follow). Use --tail to cap the line count. Combine with kubectl-get to poll if you need updates.
Usage: ${CLAUDE_PLUGIN_ROOT}/skills/nerf-kubectl/scripts/nerf-kubectl-logs [--previous|-p] [--namespace|-n <namespace>] [--container|-c <container>] [--tail <tail>] <pod>
Maps to: kubectl logs <pod> <namespace> <container> <tail> <previous>
Switches:
--previous, -p: Get logs from a previous container instance (after a crash/restart)Options:
--namespace|-n (optional): Namespace. must match ^[a-z0-9-]+$--container|-c (optional): Container name (when the pod has multiple). must match ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$--tail (optional): Number of recent lines to fetch. must match ^[0-9]+$Arguments:
<pod> (required): Pod name (or "pod/" form). must match ^(pod/)?[a-z0-9]([-a-z0-9.]*[a-z0-9])?$Show CPU and memory usage of pods.
Usage: ${CLAUDE_PLUGIN_ROOT}/skills/nerf-kubectl/scripts/nerf-kubectl-top-pods [--all-namespaces|-A] [--namespace|-n <namespace>] [--selector|-l <selector>]
Maps to: kubectl top pods <namespace> <all_namespaces> <selector>
Switches:
--all-namespaces, -A: List across all namespacesOptions:
--namespace|-n (optional): Namespace. must match ^[a-z0-9-]+$--selector|-l (optional): Label selectorShow CPU and memory usage of nodes.
Usage: ${CLAUDE_PLUGIN_ROOT}/skills/nerf-kubectl/scripts/nerf-kubectl-top-nodes [--selector|-l <selector>]
Maps to: kubectl top nodes <selector>
Options:
--selector|-l (optional): Label selectorList API resources supported by the cluster (resource names only).
Usage: ${CLAUDE_PLUGIN_ROOT}/skills/nerf-kubectl/scripts/nerf-kubectl-api-resources [--api-group <api_group>]
Maps to: kubectl api-resources --output name <api_group>
Options:
--api-group (optional): Filter by API group (e.g. apps, batch). must match ^[a-z0-9.-]*$List API group/versions supported by the cluster.
Usage: ${CLAUDE_PLUGIN_ROOT}/skills/nerf-kubectl/scripts/nerf-kubectl-api-versions
Maps to: kubectl api-versions
No arguments.
Show the schema documentation for a resource or field path.
Usage: ${CLAUDE_PLUGIN_ROOT}/skills/nerf-kubectl/scripts/nerf-kubectl-explain [--recursive] <resource>
Maps to: kubectl explain <resource> <recursive>
Switches:
--recursive: Print the entire schema recursivelyArguments:
<resource> (required): Resource type or field path (e.g. pod, pod.spec.containers). must match ^[a-z][a-zA-Z0-9.-]*$Execute a command in a pod (non-interactive, no TTY). Use this for one-shot diagnostics; for cluster mutations prefer Helm/Terraform.
Usage: ${CLAUDE_PLUGIN_ROOT}/skills/nerf-kubectl/scripts/nerf-kubectl-exec [--namespace|-n <namespace>] [--container|-c <container>] <pod> <command...>
Maps to: kubectl exec <pod> <namespace> <container> -- <command>
Options:
--namespace|-n (optional): Namespace. must match ^[a-z0-9-]+$--container|-c (optional): Container name (when the pod has multiple containers). must match ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$Arguments:
<pod> (required): Pod name. must match ^[a-z0-9]([-a-z0-9.]*[a-z0-9])?$<command...> (required): Command and args to run in the podForward a local port to a pod or service in the cluster. Wrapped with coreutils "timeout" so unattended runs cannot hang -- the forward is terminated after --timeout-seconds (required). Note that the wrapper exits 124 (the standard "timeout" exit code) when the time bound is reached; this is the expected success path for unattended diagnostics.
Usage: ${CLAUDE_PLUGIN_ROOT}/skills/nerf-kubectl/scripts/nerf-kubectl-port-forward --timeout-seconds <timeout_seconds> [--namespace|-n <namespace>] <target> <ports>
Maps to: timeout <timeout_seconds> kubectl port-forward <namespace> <target> <ports>
Options:
--timeout-seconds (required): Maximum seconds to keep the forward open (required; passed to coreutils timeout). must match ^[1-9][0-9]*$--namespace|-n (optional): Namespace. must match ^[a-z0-9-]+$Arguments:
<target> (required): Resource to forward to (e.g. pod/ or svc/). must match ^(pod|svc|service|deployment|deploy|statefulset|sts)/[a-z0-9]([-a-z0-9.]*[a-z0-9])?$<ports> (required): Port mapping (local:remote). must match ^[0-9]+:[0-9]+$Trigger a rolling restart of a deployment, daemonset, or statefulset.
Usage: ${CLAUDE_PLUGIN_ROOT}/skills/nerf-kubectl/scripts/nerf-kubectl-rollout-restart [--namespace|-n <namespace>] <target>
Maps to: kubectl rollout restart <namespace> <target>
Options:
--namespace|-n (optional): Namespace. must match ^[a-z0-9-]+$Arguments:
<target> (required): Resource to restart (e.g. deployment/). must match ^(deployment|deploy|daemonset|ds|statefulset|sts)/[a-z0-9]([-a-z0-9.]*[a-z0-9])?$Hit a bug, complaint, bypass-worthy guardrail, or want a feature? Use the nerf-report skill.