一键在 Manus 中运行任何 Skill

kubernetes-safety-workflow

星标3

分支0

更新时间2026年7月2日 15:03

Safe operating workflow for Kubernetes MCP tasks: read-only evidence first, no direct production mutation without approval, and verification after any approved change.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

LLprod39

LLprod39/WebTerm

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

Kubernetes Safety Workflow

Use this skill for any Kubernetes work done through MCP tools.

When to use

The user asks to diagnose, inspect, restart, scale, patch, roll back, or verify Kubernetes workloads.
A Studio pipeline uses Kubernetes MCP tools.
The target cluster, namespace, workload, or environment matters.

Mandatory workflow

Start with read-only inventory or workload inspection.
Resolve the exact cluster/context, namespace, workload kind, and workload name before any action.
Treat diagnosis as read-only unless the user explicitly asks for remediation.
For any mutation, require a separate approval-gated workflow with target, reason, blast radius, rollback plan, and verification.
Verify after approved mutations using read-only tools.
Report uncertainty instead of guessing a namespace, context, or workload.

Hard rules

Never run raw kubectl apply, delete, exec, port-forward, or node debug through a generic MCP tool.
Never mutate production workloads from a diagnosis draft.
Never restart, scale, patch, label, annotate, cordon, or drain without approval and prior read-only evidence.
Never use a cluster-admin kubeconfig as the default execution credential.
Prefer GitOps or provider-native workflows for planned production changes.

Diagnosis Draft Shape

Manual trigger.
Read-only MCP call such as kubernetes_describe_workload.
Analysis step over the read-only output.
Report output with target, findings, confidence, and next safe checks.

Reporting

The final report should state:

cluster/context, namespace, workload kind, and workload name
evidence used for the diagnosis
likely causes and confidence
blast radius and affected owner/team when known
safe next checks
whether any remediation requires a separate approved workflow

同仓库更多 Skills

同仓库

frontend-ux-ui-structure

LLprod39/WebTerm

UX-first frontend implementation guidance for layout clarity, predictable actions, accessibility, scanability, forms, responsive behavior, and feedback states.

2026-07-023

keycloak-prod-profile

LLprod39/WebTerm

Environment skill for Keycloak PROD operations. Pins work to the prod profile and requires extra caution before mutations.

2026-06-163

open-design

LLprod39/WebTerm

Skill-driven design and implementation based on Open Design principles. Use when creating new applications, UI components, or design artifacts to ensure high fidelity and brand consistency through a structured Discovery Loop and DESIGN.md enforcement.

2026-05-203

lunix-docker-ops

LLprod39/WebTerm

Автосгенерированный operational skill на основе повторяющегося паттерна `echo '===== DISK SPACE ====='; df -h; echo; echo '===== RUNNING CONTAINERS ====='; docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Sta…` для сервера lunix.

2026-04-083

keycloak-safety-workflow

LLprod39/WebTerm

Safe operating workflow for Keycloak MCP tasks: preflight, exact target resolution, explicit profile usage, and verification after every mutation.

2026-03-193

keycloak-test-profile

LLprod39/WebTerm

Environment skill for Keycloak TEST operations. Pins work to the test profile and blocks profile switching.

2026-03-193

name	Kubernetes Safety Workflow
description	Safe operating workflow for Kubernetes MCP tasks: read-only evidence first, no direct production mutation without approval, and verification after any approved change.

Kubernetes Safety Workflow

Use this skill for any Kubernetes work done through MCP tools.

When to use

The user asks to diagnose, inspect, restart, scale, patch, roll back, or verify Kubernetes workloads.
A Studio pipeline uses Kubernetes MCP tools.
The target cluster, namespace, workload, or environment matters.

Mandatory workflow

Start with read-only inventory or workload inspection.
Resolve the exact cluster/context, namespace, workload kind, and workload name before any action.
Treat diagnosis as read-only unless the user explicitly asks for remediation.
For any mutation, require a separate approval-gated workflow with target, reason, blast radius, rollback plan, and verification.
Verify after approved mutations using read-only tools.
Report uncertainty instead of guessing a namespace, context, or workload.

Hard rules

Never run raw kubectl apply, delete, exec, port-forward, or node debug through a generic MCP tool.
Never mutate production workloads from a diagnosis draft.
Never restart, scale, patch, label, annotate, cordon, or drain without approval and prior read-only evidence.
Never use a cluster-admin kubeconfig as the default execution credential.
Prefer GitOps or provider-native workflows for planned production changes.

Diagnosis Draft Shape

Manual trigger.
Read-only MCP call such as kubernetes_describe_workload.
Analysis step over the read-only output.
Report output with target, findings, confidence, and next safe checks.

Reporting

The final report should state:

cluster/context, namespace, workload kind, and workload name
evidence used for the diagnosis
likely causes and confidence
blast radius and affected owner/team when known
safe next checks
whether any remediation requires a separate approved workflow