Kubernetes operations
Use inventory and diagnostics while respecting the feature-gated boundary for sensitive cluster mutations.
Exact release scope. This page documents the reviewed v0.0.1 source at fcc5871. Check release status before enabling a gated capability.
Current availability
| Surface | v0.0.1 status | Default |
|---|---|---|
| Cluster and workload read paths | Preview / gated | Disabled |
| Pod logs and bounded diagnostics | Preview / gated | Disabled |
| Exec and port-forward | Contract-only | Disabled; built-in runtime does not execute |
| Helm mutation, RBAC administration, Secret writes, generic mutation | Contract-only | Disabled |
Read-only inventory
Inventory and diagnostics are scoped, authorized, bounded, and audited. Reads should report cluster identity, namespaces, workloads, pods, health, and safe metadata without leaking Secret values, bearer tokens, kubeconfigs, or raw dashboard endpoints.
- ✓Use the least-privileged ClusterPilot role and cluster credential boundary.
- ✓Apply namespace, label, size, and time limits before retrieving logs or inventory.
- ✓Preserve correlation IDs when escalating a read failure.
- ✓Do not turn a diagnostics endpoint into a generic kubectl proxy.
Sensitive mutation contract
High-risk operations require separate capability gates, authorization, admission preview, target restrictions, bounded runtime, audit, and evidence. v0.0.1 does not provide a general-purpose remote shell or unrestricted cluster mutation plane.
| Risk | Required controls |
|---|---|
| Remote command | Explicit target, command policy, no shell interpolation, bounded input/output/time, isolated execution. |
| Port forwarding | Approved service/port, short-lived session, origin and user binding, complete audit. |
| Secret/RBAC change | Typed operation, least privilege, diff preview, dual control where required, redacted evidence. |
| Helm/generic mutation | Immutable artifacts, server-side validation, conflict detection, health and rollback contract. |
Pod diagnostics
Start with workload status, conditions, events, container state, image identity, readiness, and bounded redacted logs. InvalidImageName, repeated @sha256:, pull-secret failures, unschedulable nodes, and failing probes require different recovery paths.