Kubernetes operations pack

v0.2.10

Operator pack for Kubernetes clusters: discovery (pods, nodes, services, deployments), deep introspection (describe, logs, events), rollouts (status, history, restart, undo), and narrow node/pod mutators (cordon, drain, delete). Cluster targeting via KUBECONFIG env var on the runner host; context selectable per call.

34 allowed by default 8 need approval by default 1 denied by default

Pack ID

kubernetes

Vendor

emisar

linux

Actions

Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.


              kubectl

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host

sudo emisar pack install kubernetes --hash sha256:de1110593ff86f4af7ae265272a989b7c322aa398e40cca23aa92c9c42da3bc8

Setup

kubectl finds the cluster and credentials from a kubeconfig on the runner host. Point it at one with KUBECONFIG , or rely on the default ~/.kube/config . Each action takes an optional context argument.

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

KUBECONFIG

Path (or colon-separated paths) to the kubeconfig file. Omit to use the default ~/.kube/config .

Notes

If KUBECONFIG is unset, kubectl reads ~/.kube/config on the runner host — a file, so it needs no inherit_env entry.
The kubeconfig must embed working credentials (client cert, token, or an exec auth plugin); whatever identity it carries gates which actions succeed, and mutators (cordon, drain, delete_pod) need RBAC for those verbs. Use auth_can_i to confirm what the identity may do.
RKE2: point KUBECONFIG at /etc/rancher/rke2/rke2.yaml on a server node (root-readable, mode 0600); for a remote runner rewrite its 127.0.0.1:6443 server URL to a reachable address. RKE2 does not bundle metrics-server, so nodes_top / pods_top error until one is installed. RKE2 host/etcd/containerd specifics live in the separate rke2 pack.

Verify it works

Runs kubernetes.cluster_info, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host

sudo emisar pack verify kubernetes

Install and configure a pack walks through the whole sequence on a host.

Actions 43 total

View on GitHub

kubernetes.api_versions exec low

kubectl api-versions

List API versions available on the cluster — useful for "does this k8s version support …?" checks.
View source on GitHub
kubernetes.auth_can_i exec low

List my RBAC permissions (auth can-i --list)

`kubectl auth can-i --list` — every action the kubeconfig identity is allowed, optionally scoped to one namespace. Confirms whether the runner's identity can perform the pack's mutators (drain, scale, delete). Read-only.
View source on GitHub
kubernetes.cluster_info exec low

kubectl cluster-info

Show API server, DNS, and CoreDNS endpoints for the configured cluster.
View source on GitHub
kubernetes.control_plane_health exec low

Control-plane readiness (/readyz?verbose)

`kubectl get --raw '/readyz?verbose'` — the API server's per-check readiness (etcd, scheduling, informers, …). The modern replacement for the deprecated componentstatuses API. Read-only.
View source on GitHub
kubernetes.cordon exec high

kubectl cordon node

Mark a node unschedulable. Existing pods stay; new pods won't be scheduled there. First step before draining.
View source on GitHub
kubernetes.crds_list exec low

List CustomResourceDefinitions

`kubectl get crd` — installed CustomResourceDefinitions (an inventory of the operators/controllers extending the cluster). Read-only.
View source on GitHub
kubernetes.cronjobs_list exec low

List CronJobs across all namespaces

`kubectl get cronjobs -A` — schedule, suspend state, last-schedule time, and active count. Read-only.
View source on GitHub
kubernetes.daemonsets_list exec low

List daemonsets

`kubectl get ds -A` — daemonset name, desired/current/ready counts, node selector.
View source on GitHub
kubernetes.delete_pod exec high

Delete one pod (force-restart-by-killing)

Delete one pod by name. Use to force-restart a single pod (the controller will recreate it). Faster than rollout_restart for a one-off bad pod. Namespace required to prevent wildcard mistakes.
View source on GitHub
kubernetes.deployments_list exec low

List deployments

`kubectl get deploy -A` — replica counts (desired/current/available), age, image references.
View source on GitHub
kubernetes.drain exec critical

kubectl drain node (cordon + evict)

Cordon the node and evict every pod that has a controller (Deployment/StatefulSet/etc). DaemonSets are ignored and emptyDir data is deleted with --delete-emptydir-data. Use before scheduled maintenance.
View source on GitHub
kubernetes.endpoints_list exec low

List endpoints across all namespaces

`kubectl get endpoints -A` — the ready backend IPs behind each Service. An empty endpoint set means a Service has no ready pods (a common "service is down but the Deployment looks fine" cause). Read-only.
View source on GitHub
kubernetes.events_for_pod exec low

Events for one pod

List field-selected events that reference one pod.
View source on GitHub
kubernetes.events_recent exec low

Recent cluster events

List the last 50 events across all namespaces, sorted by last timestamp.
View source on GitHub
kubernetes.events_warnings exec low

Recent Warning events (all namespaces)

List the most recent Warning-type events cluster-wide, oldest-to-newest (FailedScheduling, BackOff, FailedMount, Unhealthy, …). The fastest cluster-wide "what is wrong right now". Read-only.
View source on GitHub
kubernetes.get_yaml exec high

Get resource YAML

Return the full YAML definition of one resource. The kind enum keeps secrets, configmaps and arbitrary CRDs of unknown size out, but that does not make the read safe: every workload kind serialises its pod template, so `containers[].env[].value` literals and the `kubectl.kubernetes.io/last-applied-configuration` annotation come back verbatim — injected credentials with them. Approval-gated for that reason; the runner's redaction is a pattern-bound backstop, not a guarantee.
View source on GitHub
kubernetes.hpa_list exec low

List HorizontalPodAutoscalers

`kubectl get hpa -A` — targets (current/desired utilization), min/max replicas, and current replicas. Why a deployment is (or isn't) scaling. Read-only.
View source on GitHub
kubernetes.ingresses_list exec low

List ingresses across all namespaces

`kubectl get ingress -A` — ingress name, hosts, addresses, TLS hosts.
View source on GitHub
kubernetes.jobs_list exec low

List Jobs across all namespaces

`kubectl get jobs -A` — completions, duration, age. Spot failed or stuck batch jobs. Read-only.
View source on GitHub
kubernetes.namespaces exec low

List namespaces

`kubectl get ns` — every namespace with status + age.
View source on GitHub
kubernetes.networkpolicies_list exec low

List NetworkPolicies across all namespaces

`kubectl get networkpolicies -A` — which namespaces have NetworkPolicies and their pod selectors. Use when traffic is being unexpectedly allowed or blocked. Read-only.
View source on GitHub
kubernetes.node_describe exec low

kubectl describe node

Show the full describe output for one node — capacity, allocatable, conditions, addresses, taints, pods, events.
View source on GitHub
kubernetes.nodes_list exec low

List cluster nodes

`kubectl get nodes -o wide --show-labels` — node names, status, roles, age, k8s version, OS, kernel, container runtime. Read-only.
View source on GitHub
kubernetes.nodes_top exec low

Nodes by CPU + memory

`kubectl top nodes` — per-node CPU and memory utilization. Requires metrics-server.
View source on GitHub
kubernetes.pod_describe exec high

kubectl describe pod

Show the full describe output — events, container states, conditions, volume mounts, scheduled node. The canonical "why isn't this pod running?" answer. The `Environment:` block prints plain `env` values verbatim — only `valueFrom` references render as a placeholder — so injected credentials come back with them, the same exposure `kubernetes.get_yaml` carries. Approval-gated for that reason.
View source on GitHub
kubernetes.pod_logs exec medium

Tail pod logs

Tail the last N lines from one container in a pod.
View source on GitHub
kubernetes.pod_previous_logs exec medium

Tail PREVIOUS container logs (crash debug)

`kubectl logs --previous` — logs from the previously crashed container instance. The go-to action for CrashLoopBackOff: the current container has nothing yet, the crashed one explains why.
View source on GitHub
kubernetes.pods_list exec low

List pods across all namespaces

`kubectl get pods -A -o wide` — every pod with its node, IP, status, and age. Read-only.
View source on GitHub
kubernetes.pods_problem exec low

Pods NOT in Running/Succeeded

Filter pods to only those NOT in Running or Succeeded phase — Pending, Failed, CrashLoopBackOff, ImagePullBackOff, etc. The fastest "what's broken right now?" query. Read-only.
View source on GitHub
kubernetes.pods_top exec low

Pods by CPU (metrics-server)

`kubectl top pod -A --sort-by=cpu | head -50` — top 50 pods by CPU. Requires metrics-server to be installed. Read-only.
View source on GitHub
kubernetes.pv_list exec low

List PersistentVolumes

`kubectl get pv` — capacity, access modes, reclaim policy, status (Bound/Released/Available), bound claim, and storage class. Cluster-scoped; complements the namespaced pvcs_list. Read-only.
View source on GitHub
kubernetes.pvcs_list exec low

List PVCs across all namespaces

`kubectl get pvc -A` — persistent volume claims, bound state, size, storage class.
View source on GitHub
kubernetes.quotas_list exec low

ResourceQuota + LimitRange for a namespace

`kubectl -n <ns> get resourcequota,limitrange` — the quota usage and default request/limit ranges for one namespace. Why a pod can't be created ("exceeded quota") or gets unexpected defaults. Read-only.
View source on GitHub
kubernetes.rollout_history exec low

kubectl rollout history

Return the revision history for a deployment / statefulset / daemonset.
View source on GitHub
kubernetes.rollout_restart exec high

kubectl rollout restart (rolling)

Trigger a rolling restart — pods are replaced one-by-one respecting maxSurge/maxUnavailable. In-flight requests on terminated pods are gracefully drained per pod terminationGracePeriodSeconds.
View source on GitHub
kubernetes.rollout_status exec low

kubectl rollout status

Report the rollout progress of a deployment / statefulset / daemonset. Bounded with --watch=false so it returns immediately.
View source on GitHub
kubernetes.rollout_undo exec high

kubectl rollout undo (rollback)

Roll back to the previous revision. Bring `rollout_history` first to confirm what "previous" means in this case.
View source on GitHub
kubernetes.scale_deployment exec high

Scale a deployment

Set deployment replica count; 0 stops every pod and takes the workload offline. Use to scale up before a traffic event or scale down to drain.
View source on GitHub
kubernetes.services_list exec low

List services across all namespaces

`kubectl get svc -A` — service name, type, cluster IP, external IP, ports.
View source on GitHub
kubernetes.set_image exec high

Set deployment container image

Update one container's image in a deployment — triggers a rolling update. Container name and image ref are pattern-restricted.
View source on GitHub
kubernetes.statefulsets_list exec low

List statefulsets

`kubectl get sts -A` — statefulset name, ready/replicas, age.
View source on GitHub
kubernetes.storageclasses_list exec low

List StorageClasses

`kubectl get storageclass` — provisioner, reclaim policy, volume binding mode, and which is the default class. Read-only.
View source on GitHub
kubernetes.uncordon exec medium

kubectl uncordon node

Mark a node schedulable again. Reverse of cordon.
View source on GitHub

← Back to registry

Pack reference Publish your own