Follow the dedicated Claude Code getting started guide in our user documentation.

For a secure production setup with dedicated ServiceAccount and read-only access, also review the Kubernetes setup guide.

• configuration_contexts_list - List all available context names and associated server urls from the kubeconfig file

• targets_list - List all available targets

• configuration_view - Get the current Kubernetes configuration content as a kubeconfig YAML

  • minified (boolean) - Return a minified version of the configuration. If set to true, keeps only the current-context and the relevant pieces of the configuration for that context. If set to false, all contexts, clusters, auth-infos, and users are returned in the configuration. (Optional, default true)

• events_list - List Kubernetes events (warnings, errors, state changes) for debugging and troubleshooting in the current cluster from all namespaces

  • fieldSelector (string) - Optional Kubernetes field selector to filter events by field values (e.g. 'type=Warning', 'involvedObject.name=my-pod'). Supported fields: involvedObject.kind, involvedObject.name, involvedObject.namespace, involvedObject.uid, involvedObject.apiVersion, involvedObject.resourceVersion, involvedObject.fieldPath, reason, reportingComponent, source, type. See https://kubernetes.io/docs/concepts/overview/working-with-objects/field-selectors/
  • namespace (string) - Optional Namespace to retrieve the events from. If not provided, will list events from all namespaces

• namespaces_list - List all the Kubernetes namespaces in the current cluster

  • fieldSelector (string) - Optional Kubernetes field selector to filter namespaces by field values (e.g. 'metadata.name=default', 'status.phase=Active'). Supported fields: metadata.name, status.phase. See https://kubernetes.io/docs/concepts/overview/working-with-objects/field-selectors/

• projects_list - List all the OpenShift projects in the current cluster

• nodes_log - Get logs from a Kubernetes node (kubelet, kube-proxy, or other system logs). This accesses node logs through the Kubernetes API proxy to the kubelet

  • name (string) (required) - Name of the node to get logs from
  • query (string) (required) - query specifies services(s) or files from which to return logs (required). Example: "kubelet" to fetch kubelet logs, "/" to fetch a specific log file from the node (e.g., "/var/log/kubelet.log" or "/var/log/kube-proxy.log")
  • tailLines (integer) - Number of lines to retrieve from the end of the logs (Optional, 0 means all logs)

• nodes_stats_summary - Get detailed resource usage statistics from a Kubernetes node via the kubelet's Summary API. Provides comprehensive metrics including CPU, memory, filesystem, and network usage at the node, pod, and container levels. On systems with cgroup v2 and kernel 4.20+, also includes PSI (Pressure Stall Information) metrics that show resource pressure for CPU, memory, and I/O. See https://kubernetes.io/docs/reference/instrumentation/understand-psi-metrics/ for details on PSI metrics

  • name (string) (required) - Name of the node to get stats from

• nodes_top - List the resource consumption (CPU and memory) as recorded by the Kubernetes Metrics Server for the specified Kubernetes Nodes or all nodes in the cluster

  • label_selector (string) - Kubernetes label selector (e.g. 'node-role.kubernetes.io/worker=') to filter nodes by label (Optional, only applicable when name is not provided)
  • name (string) - Name of the Node to get the resource consumption from (Optional, all Nodes if not provided)

• pods_list - List all the Kubernetes pods in the current cluster from all namespaces

  • fieldSelector (string) - Optional Kubernetes field selector to filter pods by field values (e.g. 'status.phase=Running', 'spec.nodeName=node1'). Supported fields: metadata.name, metadata.namespace, spec.nodeName, spec.restartPolicy, spec.schedulerName, spec.serviceAccountName, status.phase (Pending/Running/Succeeded/Failed/Unknown), status.podIP, status.nominatedNodeName. Note: CrashLoopBackOff is a container state, not a pod phase, so it cannot be filtered directly. See https://kubernetes.io/docs/concepts/overview/working-with-objects/field-selectors/
  • labelSelector (string) - Optional Kubernetes label selector (e.g. 'app=myapp,env=prod' or 'app in (myapp,yourapp)'), use this option when you want to filter the pods by label

• pods_list_in_namespace - List all the Kubernetes pods in the specified namespace in the current cluster

  • fieldSelector (string) - Optional Kubernetes field selector to filter pods by field values (e.g. 'status.phase=Running', 'spec.nodeName=node1'). Supported fields: metadata.name, metadata.namespace, spec.nodeName, spec.restartPolicy, spec.schedulerName, spec.serviceAccountName, status.phase (Pending/Running/Succeeded/Failed/Unknown), status.podIP, status.nominatedNodeName. Note: CrashLoopBackOff is a container state, not a pod phase, so it cannot be filtered directly. See https://kubernetes.io/docs/concepts/overview/working-with-objects/field-selectors/
  • labelSelector (string) - Optional Kubernetes label selector (e.g. 'app=myapp,env=prod' or 'app in (myapp,yourapp)'), use this option when you want to filter the pods by label
  • namespace (string) (required) - Namespace to list pods from

• pods_get - Get a Kubernetes Pod in the current or provided namespace with the provided name

  • name (string) (required) - Name of the Pod
  • namespace (string) - Namespace to get the Pod from

• pods_delete - Delete a Kubernetes Pod in the current or provided namespace with the provided name

  • name (string) (required) - Name of the Pod to delete
  • namespace (string) - Namespace to delete the Pod from

• pods_top - List the resource consumption (CPU and memory) as recorded by the Kubernetes Metrics Server for the specified Kubernetes Pods in the all namespaces, the provided namespace, or the current namespace

  • all_namespaces (boolean) - If true, list the resource consumption for all Pods in all namespaces. If false, list the resource consumption for Pods in the provided namespace or the current namespace
  • label_selector (string) - Kubernetes label selector (e.g. 'app=myapp,env=prod' or 'app in (myapp,yourapp)'), use this option when you want to filter the pods by label (Optional, only applicable when name is not provided)
  • name (string) - Name of the Pod to get the resource consumption from (Optional, all Pods in the namespace if not provided)
  • namespace (string) - Namespace to get the Pods resource consumption from (Optional, current namespace if not provided and all_namespaces is false)

• pods_exec - Execute a command in a Kubernetes Pod (shell access, run commands in container) in the current or provided namespace with the provided name and command

  • command (array) (required) - Command to execute in the Pod container. The first item is the command to be run, and the rest are the arguments to that command. Example: ["ls", "-l", "/tmp"]
  • container (string) - Name of the Pod container where the command will be executed (Optional)
  • name (string) (required) - Name of the Pod where the command will be executed
  • namespace (string) - Namespace of the Pod where the command will be executed

• pods_log - Get the logs of a Kubernetes Pod in the current or provided namespace with the provided name

  • container (string) - Name of the Pod container to get the logs from (Optional)
  • name (string) (required) - Name of the Pod to get the logs from
  • namespace (string) - Namespace to get the Pod logs from
  • previous (boolean) - Return previous terminated container logs (Optional)
  • tail (integer) - Number of lines to retrieve from the end of the logs (Optional, default: 100)

• pods_run - Run a Kubernetes Pod in the current or provided namespace with the provided container image and optional name

  • image (string) (required) - Container Image to run in the Pod
  • name (string) - Name of the Pod (Optional, random name if not provided)
  • namespace (string) - Namespace to run the Pod in
  • port (number) - TCP/IP port to expose from the Pod container (Optional, no port exposed if not provided)

• resources_list - List Kubernetes resources and objects in the current cluster by providing their apiVersion and kind and optionally the namespace and label selector (common apiVersion and kind include: v1 Pod, v1 Service, v1 Node, apps/v1 Deployment, networking.k8s.io/v1 Ingress, route.openshift.io/v1 Route)

  • apiVersion (string) (required) - apiVersion of the resources (examples of valid apiVersion are: v1, apps/v1, networking.k8s.io/v1)
  • fieldSelector (string) - Optional Kubernetes field selector to filter resources by field values (e.g. 'status.phase=Running', 'metadata.name=myresource'). Supported fields vary by resource type. For Pods: metadata.name, metadata.namespace, spec.nodeName, spec.restartPolicy, spec.schedulerName, spec.serviceAccountName, status.phase (Pending/Running/Succeeded/Failed/Unknown), status.podIP, status.nominatedNodeName. See https://kubernetes.io/docs/concepts/overview/working-with-objects/field-selectors/
  • kind (string) (required) - kind of the resources (examples of valid kind are: Pod, Service, Deployment, Ingress)
  • labelSelector (string) - Optional Kubernetes label selector (e.g. 'app=myapp,env=prod' or 'app in (myapp,yourapp)'), use this option when you want to filter the resources by label
  • namespace (string) - Optional Namespace to retrieve the namespaced resources from (ignored in case of cluster scoped resources). If not provided, will list resources from all namespaces

• resources_get - Get a Kubernetes resource in the current cluster by providing its apiVersion, kind, optionally the namespace, and its name (common apiVersion and kind include: v1 Pod, v1 Service, v1 Node, apps/v1 Deployment, networking.k8s.io/v1 Ingress, route.openshift.io/v1 Route)

  • apiVersion (string) (required) - apiVersion of the resource (examples of valid apiVersion are: v1, apps/v1, networking.k8s.io/v1)
  • kind (string) (required) - kind of the resource (examples of valid kind are: Pod, Service, Deployment, Ingress)
  • name (string) (required) - Name of the resource
  • namespace (string) - Optional Namespace to retrieve the namespaced resource from (ignored in case of cluster scoped resources). If not provided, will get resource from configured namespace

• resources_create_or_update - Create or update a Kubernetes resource via Server-Side Apply. The manifest is the complete desired state: any field this tool previously set and the new manifest omits is removed. To edit an existing resource, fetch it with resources_get, modify it, then re-apply the full resource. (common apiVersion and kind include: v1 Pod, v1 Service, v1 Node, apps/v1 Deployment, networking.k8s.io/v1 Ingress, route.openshift.io/v1 Route)

  • resource (string) (required) - Complete YAML or JSON representation of the Kubernetes resource (full desired state, not a partial patch). Include apiVersion, kind, metadata, and the full spec.

• resources_delete - Delete a Kubernetes resource in the current cluster by providing its apiVersion, kind, optionally the namespace, and its name (common apiVersion and kind include: v1 Pod, v1 Service, v1 Node, apps/v1 Deployment, networking.k8s.io/v1 Ingress, route.openshift.io/v1 Route)

  • apiVersion (string) (required) - apiVersion of the resource (examples of valid apiVersion are: v1, apps/v1, networking.k8s.io/v1)
  • gracePeriodSeconds (integer) - Optional duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used
  • kind (string) (required) - kind of the resource (examples of valid kind are: Pod, Service, Deployment, Ingress)
  • name (string) (required) - Name of the resource
  • namespace (string) - Optional Namespace to delete the namespaced resource from (ignored in case of cluster scoped resources). If not provided, will delete resource from configured namespace

• resources_scale - Get or update the scale of a Kubernetes resource in the current cluster by providing its apiVersion, kind, name, and optionally the namespace. If the scale is set in the tool call, the scale will be updated to that value. Always returns the current scale of the resource

  • apiVersion (string) (required) - apiVersion of the resource (examples of valid apiVersion are apps/v1)
  • kind (string) (required) - kind of the resource (examples of valid kind are: StatefulSet, Deployment)
  • name (string) (required) - Name of the resource
  • namespace (string) - Optional Namespace to get/update the namespaced resource scale from (ignored in case of cluster scoped resources). If not provided, will get/update resource scale from configured namespace
  • scale (integer) - Optional scale to update the resources scale to. If not provided, will return the current scale of the resource, and not update it

• helm_install - Install (deploy) a Helm chart to create a release in the current or provided namespace

  • chart (string) (required) - Chart reference to install (for example: stable/grafana, oci://ghcr.io/nginxinc/charts/nginx-ingress)
  • name (string) - Name of the Helm release (Optional, random name if not provided)
  • namespace (string) - Namespace to install the Helm chart in (Optional, current namespace if not provided)
  • values (object) - Values to pass to the Helm chart (Optional)

• helm_list - List all the Helm releases in the current or provided namespace (or in all namespaces if specified)

  • all_namespaces (boolean) - If true, lists all Helm releases in all namespaces ignoring the namespace argument (Optional)
  • namespace (string) - Namespace to list Helm releases from (Optional, all namespaces if not provided)

• helm_uninstall - Uninstall a Helm release in the current or provided namespace

  • name (string) (required) - Name of the Helm release to uninstall
  • namespace (string) - Namespace to uninstall the Helm release from (Optional, current namespace if not provided)

• kcp_workspaces_list - List all available kcp workspaces in the current cluster

• kcp_workspace_describe - Get detailed information about a specific kcp workspace

  • workspace (string) (required) - Name or path of the workspace to describe

• kiali_get_mesh_traffic_graph - Returns service-to-service traffic topology, dependencies, and network metrics (throughput, response time, mTLS) for the specified namespaces. Use this to diagnose routing issues, latency, or find upstream/downstream dependencies.

  • graphType (string) - Granularity of the graph. 'app' aggregates by app name, 'versionedApp' separates by versions, 'workload' maps specific pods/deployments. Default: versionedApp.
  • meshCluster (string) - Optional Istio mesh cluster name from kiali_list_mesh_clusters (e.g. west). When omitted, Kiali defaults to its home cluster.
  • namespaces (string) (required) - Comma-separated list of namespaces to map

• kiali_get_mesh_status - Retrieves the high-level health, topology, and environment details of the Istio service mesh. Returns multi-cluster control plane status (istiod), data plane namespace health (including ambient mesh status), observability stack health (Prometheus, Grafana...), and component connectivity. Use this tool as the first step to diagnose mesh-wide issues, verify Istio/Kiali versions, or check overall health before drilling into specific workloads.

• kiali_manage_istio_config_read - Read Istio, Gateway API, and Inference API config. 'list' groups by namespace→'group/version/kind'→{valid:[...],invalid:[...]} where valid/invalid arrays contain resource names; omit group/kind to retrieve ALL config types in a single call. Supports Istio (networking.istio.io, security.istio.io), Gateway API (gateway.networking.k8s.io), and Inference API (inference.networking.k8s.io) when installed. 'get' returns full YAML. For writes use manage_istio_config.

  • action (string) (required) - Action to perform (read-only)
  • group (string) - API group of the Istio object. Required ONLY for 'get' action. For 'list', OMIT group and kind to retrieve ALL config types in a single call. Use 'gateway.networking.k8s.io' for Gateway API resources. Use 'inference.networking.k8s.io' for Inference API resources.
  • kind (string) - Kind of the Istio object. Required ONLY for 'get' action. For 'list', OMIT to return all kinds at once — do NOT call separately for each kind.
  • meshCluster (string) - Optional Istio mesh cluster name from kiali_list_mesh_clusters (e.g. west). When omitted, Kiali defaults to its home cluster.
  • namespace (string) - Namespace containing the Istio object. For 'list', if not provided, returns objects across all namespaces. For 'get', required.
  • object (string) - Name of the Istio object. Required for 'get' action.
  • serviceName (string) - Filter Istio configurations (VirtualServices, DestinationRules, and their referenced Gateways) that affect a specific service. Only applicable for 'list' action
  • version (string) - API version. Use 'v1' for all resource types. Required for 'get' action.

• kiali_manage_istio_config - Create, patch, or delete Istio, Gateway API, and Inference API config. Supports Istio resources (networking.istio.io, security.istio.io), Gateway API resources (gateway.networking.k8s.io), and Inference API resources (inference.networking.k8s.io) when installed on the cluster. For list and get (read-only) use manage_istio_config_read.

  • action (string) (required) - Action to perform (write)
  • data (string) - JSON or YAML data for the resource. Required for create and patch actions. For create, you can provide partial content (e.g. only spec) and it will be merged onto a valid template with defaults. Arrays (like servers, http, etc.) are REPLACED entirely, so include ALL elements you want.
  • group (string) (required) - API group of the Istio object. Use 'gateway.networking.k8s.io' for Gateway API resources. Use 'inference.networking.k8s.io' for Inference API resources.
  • kind (string) (required) - Kind of the Istio object (e.g., 'VirtualService', 'DestinationRule').
  • meshCluster (string) - Optional Istio mesh cluster name from kiali_list_mesh_clusters (e.g. west). When omitted, Kiali defaults to its home cluster.
  • namespace (string) (required) - Namespace containing the Istio object.
  • object (string) (required) - Name of the Istio object.
  • version (string) (required) - API version. Use 'v1' for all resource types.

• kiali_list_mesh_clusters - Returns the list of Istio mesh clusters that Kiali can access. Each entry includes its name and whether it is the home cluster (where Kiali is deployed). Call this tool before using meshCluster on other Kiali tools when the target cluster is unknown.

• kiali_get_resource_details - Fetches a list of resources OR retrieves detailed data for a specific resource. If 'resourceName' is omitted, it returns a list. If 'resourceName' is provided, it returns details for that specific resource.

  • meshCluster (string) - Optional Istio mesh cluster name from kiali_list_mesh_clusters (e.g. west). When omitted, Kiali defaults to its home cluster.
  • namespaces (string) - Comma-separated list of namespaces to query (e.g., 'bookinfo' or 'bookinfo,default'). If not provided, it will query across all accessible namespaces.
  • resourceName (string) - Optional. The specific name of the resource. If left empty, the tool returns a list of all resources of the specified type. If provided, the tool returns deep details for this specific resource.
  • resourceType (string) (required) - The type of resource to query. Use 'app' for Kiali applications (grouped by the Kubernetes 'app' label). Use 'argoapp' for ArgoCD Application CRDs (requires ArgoCD installed and the Kiali service account must have read permissions on applications.argoproj.io).

• kiali_list_traces - Lists distributed traces for a service in a namespace. Returns a summary (namespace, service, total_found, avg_duration_ms) and a list of traces with id, duration_ms, spans_count, root_op, slowest_service, has_errors. Use get_trace_details with a trace id to get full hierarchy.

  • errorOnly (boolean) - If true, only consider traces that contain errors. Default false.
  • limit (integer) - Maximum number of traces to return. Default 10.
  • lookbackSeconds (integer) - How far back to search. Default 600 (10m).
  • meshCluster (string) - Optional Istio mesh cluster name from kiali_list_mesh_clusters (e.g. west). When omitted, Kiali defaults to its home cluster.
  • namespace (string) (required) - Kubernetes namespace of the service.
  • serviceName (string) (required) - Service name to search traces for (required). Returns multiple traces up to limit.

• kiali_get_trace_details - Fetches a single distributed trace by trace_id and returns its call hierarchy (service tree with duration, status, and nested calls). Use this after list_traces to drill into a specific trace.

  • traceId (string) (required) - Trace ID to fetch and summarize. If provided, namespace/service_name are ignored.

• kiali_get_pod_performance - Returns a human-readable text summary with current Pod CPU/memory usage (from Prometheus) compared to Kubernetes requests/limits (from the Pod spec). Useful to answer questions like 'Is this workload using too much memory?'

  • meshCluster (string) - Optional Istio mesh cluster name from kiali_list_mesh_clusters (e.g. west). When omitted, Kiali defaults to its home cluster.
  • namespace (string) (required) - Kubernetes namespace of the Pod.
  • podName (string) - Kubernetes Pod name. If workloadName is provided, the tool will attempt to resolve a Pod from that workload first.
  • queryTime (string) - Optional end timestamp (RFC3339) for the query. Defaults to now.
  • timeRange (string) - Time window used to compute CPU rate (Prometheus duration like '5m', '10m', '1h', '1d'). Defaults to '10m'.
  • workloadName (string) - Kubernetes Workload name (e.g. Deployment/StatefulSet/etc). Tool will look up the workload and pick one of its Pods. If not found, it will fall back to treating this value as a podName.

• kiali_get_logs - Get the logs of a Kubernetes Pod (or workload name that will be resolved to a pod) in a namespace. Output is plain text, matching kubernetes-mcp-server pods_log. The line_count field tells you the total number of log lines returned. Analyze ALL of them, but summarize the results unless the user explicitly asks for the raw output. Do not omit any error or warning lines.

  • container (string) - Optional. Name of the Pod container to get the logs from.
  • format (string) - Output formatting for chat. 'codeblock' wraps logs in ~~~ fences (recommended). 'plain' returns raw text like kubernetes-mcp-server pods_log.
  • meshCluster (string) - Optional Istio mesh cluster name from kiali_list_mesh_clusters (e.g. west). When omitted, Kiali defaults to its home cluster.
  • name (string) (required) - Name of the Pod to get the logs from. If it does not exist, it will be treated as a workload name and a running pod will be selected.
  • namespace (string) (required) - Namespace to get the Pod logs from
  • previous (boolean) - Optional. Return previous terminated container logs
  • severity (string) - Optional severity filter applied client-side. Accepts 'ERROR', 'WARN' or combinations like 'ERROR,WARN'.
  • tail (integer) - Number of lines to retrieve from the end of the logs (Optional, defaults to 50). Cannot exceed 200 lines.
  • workload (string) - Optional. Workload name override (used when name lookup fails).

• kiali_get_metrics - Returns a compact JSON summary of Istio metrics (latency quantiles, traffic trends, throughput, payload sizes) for the given resource.

  • byLabels (string) - Comma-separated list of labels to group metrics by (e.g., 'source_workload,destination_service'). Optional
  • direction (string) - Traffic direction. Optional, defaults to 'outbound'
  • meshCluster (string) - Optional Istio mesh cluster name from kiali_list_mesh_clusters (e.g. west). When omitted, Kiali defaults to its home cluster.
  • namespace (string) (required) - Namespace to get metrics from
  • quantiles (string) - Comma-separated list of quantiles for histogram metrics (e.g., '0.5,0.95,0.99'). Optional
  • rateInterval (string) - Rate interval for metrics (e.g., '1m', '5m'). Optional, defaults to '10m'
  • reporter (string) - Metrics reporter(s). Comma-separated list of: 'source', 'destination', 'waypoint', or the special value 'both' (no reporter filter). Optional, defaults to 'source'. Example: 'source,waypoint'
  • requestProtocol (string) - Filter by request protocol (e.g., 'http', 'grpc', 'tcp'). Optional
  • resourceName (string) (required) - Name of the resource to get metrics for
  • resourceType (string) (required) - Type of resource to get metrics
  • step (string) - Step between data points in seconds (e.g., '15'). Optional, defaults to 15 seconds

• vm_clone - Clone a VirtualMachine on KubeVirt by creating a VirtualMachineClone resource. This creates a copy of the source VM with a new name using the KubeVirt Clone API

  • name (string) (required) - The name of the source virtual machine to clone
  • namespace (string) (required) - The namespace of the source virtual machine
  • targetName (string) (required) - The name for the new cloned virtual machine

• vm_create - Create a VirtualMachine on KubeVirt with the specified configuration, automatically resolving instance types, preferences, and container disk images. VM will be created in Halted state by default; use autostart parameter to start it immediately.

  • autostart (boolean) - Optional flag to automatically start the VM after creation (sets runStrategy to Always instead of Halted). Defaults to false.
  • instancetype (string) - Optional instance type name for the VM (e.g., 'u1.small', 'u1.medium', 'u1.large')
  • name (string) (required) - The name of the virtual machine
  • namespace (string) (required) - The namespace for the virtual machine
  • networks (array) - Optional secondary network interfaces to attach to the VM. Each item specifies a Multus NetworkAttachmentDefinition to attach. Accepts either simple strings (NetworkAttachmentDefinition names) or objects with 'name' (interface name in VM) and 'networkName' (NetworkAttachmentDefinition name) properties. Each network creates a bridge interface on the VM.
  • performance (string) - Optional performance family hint for the VM instance type (e.g., 'u1' for general-purpose, 'o1' for overcommitted, 'c1' for compute-optimized, 'm1' for memory-optimized). Defaults to 'u1' (general-purpose) if not specified.
  • preference (string) - Optional preference name for the VM
  • size (string) - Optional workload size hint for the VM (e.g., 'small', 'medium', 'large', 'xlarge'). Used to auto-select an appropriate instance type if not explicitly specified.
  • storage (string) - Optional storage size for the VM's root disk when using DataSources (e.g., '30Gi', '50Gi', '100Gi'). Defaults to 30Gi. Ignored when using container disks.
  • workload (string) - The workload for the VM. Accepts OS names (e.g., 'fedora' (default), 'ubuntu', 'centos', 'centos-stream', 'debian', 'rhel', 'opensuse', 'opensuse-tumbleweed', 'opensuse-leap') or full container disk image URLs

• vm_guest_info - Get guest operating system information from a VirtualMachine's QEMU guest agent. Requires the guest agent to be installed and running inside the VM. Provides detailed information about the OS, filesystems, network interfaces, and logged-in users.

  • info_type (string) - Type of information to retrieve: 'all' (default - all available info), 'os' (operating system details), 'filesystem' (disk and filesystem info), 'users' (logged-in users), 'network' (network interfaces and IPs)
  • name (string) (required) - The name of the virtual machine
  • namespace (string) (required) - The namespace of the virtual machine

• vm_lifecycle - Manage KubeVirt VirtualMachine lifecycle: start, stop, restart, pause, or unpause a VM

  • action (string) (required) - The lifecycle action to perform: 'start' (changes runStrategy to Always), 'stop' (changes runStrategy to Halted), 'restart' (stops then starts the VM), 'pause' (suspends the running VMI in-place), or 'unpause' (resumes a paused VMI)
  • name (string) (required) - The name of the virtual machine
  • namespace (string) (required) - The namespace of the virtual machine

• vm_create_from_template - Create a VirtualMachine from a VirtualMachineTemplate (virt-template) on KubeVirt. Processes the template server-side to substitute parameters (required values, defaults, and auto-generated values like passwords), then creates the resulting VirtualMachine in the same namespace. Cross-namespace template usage is not supported.

  • namespace (string) (required) - The namespace of the VirtualMachineTemplate and the resulting VirtualMachine (must be the same)
  • parameters (object) - Parameter values to substitute in the template. Keys are parameter names (e.g. VM_NAME), values are strings. Required parameters must be provided; optional parameters use their defaults if omitted; parameters with generate/from will be auto-generated if not provided.
  • template_name (string) (required) - The name of the VirtualMachineTemplate to create the VM from

• vm_troubleshoot - Diagnose KubeVirt VirtualMachine issues with automated root-cause detection. Collects VM status, VMI status, volumes, DataVolume/PVC state, cloud-init configuration, pod state, logs, and events, then runs heuristic checks to identify specific problems and suggest fixes. Returns a 'Detected Issues' section with CRITICAL/WARNING findings and actionable remediation steps, followed by raw diagnostic data. Use this tool FIRST whenever a user asks why a VM is not starting, stuck in Provisioning, crashlooping, failing to migrate, or exhibiting unexpected behavior. Automatically detects: missing StorageClasses, invalid PVC specs, dangerous cloud-init commands (shutdown/halt), nodeSelector migration blockers, failed migrations, and pod crashloops. If the user asks to fix or remediate the issue, use the Suggested Fixes from the report with vm_lifecycle (restart) or resources_create_or_update.

  • name (string) (required) - The name of the VirtualMachine to troubleshoot
  • namespace (string) (required) - The namespace of the VirtualMachine to troubleshoot

• netobserv_list_flows - Lists NetObserv network flow records from Loki. Use when investigating traffic between workloads, IPs, ports, or protocols in a namespace or time window.
  • endTime (integer) - End of time range as Unix epoch seconds. Defaults to now.
  • filters (string) - NetObserv filter expression passed to the console plugin (plain text; the client URL-encodes it).

Syntax:

• key=value — exact match; key=a,b — OR multiple values for the same key
• key~pattern — regex / contains match; key!~pattern — NOT regex
• key!=value — not equal; key>number — numeric greater-or-equal (e.g. Bytes>1000)
• AND within a group: & (e.g. SrcK8S_Namespace=default&Proto=6)
• OR between groups: | (e.g. SrcK8S_Name=pod-a|SrcK8S_Name=pod-b)

Prefer the dedicated "namespace" parameter for namespace scope when possible. Use Kubernetes list tools (namespaces, pods, deployments, etc.) to discover filter values.

Common Kubernetes fields (Src/Dst prefixes mirror each other):

• SrcK8S_Namespace, DstK8S_Namespace, SrcK8S_Name, DstK8S_Name
• SrcK8S_Type, DstK8S_Type (e.g. Pod, Service, Node)
• SrcK8S_OwnerName, DstK8S_OwnerName, SrcK8S_OwnerType, DstK8S_OwnerType (for Deployment, StatefulSet, etc.)
• SrcK8S_HostName, DstK8S_HostName, SrcK8S_Zone, DstK8S_Zone, K8S_ClusterName, UDN

Network & flow:

• SrcAddr, DstAddr (IPs), SrcPort, DstPort, Proto (IANA number, e.g. 6=TCP, 17=UDP)
• FlowDirection (0=Ingress, 1=Egress, 2=Inner), Bytes, Packets, Dscp, Flags

Packet drops (often with recordType flowLog and packetLoss dropped/hasDrops):

• PktDropPackets, PktDropBytes, PktDropLatestState, PktDropLatestDropCause

DNS:

• DnsName, DnsId, DnsLatencyMs, DnsErrno, DnsFlagsResponseCode

Examples:

• SrcK8S_Namespace=openshift-netobserv&SrcK8S_Name~my-app

• Proto=6&DstPort=443

• SrcK8S_Name=pod-a|SrcK8S_Name=pod-b

  • limit (integer) - Maximum number of flow records to return. Default 100.
  • namespace (string) - Restrict results to flows where source or destination namespace matches (dev-scoped Loki tenant).
  • packetLoss (string) - Packet loss filter.
  • recordType (string) - Flow record type filter.
  • startTime (integer) - Start of time range as Unix epoch seconds. Overrides timeRange when set.
  • timeRange (integer) - Lookback window in seconds when startTime is omitted. Default 300.

• netobserv_get_flow_metrics - Returns aggregated NetObserv flow metrics as topology or time-series data. Use for throughput, TLS/DNS/drop breakdowns, and namespace or workload traffic analysis; see aggregateBy and groups for grouping options.

  • aggregateBy (string) (required) - Primary dimension for netobserv_get_flow_metrics (console plugin /api/flow/metrics).

Two forms (use exact spelling):

1. Topology scopes — aggregate endpoints for graph/topology views:

• app — application workloads (pods/services), excluding infrastructure traffic
• namespace — Kubernetes namespace (default)
• owner — controller owner (Deployment, StatefulSet, …)
• resource — pod, service, or node (finest workload granularity)
• host — node name
• zone — availability zone
• cluster — cluster name (multi-cluster)
• network — user-defined / secondary network name

2. Flow record fields — group by a single flow attribute (PascalCase field name). Use for breakdown charts (TLS, DNS, drops, protocol). Field names match filters / flow logs.

TLS (requires TLS tracking on the FlowCollector):

• TLSVersion, TLSCipherSuite, TLSGroup, TLSTypes

DNS:

• DnsName, DnsFlagsResponseCode, DnsErrno

Packet drops:

• PktDropLatestState, PktDropLatestDropCause

Network / K8s (single-sided breakdown; pair with filters for src/dst):

• Proto, SrcPort, DstPort, FlowDirection, Dscp
• SrcK8S_Namespace, DstK8S_Namespace, SrcK8S_Name, DstK8S_Name
• SrcK8S_Type, DstK8S_Type, SrcK8S_OwnerName, DstK8S_OwnerName
• SrcK8S_HostName, DstK8S_HostName, SrcK8S_Zone, DstK8S_Zone
• K8S_ClusterName, SrcK8S_NetworkName, DstK8S_NetworkName

Pair aggregateBy with type and function:

• Throughput: type=Bytes or Packets, function=rate
• Flow count: type=Flows, function=count or rate
• DNS volume: type=DnsFlows, function=count
• DNS latency: type=DnsLatencyMs, function=avg, p90, or max
• RTT: type=TimeFlowRttNs, function=avg, min, or p90
• Drops: type=PktDropPackets or PktDropBytes, function=rate

Examples:

• aggregateBy=namespace, type=Bytes, function=rate
• aggregateBy=TLSVersion, type=Bytes, function=rate, filters=TLSTypes!~""
• aggregateBy=TLSGroup, type=Flows, function=count
• aggregateBy=DnsFlagsResponseCode, type=DnsFlows, function=count
• aggregateBy=PktDropLatestState, type=PktDropPackets, function=rate, packetLoss=dropped
• aggregateBy=resource, type=Bytes, function=rate, namespace=netobserv
  • dataSource (string) - Metrics backend: auto (prefer Prometheus, fallback to Loki), prom, or loki.
  • endTime (integer) - End of time range as Unix epoch seconds. Defaults to now.
  • filters (string) - NetObserv filter expression passed to the console plugin (plain text; the client URL-encodes it).

Syntax:

• key=value — exact match; key=a,b — OR multiple values for the same key
• key~pattern — regex / contains match; key!~pattern — NOT regex
• key!=value — not equal; key>number — numeric greater-or-equal (e.g. Bytes>1000)
• AND within a group: & (e.g. SrcK8S_Namespace=default&Proto=6)
• OR between groups: | (e.g. SrcK8S_Name=pod-a|SrcK8S_Name=pod-b)

Prefer the dedicated "namespace" parameter for namespace scope when possible. Use Kubernetes list tools (namespaces, pods, deployments, etc.) to discover filter values.

Common Kubernetes fields (Src/Dst prefixes mirror each other):

• SrcK8S_Namespace, DstK8S_Namespace, SrcK8S_Name, DstK8S_Name
• SrcK8S_Type, DstK8S_Type (e.g. Pod, Service, Node)
• SrcK8S_OwnerName, DstK8S_OwnerName, SrcK8S_OwnerType, DstK8S_OwnerType (for Deployment, StatefulSet, etc.)
• SrcK8S_HostName, DstK8S_HostName, SrcK8S_Zone, DstK8S_Zone, K8S_ClusterName, UDN

Network & flow:

• SrcAddr, DstAddr (IPs), SrcPort, DstPort, Proto (IANA number, e.g. 6=TCP, 17=UDP)
• FlowDirection (0=Ingress, 1=Egress, 2=Inner), Bytes, Packets, Dscp, Flags

Packet drops (often with recordType flowLog and packetLoss dropped/hasDrops):

• PktDropPackets, PktDropBytes, PktDropLatestState, PktDropLatestDropCause

DNS:

• DnsName, DnsId, DnsLatencyMs, DnsErrno, DnsFlagsResponseCode

Examples:

• SrcK8S_Namespace=openshift-netobserv&SrcK8S_Name~my-app
• Proto=6&DstPort=443
• SrcK8S_Name=pod-a|SrcK8S_Name=pod-b
  • function (string) - Aggregation function.
  • groups (string) - Optional comma-separated parent scopes when aggregateBy is a topology scope. Adds extra label dimensions (e.g. break namespace results down by cluster or zone). Ignored or less useful when aggregateBy is already a raw flow field (e.g. TLSVersion); use filters instead.

Single scopes:

• clusters, networks, zones, hosts, namespaces, owners

Combined scopes (use +, no spaces):

• clusters+zones, clusters+hosts, clusters+namespaces, clusters+owners
• zones+hosts, zones+namespaces, zones+owners
• hosts+namespaces, hosts+owners
• namespaces+owners
• networks+zones, networks+hosts, networks+namespaces, networks+owners

Examples:

• aggregateBy=namespace, groups=clusters

• aggregateBy=resource, groups=namespaces

• aggregateBy=owner, groups=zones,hosts

  • limit (integer) - Maximum number of flow records to return. Default 100.
  • namespace (string) - Restrict results to flows where source or destination namespace matches (dev-scoped Loki tenant).
  • packetLoss (string) - Packet loss filter.
  • rateInterval (string) - Prometheus rate interval (e.g. 1m, 5m).
  • recordType (string) - Flow record type filter.
  • startTime (integer) - Start of time range as Unix epoch seconds. Overrides timeRange when set.
  • step (string) - Query resolution step (e.g. 30s, 1m).
  • timeRange (integer) - Lookback window in seconds when startTime is omitted. Default 300.
  • type (string) - Metric type to aggregate.

• netobserv_export_flows - Exports NetObserv flow records as CSV with the same filters as list_flows. Use when the user needs downloadable flow data for audits or offline analysis.

  • columns (string) - Optional comma-separated column names to include (e.g. SrcK8S_Namespace,DstK8S_Namespace,Bytes). Omit to export all columns present in the result.
  • endTime (integer) - End of time range as Unix epoch seconds. Defaults to now.
  • filters (string) - NetObserv filter expression passed to the console plugin (plain text; the client URL-encodes it).

Syntax:

• key=value — exact match; key=a,b — OR multiple values for the same key
• key~pattern — regex / contains match; key!~pattern — NOT regex
• key!=value — not equal; key>number — numeric greater-or-equal (e.g. Bytes>1000)
• AND within a group: & (e.g. SrcK8S_Namespace=default&Proto=6)
• OR between groups: | (e.g. SrcK8S_Name=pod-a|SrcK8S_Name=pod-b)

Prefer the dedicated "namespace" parameter for namespace scope when possible. Use Kubernetes list tools (namespaces, pods, deployments, etc.) to discover filter values.

Common Kubernetes fields (Src/Dst prefixes mirror each other):

• SrcK8S_Namespace, DstK8S_Namespace, SrcK8S_Name, DstK8S_Name
• SrcK8S_Type, DstK8S_Type (e.g. Pod, Service, Node)
• SrcK8S_OwnerName, DstK8S_OwnerName, SrcK8S_OwnerType, DstK8S_OwnerType (for Deployment, StatefulSet, etc.)
• SrcK8S_HostName, DstK8S_HostName, SrcK8S_Zone, DstK8S_Zone, K8S_ClusterName, UDN

Network & flow:

• SrcAddr, DstAddr (IPs), SrcPort, DstPort, Proto (IANA number, e.g. 6=TCP, 17=UDP)
• FlowDirection (0=Ingress, 1=Egress, 2=Inner), Bytes, Packets, Dscp, Flags

Packet drops (often with recordType flowLog and packetLoss dropped/hasDrops):

• PktDropPackets, PktDropBytes, PktDropLatestState, PktDropLatestDropCause

DNS:

• DnsName, DnsId, DnsLatencyMs, DnsErrno, DnsFlagsResponseCode

Examples:

• SrcK8S_Namespace=openshift-netobserv&SrcK8S_Name~my-app
• Proto=6&DstPort=443
• SrcK8S_Name=pod-a|SrcK8S_Name=pod-b
  • format (string) - Export format. Only csv is supported.
  • limit (integer) - Maximum number of flow records to return. Default 100.
  • namespace (string) - Restrict results to flows where source or destination namespace matches (dev-scoped Loki tenant).
  • packetLoss (string) - Packet loss filter.
  • recordType (string) - Flow record type filter.
  • startTime (integer) - Start of time range as Unix epoch seconds. Overrides timeRange when set.
  • timeRange (integer) - Lookback window in seconds when startTime is omitted. Default 300.

• tekton_pipeline_start - Start a Tekton Pipeline by creating a PipelineRun that references it

  • name (string) (required) - Name of the Pipeline to start
  • namespace (string) - Namespace of the Pipeline
  • params (object) - Parameter values to pass to the Pipeline. Keys are parameter names; values can be a string, an array of strings, or an object (map of string to string) depending on the parameter type defined in the Pipeline spec

• tekton_pipelinerun_lifecycle - Manage a Tekton PipelineRun lifecycle by restarting it with the same spec or cancelling it by setting spec.status to Cancelled.

  • action (string) (required) - Lifecycle action to perform: 'restart' creates a new PipelineRun with the same spec; 'cancel' sets spec.status to Cancelled.
  • name (string) (required) - Name of the PipelineRun to manage
  • namespace (string) - Namespace of the PipelineRun

• tekton_pipelinerun_logs - Get logs for all TaskRuns owned by a Tekton PipelineRun. Use this to inspect PipelineRun execution output without locating pods manually.

  • name (string) (required) - Name of the PipelineRun to get logs from
  • namespace (string) - Namespace of the PipelineRun
  • step (string) - Step name to include within matching TaskRuns
  • tail (integer) - Number of lines to retrieve from the end of each container log (default: 100)
  • task (string) - Pipeline task name to filter by (tekton.dev/pipelineTask label)

• tekton_task_start - Start a Tekton Task by creating a TaskRun that references it

  • name (string) (required) - Name of the Task to start
  • namespace (string) - Namespace of the Task
  • params (object) - Parameter values to pass to the Task. Keys are parameter names; values can be a string, an array of strings, or an object (map of string to string) depending on the parameter type defined in the Task spec

• tekton_taskrun_restart - Restart a Tekton TaskRun by creating a new TaskRun with the same spec

  • name (string) (required) - Name of the TaskRun to restart
  • namespace (string) - Namespace of the TaskRun

• tekton_taskrun_logs - Get the logs from a Tekton TaskRun by resolving its underlying pod

  • name (string) (required) - Name of the TaskRun to get logs from
  • namespace (string) - Namespace of the TaskRun
  • step (string) - Step name to include. If omitted, logs from all steps and sidecars are returned
  • tail (integer) - Number of lines to retrieve from the end of the logs (Optional, default: 100)

• cluster-health-check - Perform comprehensive health assessment of Kubernetes/OpenShift cluster
  • namespace (string) - Optional namespace to limit health check scope (default: all namespaces)
  • check_events (string) - Include recent warning/error events (true/false, default: true)

• mesh-list-applications - List applications in the mesh namespaces

  • namespace (string) - Optional namespace to filter applications (default: all namespaces)

• list-istio-config - List Istio configuration resources in the mesh namespaces

  • namespace (string) - Optional namespace to filter Istio configuration (default: all namespaces)

• mesh-list-namespaces - List all namespaces with their sidecar injection status and Istio labels

• mesh-list-services - List services in the mesh namespaces

  • namespace (string) - Optional namespace to filter services (default: all namespaces)

• mesh-list-workloads - List workloads in the mesh namespaces

  • namespace (string) - Optional namespace to filter workloads (default: all namespaces)

• mesh-health-check - Perform a comprehensive health assessment of the Istio service mesh including control plane and data plane status

  • namespace (string) - Optional namespace to focus the health check on (default: all namespaces)

• mesh-topology - Show the mesh topology including control plane components and cluster connectivity

• traffic-topology - Analyze the service mesh traffic topology showing service dependencies, traffic flow, and communication patterns

  • namespaces (string) (required) - Comma-separated list of namespaces to include in the graph, or 'all' to include all accessible mesh namespaces

• service-troubleshoot - Investigate service errors using logs, traces, and Istio configuration to identify root causes

  • namespace (string) (required) - Namespace where the service is deployed
  • service (string) (required) - Name of the service to troubleshoot
  • workload (string) - Optional workload or pod name to fetch logs from (if omitted, uses the service name)

• trace-analysis - Investigate distributed traces for a service to identify latency bottlenecks, error sources, and slow spans

  • namespace (string) (required) - Namespace where the service is deployed
  • service (string) (required) - Name of the service to investigate traces for

• istio-config-review - Review and validate Istio configuration in a namespace, checking for misconfigurations and best practice violations

  • namespace (string) (required) - Namespace to review Istio configuration for

• vm-troubleshoot - Generate a step-by-step troubleshooting guide for diagnosing KubeVirt VirtualMachine issues

  • namespace (string) (required) - The namespace of the VirtualMachine to troubleshoot
  • name (string) (required) - The name of the VirtualMachine to troubleshoot

• windows-golden-image - Guides creation of a Windows golden image via the KubeVirt windows-efi-installer Tekton pipeline

  • winImageDownloadURL (string) (required) - Microsoft Windows ISO download URL (must be https://)
  • namespace (string) - Target namespace for the PipelineRun
  • windowsVersion (string) - Windows version: 10, 11, 2k22 (default), or 2k25
  • pipelineVersion (string) - Pipeline version (default: latest). Use specific version like 0.25.0 if needed

• hco-status - Generate a status report for the HyperConverged Cluster Operator (HCO) managing KubeVirt and related components

• pipeline-troubleshoot - Gather PipelineRun status, its Pipeline definition, TaskRuns, failed or errored step logs, warning events, Pipeline-as-Code Repository, and TektonConfig context for Tekton troubleshooting
  • namespace (string) (required) - Namespace of the PipelineRun to troubleshoot
  • name (string) (required) - Name of the PipelineRun to troubleshoot