K8s Logs
Use this skill for read-only Kubernetes investigation.
This skill must not restart workloads, delete pods, scale deployments, edit resources, patch config, or mutate data.
Required Inputs
Before running commands, identify:
- environment
- kubeconfig or context
- namespace
- deployment, pod, or label selector
- request id, business id, endpoint, error marker, or absolute time window
If the user only says "just now" or "today", convert it into an explicit time window before drawing conclusions.
Workflow
- Confirm kube context and API server.
- Confirm namespace and workload.
- Check deployed image, pod readiness, restart count, node, age, and recent events.
- Query logs with bounded
--since or --since-time.
- Search by concrete ids first, then by error markers.
- For cross-service traces, follow one direction at a time: entry service, handler branch, downstream call, async consumer, owner service.
- Summarize evidence, missing expected markers, and next decisive check.
Output
Include:
- environment and namespace
- deployment or pod name
- image tag
- log time window
- matched markers
- suspected failure point
- remaining uncertainty
Redact tokens, cookies, authorization headers, passwords, and personal data.
References
Read commands.md for command templates.
1---2name: k8s-logs3description: Read-only Kubernetes log and workload investigation skill. Use when users ask an agent to inspect pods, deployments, images, restarts, events, request ids, business ids, or bounded application logs without changing cluster state.4---56# K8s Logs78Use this skill for read-only Kubernetes investigation.910This skill must not restart workloads, delete pods, scale deployments, edit resources, patch config, or mutate data.1112## Required Inputs1314Before running commands, identify:1516- environment17- kubeconfig or context18- namespace19- deployment, pod, or label selector20- request id, business id, endpoint, error marker, or absolute time window2122If the user only says "just now" or "today", convert it into an explicit time window before drawing conclusions.2324## Workflow25261. Confirm kube context and API server.272. Confirm namespace and workload.283. Check deployed image, pod readiness, restart count, node, age, and recent events.294. Query logs with bounded `--since` or `--since-time`.305. Search by concrete ids first, then by error markers.316. For cross-service traces, follow one direction at a time: entry service, handler branch, downstream call, async consumer, owner service.327. Summarize evidence, missing expected markers, and next decisive check.3334## Output3536Include:3738- environment and namespace39- deployment or pod name40- image tag41- log time window42- matched markers43- suspected failure point44- remaining uncertainty4546Redact tokens, cookies, authorization headers, passwords, and personal data.4748## References4950Read [commands.md](./references/commands.md) for command templates.
PHPerKael