Agent Skills › opskat/opskat › k8s

k8s

GitHub

提供Kubernetes资产交互能力，自动处理kubectl命令执行、kubeconfig管理及SSH跳板机代理配置。

internal/ai/skills/k8s/SKILL.md opskat/opskat

触发场景

需要执行kubectl命令查询或管理集群资源通过SSH隧道访问受限K8s环境

安装

npx skills add opskat/opskat --skill k8s -g -y

更多选项

非标准路径

npx skills add https://github.com/opskat/opskat/tree/main/internal/ai/skills/k8s -g -y

不安装直接使用

npx skills use opskat/opskat@k8s

指定 Agent (Claude Code)

npx skills add opskat/opskat --skill k8s -a claude-code -g -y

安装 repo 全部 skill

npx skills add opskat/opskat --all -g -y

预览 repo 内 skill

npx skills add opskat/opskat --list

SKILL.md

Frontmatter

{
    "name": "k8s",
    "description": "Run kubectl commands against a Kubernetes asset via exec. Covers command syntax and the stored kubeconfig \/ jump-host behavior."
}

Kubernetes assets

Command syntax

Pass the kubectl command as command, with or without the leading kubectl:

get pods -A
describe pod api-0 -n prod
logs deploy/api --tail 100
kubectl get nodes -o wide

Notes

The asset's stored kubeconfig is used automatically. Do not pass --kubeconfig.
The asset's default context and namespace are applied when the command does not specify them.
If the asset has an SSH jump host configured, kubectl runs on that host; otherwise it runs locally.
The scope parameter is not used by Kubernetes assets.

Asset config (for put_asset)

field	type	required	notes
`kubeconfig`	string	yes	Write-only. Full YAML encrypted directly in the asset config; it does not create a managed credential
`namespace`	string	no	Default namespace; must not contain whitespace or start with `-`
`context`	string	no	Kubeconfig context to use; same character restrictions as `namespace`
`ssh_asset_id`	number	no	SSH asset to tunnel through; 0 detaches
`proxy_chain`	array	no	Ordered list of hops, nearest to this machine first; replaces the whole stored chain and the SSH tunnel, `[]` clears it. Layers: `{"type":"ssh","ssh_asset_id":N}`, `{"type":"socks5","host":"...","port":N,"username":"...","password":"..."}`, `{"type":"http_tunnel","url":"https://...","token":"...","timeout_seconds":N}` (first layer only). `password` / `token` are write-only, encrypted in the asset. Not together with `ssh_asset_id`
`password`	string	no	Reserved compatibility key; any non-empty value is rejected as inapplicable
`credential_id`	number	no	Reserved compatibility key; any non-zero value is rejected as inapplicable

Never echo kubeconfig. It remains direct encrypted asset material. K8s accepts no credential fields.

版本历史

2b9abfb 当前 2026-10-19 03:58
新增 proxy_chain 支持多层代理链（SSH/socks5/http_tunnel），增强资产连接配置灵活性。
b159e91 2026-08-19 20:20
更新资产配置说明，明确 kubeconfig 为只写且直接加密存储；新增 password 和 credential_id 兼容字段说明（拒绝使用）。
aeb4bc3 2026-07-24 16:28