{ "run_id": "aashishmahajan--kube-noob-claude-haiku-5-5-1793143383708318849", "checker": { "claims": [ { "claim": "Answers cite local knowledge as [kn:#] chunk ids", "command": " mcp tools/call {\"tool\": \"kubenoob_search_knowledge\", \"arguments\": {\"query\": \"readinessProbe\", \"limit\": 2}}", "evidence": "kn:k8s-probes#0\\\",\\n \\\"title\\\": \\\"Readiness, liveness and startup probes > Probes\\\",\\n \\\"url\\\": \\\"https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/\\\",\\n \\\"license\\\": \\\"Apache-2.0\\\",\\n \\\"sourceId\\\": \\\"builtin:k8s-probes\\\",\\n \\\"version\\\": \\\"2026-10-27\\\",\\n \\\"origin\\\": \\\"builtin\\\",\\n \\\"score\\\": 4.296,\\n \\\"text\\\": \\\"- **readinessProbe**: may this pod receive traffic now? Failing removes the pod from Service endpoints (no restart).\\\\n Can check dependencies.\\\\n- **livenessProbe**: is the process wedged? Fai", "expected": "search result cites kn:k8s-probes#0", "input": "{\"tool\": \"kubenoob_search_knowledge\", \"arguments\": {\"query\": \"readinessProbe\", \"limit\": 2}}", "kind": "claim", "outcome": "Real input produced the expected result: kn:k8s-probes#0", "source": "- **Cite**: answers cite local knowledge as `[kn:#]`.", "source_checked": true, "source_file": "README.md", "verdict": "yes" }, { "claim": "Audit finds issues in a Deployment with rules such as KN-S013", "command": " audit -f --platform openshift --fail-on never", "evidence": "KN-S013 Deployment/shop/orders-api L23 spec.template.spec.containers[0].env[0].value\n Container 'api' sets DB_PASSWORD as a literal value.\n fix: Move the value to a Secret and reference it with valueFrom.secretKeyRef (or an external secret store).\n RHACS: Environment Variable Contains Secret\n[HIGH ] KN-S004 Deployment/shop/orders-api L25 spec.template.spec.containers[0].securityContext.runAsUser\n Container 'api' sets runAsUser: 1000; restricted-v2 will reject IDs outside the namespace range.\n fix: Remove runAsUser/fsGroup and let OpenShi", "expected": "report lists KN-S013 hardcoded DB_PASSWORD finding", "input": "examples/insecure-deployment.yaml", "kind": "claim", "outcome": "Real input produced the expected result: KN-S013", "returncode": 0, "source": "- **Audit**: 60 rules plus strict schemas (Kubernetes 1.35, Routes, SCCs, EgressFirewall, Gateway API, StackRox),", "source_checked": true, "source_file": "README.md", "verdict": "yes" }, { "claim": "Debug diagnoses a CrashLoop from pasted events", "command": " diagnose -f ", "evidence": "DBG-CRASHLOOP\n title: Container keeps crashing (CrashLoopBackOff)\n confidence: 0.6\n evidence:\n - 'Reason: CrashLoopBackOff'\n - Warning BackOff 30s (x25 over 6m) kubelet Back-off restarting failed container api in pod orders-api-7c4b9d6f5-x2lqp_shop\n rootCauses:\n - The process exits right after start (bad config, missing env/secret, failed migration, wrong command).\n - Liveness probe kills a slow-starting app (look for 'Liveness probe failed' before each restart).\n - OOMKilled at startup (see lastState.terminated.reason).\n - 'On OpenShift: the image expects root or a fixed", "expected": "diagnosis id DBG-CRASHLOOP", "input": "examples/events-crashloop.txt", "kind": "claim", "outcome": "Real input produced the expected result: DBG-CRASHLOOP", "returncode": 0, "source": "- **Debug**: 38 offline playbooks, read-only steps first;", "source_checked": true, "source_file": "README.md", "verdict": "yes" } ], "cycle_checks": [ { "claim": "Watch namespaces on a schedule-like loop (polls every interval; --once runs one pass)", "command": "", "evidence": "Missing prerequisite: no cluster. Observed: 'error: No cluster backend available: not in a pod and neither oc nor kubectl is on PATH.' rc=4. No cycle replayed.", "expected": "one watch pass against a live cluster; cannot run here", "input": "watch -n shop --once with no cluster backend", "kind": "cycle", "method": "run-once (--once)", "outcome": "Missing prerequisite: no cluster. Observed: 'error: No cluster backend available: not in a pod and neither oc nor kubectl is on PATH.' rc=4. No cycle replayed.", "schedule": "poll interval watch.intervalSeconds", "source": "src/kube_noob/cli.py", "verdict": "blocked" } ], "details": { "argv": [ "", "mcp" ], "kind": "mcp", "scope": "product operation", "serverInfo": { "icons": [ { "mimeType": "image/svg+xml", "sizes": [ "any" ], "src": "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA1MTIgNTEyIiByb2xlPSJpbWciIGFyaWEtbGFiZWxsZWRieT0idCI+CiAgPHRpdGxlIGlkPSJ0Ij5rdWJlLW5vb2I8L3RpdGxlPgogIDxkZWZzPgogICAgPGxpbmVhckdyYWRpZW50IGlkPSJiZyIgeDE9IjAiIHkxPSIwIiB4Mj0iMSIgeTI9IjEiPgogICAgICA8c3RvcCBvZmZzZXQ9IjAiIHN0b3AtY29sb3I9IiMwRTJBNDciLz4KICAgICAgPHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjMDcxNDIyIi8+CiAgICA8L2xpbmVhckdyYWRpZW50PgogICAgPGxpbmVhckdyYWRpZW50IGlkPSJyaW5nIiB4MT0iMCIgeTE9IjAiIHgyPSIxIiB5Mj0iMSI+CiAgICAgIDxzdG9wIG9mZnNldD0iMCIgc3RvcC1jb2xvcj0iIzQzRTk3QiIvPgogICAgICA8c3RvcCBvZmZzZXQ9IjAuNTUiIHN0b3AtY29sb3I9IiMyMkI4Q0YiLz4KICAgICAgPHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjMkY2RkVEIi8+CiAgICA8L2xpbmVhckdyYWRpZW50PgogICAgPGxpbmVhckdyYWRpZW50IGlkPSJib2R5IiB4MT0iMCIgeTE9IjAiIHgyPSIxIiB5Mj0iMSI+CiAgICAgIDxzdG9wIG9mZnNldD0iMCIgc3RvcC1jb2xvcj0iI0ZGRkZGRiIvPgogICAgICA8c3RvcCBvZmZzZXQ9IjEiIHN0b3AtY29sb3I9IiM5Q0NCRkYiLz4KICAgIDwvbGluZWFyR3JhZGllbnQ+CiAgICA8bGluZWFyR3JhZGllbnQgaWQ9ImZpbiIgeDE9IjAiIHkxPSIwIiB4Mj0iMSIgeTI9IjEiPgogICAgICA8c3RvcCBvZmZzZXQ9IjAiIHN0b3AtY29sb3I9IiM0M0U5N0IiLz4KICAgICAgPHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjMTZBM0EzIi8+CiAgICA8L2xpbmVhckdyYWRpZW50PgogICAgPGxpbmVhckdyYWRpZW50IGlkPSJmbGFtZSIgeDE9IjEiIHkxPSIwIiB4Mj0iMCIgeTI9IjEiPgogICAgICA8c3RvcCBvZmZzZXQ9IjAiIHN0b3AtY29sb3I9IiNGRkU0NUMiLz4KICAgICAgPHN0b3Agb2Zmc2V0PSIwLjUiIHN0b3AtY29sb3I9IiNGRjlGMUMiLz4KICAgICAgPHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjRkY0RDJFIi8+CiAgICA8L2xpbmVhckdyYWRpZW50PgogICAgPHJhZGlhbEdyYWRpZW50IGlkPSJ2aXNvciIgY3g9IjAuNCIgY3k9IjAuMzUiIHI9IjAuNzUiPgogICAgICA8c3RvcCBvZmZzZXQ9IjAiIHN0b3AtY29sb3I9IiMxRjRFN0EiLz4KICAgICAgPHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjMEExQTJDIi8+CiAgICA8L3JhZGlhbEdyYWRpZW50PgogIDwvZGVmcz4KCiAgPCEtLSBhcHAtaWNvbiB0aWxlIC0tPgogIDxyZWN0IHg9IjAiIHk9IjAiIHdpZHRoPSI1MTIiIGhlaWdodD0iNTEyIiByeD0iMTEyIiBmaWxsPSJ1cmwoI2JnKSIvPgogIDxyZWN0IHg9IjE4IiB5PSIxOCIgd2lkdGg9IjQ3NiIgaGVpZ2h0PSI0NzYiIHJ4PSI5NiIgZmlsbD0ibm9uZSIgc3Ryb2tlPSJ1cmwoI3JpbmcpIiBzdHJva2Utd2lkdGg9IjE0Ii8+CgogIDwhLS0gc3RhcnMgLS0+CiAgPGNpcmNsZSBjeD0iNDA0IiBjeT0iMzcyIiByPSI3IiBmaWxsPSIjNDNFOTdCIi8+CiAgPGNpcmNsZSBjeD0iNDI4IiBjeT0iMTc2IiByPSI0IiBmaWxsPSIjOUNDQkZGIi8+CiAgPGNpcmNsZSBjeD0iMTE4IiBjeT0iMTIyIiByPSI1IiBmaWxsPSIjOUNDQkZGIi8+CgogIDwhLS0gcm9ja2V0LCBmbHlpbmcgdXAtcmlnaHQgLS0+CiAgPGcgdHJhbnNmb3JtPSJyb3RhdGUoNDUgMjU2IDI1NikiPgogICAgPCEtLSBmbGFtZSAtLT4KICAgIDxwYXRoIGQ9Ik0yNTYgMzUyIEMgMjI2IDM5MiAyMzIgNDMyIDI1NiA0NzAgQyAyODAgNDMyIDI4NiAzOTIgMjU2IDM1MiBaIiBmaWxsPSJ1cmwoI2ZsYW1lKSIvPgogICAgPHBhdGggZD0iTTI1NiAzNjIgQyAyNDQgMzg4IDI0NiA0MTQgMjU2IDQzNiBDIDI2NiA0MTQgMjY4IDM4OCAyNTYgMzYyIFoiIGZpbGw9IiNGRkYzQjAiLz4KICAgIDwhLS0gZmlucyAtLT4KICAgIDxwYXRoIGQ9Ik0xOTYgMjkwIEwgMTUwIDM1MiBMIDE1MCAzNzIgTCAyMDYgMzQwIFoiIGZpbGw9InVybCgjZmluKSIvPgogICAgPHBhdGggZD0iTTMxNiAyOTAgTCAzNjIgMzUyIEwgMzYyIDM3MiBMIDMwNiAzNDAgWiIgZmlsbD0idXJsKCNmaW4pIi8+CiAgICA8IS0tIGJvZHkgLS0+CiAgICA8cGF0aCBkPSJNMjU2IDY0IEMgMzE2IDExMiAzMzAgMTk2IDMyMiAzMDAgQyAzMjAgMzMwIDMwNiAzNTIgMjU2IDM1MiBDIDIwNiAzNTIgMTkyIDMzMCAxOTAgMzAwIEMgMTgyIDE5NiAxOTYgMTEyIDI1NiA2NCBaIgogICAgICAgICAgZmlsbD0idXJsKCNib2R5KSIvPgogICAgPCEtLSBub3NlIGNvbmUgLS0+CiAgICA8cGF0aCBkPSJNMjU2IDY0IEMgMjg2IDg4IDMwNCAxMTYgMzEyIDE0NiBMIDIwMCAxNDYgQyAyMDggMTE2IDIyNiA4OCAyNTYgNjQgWiIgZmlsbD0iIzJGNkZFRCIvPgogICAgPCEtLSBwb3J0aG9sZSB3aXRoIGFzdHJvbmF1dCAibm9vYiIgZmFjZSAtLT4KICAgIDxjaXJjbGUgY3g9IjI1NiIgY3k9IjIyMiIgcj0iNTAiIGZpbGw9IiMwRTJBNDciLz4KICAgIDxjaXJjbGUgY3g9IjI1NiIgY3k9IjIyMiIgcj0iNDIiIGZpbGw9InVybCgjdmlzb3IpIi8+CiAgICA8Y2lyY2xlIGN4PSIyNDAiIGN5PSIyMTQiIHI9IjciIGZpbGw9IiNGRkZGRkYiLz4KICAgIDxjaXJjbGUgY3g9IjI3MiIgY3k9IjIxNCIgcj0iNyIgZmlsbD0iI0ZGRkZGRiIvPgogICAgPHBhdGggZD0iTTIzOCAyMzYgUSAyNTYgMjUyIDI3NCAyMzYiIGZpbGw9Im5vbmUiIHN0cm9rZT0iIzQzRTk3QiIgc3Ryb2tlLXdpZHRoPSI2IiBzdHJva2UtbGluZWNhcD0icm91bmQiLz4KICAgIDxwYXRoIGQ9Ik0yMjggMTk4IFEgMjQwIDE4NiAyNTYgMTg2IiBmaWxsPSJub25lIiBzdHJva2U9IiM5Q0NCRkYiIHN0cm9rZS13aWR0aD0iNSIgc3Ryb2tlLWxpbmVjYXA9InJvdW5kIiBvcGFjaXR5PSIwLjciLz4KICA8L2c+CgogIDwhLS0gbGF1bmNoIGNsb3VkIC0tPgogIDxnIGZpbGw9IiNFOEY0RkYiPgogICAgPGNpcmNsZSBjeD0iMTEyIiBjeT0iNDIwIiByPSIzNCIvPgogICAgPGNpcmNsZSBjeD0iMTUwIiBjeT0iNDM2IiByPSIyNiIvPgogICAgPGNpcmNsZSBjeD0iODQiIGN5PSI0NDAiIHI9IjIyIi8+CiAgPC9nPgo8L3N2Zz4K" } ], "name": "kube_noob_mcp", "title": "kube-noob", "version": "0.4.0", "websiteUrl": "https://github.com/aashishmahajan/kube-noob" }, "tool_result": { "content": [ { "text": "{\n \"query\": \"readinessProbe\",\n \"webEnabled\": false,\n \"results\": [\n {\n \"chunkId\": \"kn:k8s-probes#0\",\n \"title\": \"Readiness, liveness and startup probes > Probes\",\n \"url\": \"https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/\",\n \"license\": \"Apache-2.0\",\n \"sourceId\": \"builtin:k8s-probes\",\n \"version\": \"2026-10-27\",\n \"origin\": \"builtin\",\n \"score\": 4.296,\n \"text\": \"- **readinessProbe**: may this pod receive traffic now? Failing removes the pod from Service endpoints (no restart).\\n Can check dependencies.\\n- **livenessProbe**: is the process wedged? Failing restarts the container. Check only the process itself - never a\\n database or downstream API, or one slow dependency restarts every replica at once.\\n- **startupProbe**: disables liveness/readiness until the app has started; size it as\\n `failureThreshold x periodSeconds >= worst-case startup time`.\"\n },\n {\n \"chunkId\": \"kn:k8s-probes#1\",\n \"title\": \"Readiness, liveness and startup probes > Safe defaults\",\n \"url\": \"https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/\",\n \"license\": \"Apache-2.0\",\n \"sourceId\": \"builtin:k8s-probes\",\n \"version\": \"2026-10-27\",\n \"origin\": \"builtin\",\n \"score\": 4.199,\n \"text\": \"```yaml\\nreadinessProbe: {httpGet: {path: /readyz, port: http}, periodSeconds: 5, timeoutSeconds: 2, failureThreshold: 3}\\nlivenessProbe: {httpGet: {path: /healthz, port: http}, periodSeconds: 10, timeoutSeconds: 3, failureThreshold: 3}\\n```\\nApps must listen on 0.0.0.0 (not 127.0.0.1) so the kubelet can reach them. Keep `timeoutSeconds` below\\n`periodSeconds` as a convention so probes do not overlap (Kubernetes does not enforce it).\"\n }\n ],\n \"howToCite\": \"Cite results inline as [], e.g. [kn:ocp-scc#0].\",\n \"knowledgeAsOf\": \"knowledge as of 2026-10-27 (Kubernetes 1.35, OpenShift 4.22); release-note issues as of 2026-10-27 for OpenShift 4.20, 4.21, 4.22\"\n}", "type": "text" } ], "isError": false, "structuredContent": { "howToCite": "Cite results inline as [], e.g. [kn:ocp-scc#0].", "knowledgeAsOf": "knowledge as of 2026-10-27 (Kubernetes 1.35, OpenShift 4.22); release-note issues as of 2026-10-27 for OpenShift 4.20, 4.21, 4.22", "query": "readinessProbe", "results": [ { "chunkId": "kn:k8s-probes#0", "license": "Apache-2.0", "origin": "builtin", "score": 4.296, "sourceId": "builtin:k8s-probes", "text": "- **readinessProbe**: may this pod receive traffic now? Failing removes the pod from Service endpoints (no restart).\n Can check dependencies.\n- **livenessProbe**: is the process wedged? Failing restarts the container. Check only the process itself - never a\n database or downstream API, or one slow dependency restarts every replica at once.\n- **startupProbe**: disables liveness/readiness until the app has started; size it as\n `failureThreshold x periodSeconds >= worst-case startup time`.", "title": "Readiness, liveness and startup probes > Probes", "url": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/", "version": "2026-10-27" }, { "chunkId": "kn:k8s-probes#1", "license": "Apache-2.0", "origin": "builtin", "score": 4.199, "sourceId": "builtin:k8s-probes", "text": "```yaml\nreadinessProbe: {httpGet: {path: /readyz, port: http}, periodSeconds: 5, timeoutSeconds: 2, failureThreshold: 3}\nlivenessProbe: {httpGet: {path: /healthz, port: http}, periodSeconds: 10, timeoutSeconds: 3, failureThreshold: 3}\n```\nApps must listen on 0.0.0.0 (not 127.0.0.1) so the kubelet can reach them. Keep `timeoutSeconds` below\n`periodSeconds` as a convention so probes do not overlap (Kubernetes does not enforce it).", "title": "Readiness, liveness and startup probes > Safe defaults", "url": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/", "version": "2026-10-27" } ], "webEnabled": false } }, "tool_result_checked": true, "tool_schema_bytes": 40072, "tools": [ "kubenoob_run_protocol", "kubenoob_validate_manifests", "kubenoob_audit_manifests", "kubenoob_red_team", "kubenoob_fix_manifests", "kubenoob_clarify_requirements", "kubenoob_generate_manifests", "kubenoob_generate_helm_chart", "kubenoob_search_knowledge", "kubenoob_get_knowledge", "kubenoob_api_history", "kubenoob_explain_rule", "kubenoob_list_rules", "kubenoob_diagnose", "kubenoob_known_issues", "kubenoob_explain_denial", "kubenoob_check_network_policy", "kubenoob_incidents", "kubenoob_incident", "kubenoob_incident_confirm", "kubenoob_learn_tracks", "kubenoob_learn_lesson", "kubenoob_learn_exercise", "kubenoob_learn_submit", "kubenoob_learn_quiz", "kubenoob_learn_progress", "kubenoob_grade_answer", "kubenoob_learning_summary", "kubenoob_learning_note_add", "kubenoob_learning_profile_set", "kubenoob_config_status" ], "working": true }, "evidence_strength": "readme_checked", "example_checks": [ { "claim": "Quick start: list the built-in demos", "command": " demo --list", "deferred": false, "evidence": "audit Audit and auto-fix a Deployment for OpenShift [developers, platform engineers]\ndiagnose Diagnose SCC and CrashLoop/OOM failures, read-only first [SREs, on-call]\nprotocol Blueprint to audited ROSA HCP manifests (7-step protocol) [platform engineers]\nlearn Lesson plus a graded exercise [learners, trainers]\nsearch Cited answers from local knowledge [everyone]\nlearning Remember a confirmed team fix and find it later [teams]\nposture Show and lock the security posture [security, platform admins]\n\nRun: kube-noob demo or kube-noob demo all", "expected": "lists demos and the run command", "input": "demo --list", "kind": "example", "outcome": "command completed successfully", "returncode": 0, "source": "README.md Quick start", "verdict": "yes" }, { "claim": "Quick start: run the offline self-test", "command": " selftest", "deferred": false, "evidence": "kube-noob self-test: 61/61 passed\n everyday 10/10\n helm 7/7\n kubernetes 18/18\n openshift 11/11\n rhacs 5/5\n rosa-hcp 10/10", "expected": "all rule and playbook checks pass", "input": "selftest", "kind": "example", "outcome": "command completed successfully", "returncode": 0, "source": "README.md Quick start", "verdict": "yes" }, { "claim": "Quick start: cited search with the demo query", "command": " demo search", "deferred": false, "evidence": "== kube-noob demo: Cited answers from local knowledge ==\n\n# Ask the local knowledge base; every answer carries a citation\n$ kube-noob search \"restricted-v2 SCC runAsUser range\"\n[kn:ocp-scc#1] SecurityContextConstraints (SCC) on OpenShift > restricted-v2 (default for authenticated users on new 4.11+ clusters)\n[kn:openshift#4] OpenShift Container Platform - what it adds on top of Kubernetes > Security defaults\n[kn:ocp-arbitrary-uid#0] Building images that run as an arbitrary UID (OpenShift) > Arbitrary UIDs", "expected": "cited answers with kn: ids", "input": "demo search", "kind": "example", "outcome": "command completed successfully", "returncode": 0, "source": "README.md Quick start", "verdict": "yes" } ], "status": "PASS" }, "diagnosis": null }