kubectl-investigator

What problem does it solve?

AI agents lack the structured methodology that seasoned SREs apply during live Kubernetes incidents. Without guardrails, they misclassify failures, miss critical signals, or recommend dangerous mitigations like unbounded rollbacks. This skill encodes a proven seven-step investigation playbook so agents triage incidents with the same rigor as a senior engineer, producing timelines, ranked hypotheses, and safe mitigation recommendations.

Core Features & Use Cases

• Seven-step investigation methodology: Anchor the incident window, bisect the change surface, classify against four reference paths (OOM, DNS, cascading-failure, deploy-correlator), confirm with three independent signals, quantify blast radius, and propose mitigation before root cause.
• Built-in escalation guards: Detects methodology-level failure modes (ambiguous T0, confirmation bias, asymmetric revert blast radius) and operational failure modes (missing telemetry, multi-incident interleaving) to force human escalation rather than force-fit a wrong answer.
• Eleven fixture-tested worked examples: Covers canonical paths, escalation cases, and edge cases (zero-change windows, multi-region asymmetry, capacity-bound organic growth) with deterministic replay tests that run offline against committed telemetry snapshots.

Quick Start

Use the kubectl-investigator skill to investigate the current Kubernetes incident by following the seven-step methodology against your cluster telemetry and produce a structured handoff for the postmortem author.