Appearance
Kubernetes ​
| Workflow | Type | Description |
|---|---|---|
| kubernetes.cluster.api_resources | Atomic | List all API resources advertised by the cluster (kubectl api-resources equivalent) |
| kubernetes.cluster.version | Atomic | Read Kubernetes API server version. |
| kubernetes.clusterrole.delete | Atomic | Delete a ClusterRole (cluster-scoped, rbac.authorization.k8s.io/v1) |
| kubernetes.clusterrole.ensure | Atomic | Create or replace a ClusterRole (cluster-scoped, rbac.authorization.k8s.io/v1) |
| kubernetes.clusterrole.list | Atomic | Enumerate ClusterRoles (cluster-scoped) |
| kubernetes.clusterrolebinding.delete | Atomic | Delete a ClusterRoleBinding (cluster-scoped, rbac.authorization.k8s.io/v1) |
| kubernetes.clusterrolebinding.ensure | Atomic | Create or replace a ClusterRoleBinding (cluster-scoped). role_ref is immutable; existing binding with different role_ref is deleted and recreated. |
| kubernetes.clusterrolebinding.list | Atomic | Enumerate ClusterRoleBindings (cluster-scoped) |
| kubernetes.configmap.delete | Atomic | Delete a namespaced Kubernetes ConfigMap |
| kubernetes.configmap.ensure | Atomic | Create or replace a namespaced Kubernetes ConfigMap |
| kubernetes.configmap.get | Atomic | Read a single ConfigMap (data and binary_data included) |
| kubernetes.configmap.list | Atomic | List ConfigMaps in a namespace |
| kubernetes.connection.identity | Atomic | Read effective Kubernetes user identity. |
| kubernetes.cronjob.delete | Atomic | Delete a namespaced Kubernetes CronJob |
| kubernetes.cronjob.ensure | Atomic | Create or replace a namespaced Kubernetes CronJob (batch/v1) |
| kubernetes.cronjob.list | Atomic | Enumerate CronJobs in a namespace (batch/v1) |
| kubernetes.daemonset.delete | Atomic | Delete a namespaced Kubernetes DaemonSet |
| kubernetes.daemonset.ensure | Atomic | Create or replace a namespaced Kubernetes DaemonSet |
| kubernetes.daemonset.list | Atomic | Enumerate DaemonSets in a namespace |
| kubernetes.deployment.delete | Atomic | Delete a namespaced Kubernetes Deployment |
| kubernetes.deployment.ensure | Atomic | Create or replace a namespaced Kubernetes Deployment |
| kubernetes.deployment.get | Atomic | Read a single Deployment's metadata, spec, and status |
| kubernetes.deployment.list | Atomic | Enumerate Deployments in a namespace |
| kubernetes.deployment.patch | Atomic | Apply a strategic-merge, JSON-merge, or JSON patch to a Deployment |
| kubernetes.deployment.pause | Atomic | Pause a Deployment rollout (kubectl rollout pause equivalent) |
| kubernetes.deployment.restart | Atomic | Trigger a rollout restart of a Deployment (kubectl rollout restart equivalent) |
| kubernetes.deployment.resume | Atomic | Resume a paused Deployment rollout (kubectl rollout resume equivalent) |
| kubernetes.deployment.rollback | Atomic | Roll a Deployment back to a previous revision (kubectl rollout undo equivalent) |
| kubernetes.deployment.rollout_status | Atomic | Report current rollout state of a Deployment (single read; not a watcher) |
| kubernetes.deployment.scale | Atomic | Set the replica count on a Deployment (scale subresource) |
| kubernetes.deployment.set_image | Atomic | Update a Deployment container's image (kubectl set image equivalent) — triggers a rolling update |
| kubernetes.deployment.wait_for_available | Atomic | Poll a Kubernetes Deployment until rollout completes or timeout |
| kubernetes.event.list | Atomic | List events in a namespace, newest first |
| kubernetes.horizontalpodautoscaler.delete | Atomic | Delete a namespaced Kubernetes HorizontalPodAutoscaler |
| kubernetes.horizontalpodautoscaler.ensure | Atomic | Create or replace a namespaced Kubernetes HorizontalPodAutoscaler (autoscaling/v2) |
| kubernetes.horizontalpodautoscaler.list | Atomic | Enumerate HorizontalPodAutoscalers with their live scaling state |
| kubernetes.ingress.delete | Atomic | Delete a namespaced Kubernetes Ingress |
| kubernetes.ingress.ensure | Atomic | Create or replace a namespaced Kubernetes Ingress (networking.k8s.io/v1) |
| kubernetes.ingress.list | Atomic | Enumerate Ingresses in a namespace (networking.k8s.io/v1) |
| kubernetes.job.delete | Atomic | Delete a Kubernetes Job |
| kubernetes.job.ensure | Atomic | Create a Kubernetes Job; pass replace=true to delete+recreate if it already exists (Jobs are immutable) |
| kubernetes.job.list | Atomic | Enumerate Jobs in a namespace |
| kubernetes.job.wait_for_complete | Linear | Poll a Kubernetes Job until it reaches Complete or Failed condition (or timeout) |
| kubernetes.limitrange.delete | Atomic | Delete a namespaced Kubernetes LimitRange |
| kubernetes.limitrange.ensure | Atomic | Create or replace a namespaced Kubernetes LimitRange |
| kubernetes.limitrange.list | Atomic | Enumerate LimitRanges in a namespace |
| kubernetes.manifest.apply | Atomic | Create or replace any Kubernetes resource from a raw manifest dict |
| kubernetes.manifest.apply_ssa | Atomic | Server-side apply (SSA) a single Kubernetes manifest |
| kubernetes.manifest.delete | Atomic | Delete any Kubernetes resource by (apiVersion, kind, name, namespace) |
| kubernetes.manifest.diff | Atomic | Server-side dry-run a manifest to preview what would change (no mutation) |
| kubernetes.manifest.validate | Atomic | Server-side schema validation of a manifest with strict field checking (no mutation) |
| kubernetes.namespace.delete | Atomic | Delete a Kubernetes Namespace |
| kubernetes.namespace.ensure | Atomic | Create a Kubernetes Namespace if it does not exist |
| kubernetes.namespace.list | Atomic | Enumerate namespaces on a Kubernetes cluster |
| kubernetes.networkpolicy.delete | Atomic | Delete a namespaced Kubernetes NetworkPolicy |
| kubernetes.networkpolicy.ensure | Atomic | Create or replace a namespaced Kubernetes NetworkPolicy (networking.k8s.io/v1) |
| kubernetes.networkpolicy.get | Atomic | Read a single NetworkPolicy (full spec included) |
| kubernetes.networkpolicy.list | Atomic | Enumerate NetworkPolicies in a namespace (networking.k8s.io/v1) |
| kubernetes.networkpolicy.verify-receipt | Atomic | Independent read-only receipt of NetworkPolicies applied in one or more namespaces (canonical spec digest) |
| kubernetes.node.cordon | Atomic | Mark a Node as unschedulable (kubectl cordon equivalent) |
| kubernetes.node.drain | Linear | Cordon a Node and evict its Pods (kubectl drain equivalent) |
| kubernetes.node.list | Atomic | Enumerate all Nodes in a Kubernetes cluster |
| kubernetes.node.uncordon | Atomic | Mark a Node as schedulable (kubectl uncordon equivalent) |
| kubernetes.persistentvolume.delete | Atomic | Delete a cluster PersistentVolume (destructive; reclaims orphaned storage) |
| kubernetes.persistentvolume.list | Atomic | Enumerate cluster PersistentVolumes, flagging orphaned storage |
| kubernetes.pod.delete | Atomic | Delete a Pod (controller-managed pods will be recreated by their controller) |
| kubernetes.pod.exec | Linear | Run a command on a Pod over a long-lived WebSocket session |
| kubernetes.pod.get | Atomic | Read a single Pod's metadata, spec, and status |
| kubernetes.pod.list | Atomic | Enumerate Pods in a namespace |
| kubernetes.pod.logs | Atomic | Read recent logs from a Pod (one-shot tail; not streaming) |
| kubernetes.pod.logs_stream | Linear | Follow a Pod's logs over a long-lived WebSocket session |
| kubernetes.pod.port_forward | Linear | Forward a local WebSocket to a TCP port on a Pod |
| kubernetes.poddisruptionbudget.delete | Atomic | Delete a namespaced Kubernetes PodDisruptionBudget |
| kubernetes.poddisruptionbudget.ensure | Atomic | Create or replace a namespaced Kubernetes PodDisruptionBudget (policy/v1) |
| kubernetes.poddisruptionbudget.list | Atomic | Enumerate PodDisruptionBudgets, flagging any that block a drain |
| kubernetes.pvc.delete | Atomic | Delete a namespaced Kubernetes PersistentVolumeClaim (note: underlying PV may be retained or deleted based on reclaim policy) |
| kubernetes.pvc.ensure | Atomic | Create or replace a namespaced Kubernetes PersistentVolumeClaim |
| kubernetes.pvc.list | Atomic | Enumerate PersistentVolumeClaims in a namespace |
| kubernetes.pvc.wait_for_bound | Linear | Poll a PersistentVolumeClaim until status.phase == Bound, or timeout |
| kubernetes.rbac.can_i | Atomic | Check whether the connection's identity can perform a verb on a resource (kubectl auth can-i equivalent) |
| kubernetes.resource.wait_for_condition | Linear | Generic kubectl-wait equivalent: poll any Kubernetes resource until a condition matches the requested status |
| kubernetes.resourcequota.delete | Atomic | Delete a namespaced Kubernetes ResourceQuota |
| kubernetes.resourcequota.ensure | Atomic | Create or replace a namespaced Kubernetes ResourceQuota |
| kubernetes.resourcequota.get | Atomic | Read a ResourceQuota with its live consumption and utilization |
| kubernetes.resourcequota.list | Atomic | Enumerate ResourceQuotas in a namespace with their utilization |
| kubernetes.role.delete | Atomic | Delete a namespaced Kubernetes Role (rbac.authorization.k8s.io/v1) |
| kubernetes.role.ensure | Atomic | Create or replace a namespaced Kubernetes Role (rbac.authorization.k8s.io/v1) |
| kubernetes.role.list | Atomic | Enumerate Roles in a namespace |
| kubernetes.rolebinding.delete | Atomic | Delete a namespaced Kubernetes RoleBinding (rbac.authorization.k8s.io/v1) |
| kubernetes.rolebinding.ensure | Atomic | Create or replace a namespaced Kubernetes RoleBinding (role_ref is immutable; existing binding with different role_ref is deleted and recreated) |
| kubernetes.rolebinding.list | Atomic | Enumerate RoleBindings in a namespace |
| kubernetes.secret.delete | Atomic | Delete a namespaced Kubernetes Secret |
| kubernetes.secret.ensure | Atomic | Create or replace a namespaced Kubernetes Secret |
| kubernetes.secret.get | Atomic | Read a single Secret (data values redacted by default; pass reveal=true to include them) |
| kubernetes.secret.list | Atomic | List Secrets in a namespace (keys + metadata only — values are not returned) |
| kubernetes.service.delete | Atomic | Delete a namespaced Kubernetes Service |
| kubernetes.service.ensure | Atomic | Create or replace a namespaced Kubernetes Service |
| kubernetes.service.get | Atomic | Read a single Service's spec and status |
| kubernetes.service.list | Atomic | List Services in a namespace |
| kubernetes.serviceaccount.delete | Atomic | Delete a namespaced Kubernetes ServiceAccount |
| kubernetes.serviceaccount.ensure | Atomic | Create or replace a namespaced Kubernetes ServiceAccount |
| kubernetes.serviceaccount.list | Atomic | Enumerate ServiceAccounts in a namespace |
| kubernetes.statefulset.delete | Atomic | Delete a namespaced Kubernetes StatefulSet |
| kubernetes.statefulset.ensure | Atomic | Create or replace a namespaced Kubernetes StatefulSet |
| kubernetes.statefulset.list | Atomic | Enumerate StatefulSets in a namespace |
| kubernetes.statefulset.wait_for_ready | Linear | Poll a StatefulSet until all replicas are ready or timeout |
| kubernetes.storageclass.list | Atomic | Enumerate the cluster's StorageClasses and identify the default |
| kubernetes.target_availability.verify | Atomic | Prove deny-test targets are present and available before treating access-denied as evidence |
| kubernetes.workload.healthcheck | Atomic | Atomic adapter for kubernetes.workload.healthcheck; required by parent workflow specs: kubernetes.app.deploy-from-image, kubernetes.workload.rollback-after-healthcheck. |