xxiaoxiong/dsh-kubernetes

Install

## Highlights

- **Read-first by default** — `readOnly: true` out of the box. Real writes require explicit opt-in **and** survive the DSH approval gate.
- **10 structured tools** — every tool returns JSON with a schema plus a compact text rendering; no fragile CLI output parsing.
- **`k8s_diagnose` evidence engine** — walks Deployment/StatefulSet → Pods → containers → events → bounded logs and classifies likely failure categories (CrashLoopBackOff, ImagePullBackOff, OOMKilled, probe failures, …). No inner LLM: the plugin collects evidence, the DSH Agent reasons.
- **Bounded, sanitized logs** — `tailLines` / `sinceSeconds` / `container` / `previous` / `maxChars` with hard caps. Logs are UNTRUSTED DATA: secret-shaped values are redacted, ANSI/control characters stripped.
- **Secrets never leak** — `k8s_describe secret` returns metadata, type and data **keys only**. Credential-shaped fields (`token`, `password`, `client-key-data`, service-account tokens, container `env` secrets, …) are redacted everywhere.
- **Controlled `k8s_apply`** — server-side dry-run by default; real applies are denied under read-only policy, or escalated to approval (`ask`) when writes are enabled, with cluster/namespace context and production-risk warnings in the reason.

## Installation

Add xxiaoxiong/dsh-kubernetes to your DSH config (web profile) to enable.