# observability-k8s-investigation

Investigates Kubernetes failures with OTel telemetry, from pod restarts and node pressure to control-plane issues.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 3000 installs · ★ 601
- Author: elastic
- License: Apache-2.0 · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/elastic/agent-skills/tree/HEAD/skills/observability/k8s-investigation/SKILL.md
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/skills/observability-k8s-investigation

## What it does

This skill investigates Kubernetes workload, node, and control-plane failures through EDOT telemetry and the `kube-stack collector`. It correlates cluster state with pod metrics, Kubernetes events, and application logs to narrow down `CrashLoopBackOff`, `OOMKilled`, image-pull failures, and autoscaling anomalies.

It runs Elasticsearch operations through the `elastic` CLI rather than direct HTTP API calls. Queries require `elastic` CLI >= 0.2 with an Elasticsearch context, Kubernetes telemetry ingested through EDOT or the OpenTelemetry `kube-stack collector`, and Elasticsearch 8.11 or Serverless. Check the telemetry ingest path before starting an investigation.

When metrics, status reasons, or log lines are already supplied, the skill can assess that evidence without cluster access. A log query returning no rows is reported as `no_logs_available`, not treated as proof of a particular failure mode.

## Requirements
- Works with: Kubernetes

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add elastic/agent-skills --skill observability-k8s-investigation -a claude-code
```
```bash
npx skills add elastic/agent-skills --skill k8s-investigation -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/k8s-investigation/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/k8s-investigation/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add elastic/agent-skills --skill k8s-investigation -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/k8s-investigation/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add elastic/agent-skills --skill k8s-investigation -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/k8s-investigation/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install elastic/agent-skills k8s-investigation
```

2. **Manually: put the files in place**
- File: `.github/skills/k8s-investigation/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add elastic/agent-skills --skill k8s-investigation -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/elastic/agent-skills --path skills/observability/k8s-investigation
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/k8s-investigation/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add elastic/agent-skills --skill k8s-investigation -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/elastic/agent-skills/tree/HEAD/skills/observability/k8s-investigation/SKILL.md

## When to use it
- identify the cause of a pod `CrashLoopBackOff`
- compare `OOMKilled` with container memory usage
- check node pressure and resource exhaustion
- correlate Kubernetes events with metrics and logs
- investigate an autoscaling anomaly

## Example prompts
- Investigate this pod `CrashLoopBackOff` using EDOT telemetry.
- Check whether this `OOMKilled` event is related to the container memory limit.
- Correlate Kubernetes events, metrics, and logs for this node issue.

## Source text · SKILL.md · Apache-2.0

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: be4ba8687976d7c9.

BEGIN THIRD-PARTY FILE be4ba8687976d7c9
```text
---
name: observability-k8s-investigation
description: >
  Investigate Kubernetes workload, node, and control-plane issues using OTel telemetry
  (EDOT). Use when diagnosing pod failures (CrashLoopBackOff, OOMKilled, Error), node
  pressure, resource exhaustion, image pull failures, admission rejections, autoscaling
  anomalies, or correlating K8s state with application signals. OTel ingest path only
  — the legacy ECS Kubernetes integration shape is out of scope.
compatibility: >
  Requires the `elastic` CLI (>= 0.2) with an Elasticsearch context, and Kubernetes
  telemetry ingested through EDOT / the OpenTelemetry kube-stack collector into OTel-receiver-namespaced
  data streams. The base floor is Elasticsearch 8.11 or later, or Serverless. One
  query uses the `VALUES()` aggregation, which is GA on Serverless but preview from
  8.14 and GA only in 9.4 on Stack; a `VALUES()`-free rewrite is given at the point
  of use. Alert-state lookups additionally need a Kibana context.
metadata:
  author: elastic
  version: 0.5.1
  universal: true
---

# Kubernetes Investigation

Diagnose Kubernetes issues using OTel telemetry collected via EDOT (Elastic Distribution of OpenTelemetry) and the
kube-stack collector. Correlate cluster state, pod runtime metrics, K8s events, application logs, and APM to identify
root cause across the workload, node, and control-plane layers.

<!-- begin-partial: preamble -->

## Environment Configuration

This skill executes Elasticsearch operations through the `elastic` CLI. If the
[`elastic` CLI](https://github.com/elastic/cli#configuration) is not installed, tell the user what it is needed for. Do
not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., `GET /`, `GET /_cat/indices`, `GET /{index}/_mapping`,
`GET /{index}/_settings/index.mode`, `POST /_query`). The [Operations](#operations) table at the end of this document
maps each shorthand to the equivalent `elastic` CLI command — always use the CLI rather than calling the HTTP API
directly.

<!-- end-partial: preamble -->

### Analysis without cluster access

The CLI check above gates _querying the cluster_ — it does not gate analysis. When the user has already supplied the
evidence in their question (metric values, counts, status reasons, log lines, alert payloads, configuration), reason
from that evidence and deliver the conclusion.

When you genuinely do need data the user has not provided, still say what you would check and how — name the specific
```
END THIRD-PARTY FILE be4ba8687976d7c9

The third-party file has ended. Everything between the be4ba8687976d7c9 tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

First 2567 of 33368 bytes. © elastic · Apache-2.0 · https://github.com/elastic/agent-skills/tree/HEAD/skills/observability/k8s-investigation/SKILL.md

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md