kube-noob

Learn, audit and debug Kubernetes, OpenShift, ROSA HCP, Helm and RHACS/StackRox, offline by default. Use it as an MCP server, a Claude plugin, a CLI, or a sidecar/service on OpenShift.

• Audit: 60 rules plus strict schemas (Kubernetes 1.35, Routes, SCCs, EgressFirewall, Gateway API, StackRox), removed-API checks, safe auto-fixes, 9 red-team scenarios, RHACS policy mapping.
• Generate: hardened manifests and Helm charts for kubernetes, openshift, rosa-classic, rosa-hcp, re-audited before they are returned.
• Debug: 33 offline playbooks, read-only steps first; opt-in, read-only cluster evidence (Secrets are never read, values are redacted).
• Learn: 5 tracks, 16 lessons, graded exercises and quizzes; remembers confirmed team fixes locally.
• Cite: answers reference local knowledge as [kn:<doc>#<n>] with source and license.

Every design request runs a 7-step protocol: Clarify, Validate, Research, Audit, Calibrate, Generate, Red Team.

Quick start

pipx install kube-noob
kube-noob demo --list
kube-noob audit -f k8s/ --platform openshift --version 4.22
kube-noob diagnose -f events.txt
kube-noob doctor
kube-noob selftest

Pick your role in use cases; every demo runs offline.

Generate a hardened app for ROSA HCP from a blueprint:

name: orders-api
namespace: shop
image: quay.io/acme/orders@sha256:<digest>
platform: rosa-hcp
storage: {size: 20Gi, accessMode: ReadWriteMany}
exposure: {type: route, host: orders.apps.example.com}

kube-noob protocol "deploy orders-api with shared storage" --blueprint blueprint.yaml

Use with Claude or any MCP client

Claude Code plugin (skills + server):

/plugin marketplace add aashishmahajan/kube-noob
/plugin install kube-noob@kube-noob

Any MCP client:

{"mcpServers": {"kube-noob": {"command": "uvx", "args": ["--from", "kube-noob==0.2.0", "kube-noob", "mcp"]}}}

Tools are prefixed kubenoob_ (protocol, audit, fix, generate, diagnose, search, learn, grade). Cluster and web tools appear only when enabled.

Run on OpenShift

git clone https://github.com/aashishmahajan/kube-noob && cd kube-noob
oc new-project kube-noob
oc create secret generic kube-noob-token --from-literal=token="$(openssl rand -hex 32)"
helm install kube-noob deploy/helm/kube-noob --set auth.existingSecret=kube-noob-token

The service requires a bearer token, ships NetworkPolicies and runs under restricted-v2. For a loopback-only sidecar see deploy/sidecar.

Safe by default

kube-noob doctor prints what the process can reach and exits 1 when the configuration contradicts the lock.

Config comes from --config, $KUBE_NOOB_CONFIG, ~/.config/kube-noob/config.yaml or /etc/kube-noob/config.yaml, never implicitly from the current directory. All keys: kube-noob.example.yaml.

Docs

• Use cases by role and learning with kube-noob
• Run it on OpenShift: service, sidecar, Lightspeed and the enterprise roadmap
• Architecture and trust boundaries
• Corpus, training and the reward
• Operations: weekly risk review and releases
• Guidance traceability (every rule and its test) and release readiness
• Security policy and Contributing

Credits

Built on public, credited sources (Kubernetes docs CC BY 4.0, OpenShift docs, Red Hat Cloud Experts, HyperShift, StackRox, Helm docs and more): see THIRD_PARTY_NOTICES.md. Kubernetes, OpenShift, Helm, ROSA, RHACS and StackRox are trademarks of their owners; kube-noob is independent and not endorsed by them. Licensed under Apache-2.0.