kube-noob

kube-noob

No AI inside. Works with yours. kube-noob is a Kubernetes, OpenShift, ROSA HCP, Helm and RHACS/StackRox expert in a box: audit rules, read-only-first playbooks, cited docs and graded exercises. Claude, OpenShift Lightspeed or any MCP client calls it as tools; the CLI runs it with no AI at all. It makes no network calls unless you turn them on.

• Audit: 60 rules plus strict schemas (Kubernetes 1.35, Routes, SCCs, EgressFirewall, Gateway API, StackRox), removed-API checks, safe auto-fixes, 9 red-team scenarios, RHACS policy mapping.
• Generate: hardened manifests and Helm charts, re-audited before return.
• Debug: 38 offline playbooks, read-only steps first; reported OpenShift bugs with their fix version; policy denials explained (Kyverno, Gatekeeper, Pod Security, SCC, RBAC); NetworkPolicy reachability; read-only cluster evidence (never Secrets).
• Learn: 5 tracks, 16 lessons, graded exercises; remembers confirmed fixes locally.
• Cite: answers cite local knowledge as [kn:<doc>#<n>].

Every design request runs a 7-step protocol: Clarify, Validate, Research, Audit, Calibrate, Generate, Red Team.

Who does the thinking

You use	Who answers	What leaves your machine
The Claude plugin (Claude Code, Cowork)	Claude, calling kube-noob's tools	What you share with Claude, as in any chat; kube-noob sends nothing
OpenShift Lightspeed or another MCP client	That client's model	Whatever that client sends its model; kube-noob sends nothing
The CLI	kube-noob's rules, no model	Nothing
kube-noob ask (optional)	A model you configure: Anthropic or a local one	Your question, to that model only

Quick start

brew tap aashishmahajan/kube-noob https://github.com/aashishmahajan/kube-noob
brew trust --formula aashishmahajan/kube-noob/kube-noob
brew install kube-noob
kube-noob demo --list
kube-noob audit -f k8s/ --platform openshift --version 4.22
kube-noob diagnose 'paste events or errors'
kube-noob doctor
kube-noob selftest

Short form: noob. No Homebrew: uv tool install kube-noob or pipx install kube-noob (Python 3.11+, not macOS's built-in 3.9). Errors: install. Roles, demos: use cases.

Use with Claude or any MCP client

Claude plugin, in Claude Code (needs uv):

/plugin marketplace add aashishmahajan/kube-noob
/plugin install kube-noob@kube-noob

In claude.ai or the desktop app: Customize > Plugins > Add > Add marketplace, aashishmahajan/kube-noob.

Any MCP client:

{"mcpServers": {"kube-noob": {"command": "uvx", "args": ["--from", "kube-noob==0.4.0", "kube-noob", "mcp"]}}}

Cluster and web tools appear when enabled.

Run on OpenShift

As a token-protected service, a loopback-only sidecar, or a tool for OpenShift Lightspeed: docs/openshift.md. The chart ships NetworkPolicies and runs under restricted-v2.

Safe by default

Setting	Default	Change with
Web lookups (HTTPS GET, allowlisted docs, text only)	off	webEnabled: true / KUBE_NOOB_WEB_ENABLED=true
Admin offline lock (overrides web, local models only)	off	offline: true / KUBE_NOOB_OFFLINE=1 / chart config.offline
Live cluster (read-only, no Secrets)	off	cluster.enabled: true / --cluster-enabled
Local learning file (profile, confirmed notes)	on	learningEnabled: false
Model for kube-noob ask only	none	llm.provider: anthropic (kube-noob[ask]) or openai-compatible

kube-noob doctor shows what it can reach. Config never comes from the current directory implicitly. All keys: kube-noob.example.yaml.

Docs

• Use cases and learning
• Enterprise roadmap
• Architecture
• Training
• Operations
• Guidance traceability and release readiness
• Privacy, security policy and contributing

Credits

Credited sources: THIRD_PARTY_NOTICES.md. Kubernetes, OpenShift, Helm, ROSA, RHACS and StackRox are trademarks of their owners; kube-noob is independent and not endorsed by them. Licensed under Apache-2.0.