Metadata-Version: 2.5
Name: kube-noob
Version: 0.4.0
Summary: Kubernetes, Helm, OpenShift, ROSA HCP and RHACS expertise as deterministic tools: audit, diagnose, cited search, learning. No AI inside: use it from Claude, OpenShift Lightspeed, any MCP client or the CLI.
Project-URL: Homepage, https://github.com/aashishmahajan/kube-noob
Project-URL: Source, https://github.com/aashishmahajan/kube-noob
Project-URL: Issues, https://github.com/aashishmahajan/kube-noob/issues
Project-URL: Security, https://github.com/aashishmahajan/kube-noob/security/policy
Project-URL: Documentation, https://github.com/aashishmahajan/kube-noob/tree/main/docs
Project-URL: Changelog, https://github.com/aashishmahajan/kube-noob/blob/main/CHANGELOG.md
Project-URL: Install, https://github.com/aashishmahajan/kube-noob/blob/main/docs/install.md
Author: kube-noob maintainers
License-Expression: Apache-2.0
License-File: LICENSE
License-File: NOTICE
License-File: THIRD_PARTY_NOTICES.md
Keywords: helm,hypershift,kubernetes,learning,manifest-audit,mcp,model-context-protocol,openshift,rhacs,rosa,security,sre,stackrox
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Education
Classifier: Intended Audience :: System Administrators
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Classifier: Topic :: System :: Clustering
Classifier: Topic :: System :: Systems Administration
Classifier: Typing :: Typed
Requires-Python: >=3.11.4
Requires-Dist: httpx<1,>=0.27
Requires-Dist: jsonschema<5,>=4.23
Requires-Dist: mcp<3,>=2.3
Requires-Dist: pydantic<3,>=2.12
Requires-Dist: pyyaml<7,>=6.0.2
Requires-Dist: starlette>=0.40
Requires-Dist: uvicorn<1,>=0.31
Provides-Extra: ask
Requires-Dist: anthropic<3,>=2.0; extra == 'ask'
Provides-Extra: dev
Requires-Dist: anthropic<3,>=2.0; extra == 'dev'
Requires-Dist: build>=1.2; extra == 'dev'
Requires-Dist: mypy>=1.13; extra == 'dev'
Requires-Dist: pip-audit>=2.7; extra == 'dev'
Requires-Dist: pytest-cov>=5; extra == 'dev'
Requires-Dist: pytest>=8.3; extra == 'dev'
Requires-Dist: ruff>=0.8; extra == 'dev'
Requires-Dist: types-pyyaml>=6.0; extra == 'dev'
Requires-Dist: uv>=0.11; extra == 'dev'
Description-Content-Type: text/markdown

<p align="center">
  <img src="https://raw.githubusercontent.com/aashishmahajan/kube-noob/main/docs/brand/social-preview.png" alt="kube-noob - No AI inside. Works with yours." width="720">
</p>

# kube-noob

<!-- mcp-name: io.github.aashishmahajan/kube-noob -->

[![ci](https://github.com/aashishmahajan/kube-noob/actions/workflows/ci.yml/badge.svg)](https://github.com/aashishmahajan/kube-noob/actions/workflows/ci.yml)
[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/aashishmahajan/kube-noob/badge)](https://securityscorecards.dev/viewer/?uri=github.com/aashishmahajan/kube-noob)
[![PyPI](https://img.shields.io/pypi/v/kube-noob)](https://pypi.org/project/kube-noob/)
[![License](https://img.shields.io/badge/license-Apache--2.0-blue)](https://github.com/aashishmahajan/kube-noob/blob/main/LICENSE)

**No AI inside. Works with yours.** kube-noob is a Kubernetes, OpenShift, ROSA HCP, Helm and RHACS/StackRox expert
in a box: audit rules, read-only-first playbooks, cited docs and graded exercises. Claude, OpenShift Lightspeed or any
MCP client calls it as tools; the CLI runs it with no AI at all. It makes no network calls unless you turn them on.

- **Audit**: 60 rules plus strict schemas (Kubernetes 1.35, Routes, SCCs, EgressFirewall, Gateway API, StackRox),
  removed-API checks, safe auto-fixes, 9 red-team scenarios, RHACS policy mapping.
- **Generate**: hardened manifests and Helm charts, re-audited before return.
- **Debug**: 38 offline playbooks, read-only steps first; reported OpenShift bugs with their fix version; policy
  denials explained (Kyverno, Gatekeeper, Pod Security, SCC, RBAC); NetworkPolicy reachability; read-only cluster
  evidence (never Secrets).
- **Learn**: 5 tracks, 16 lessons, graded exercises; remembers confirmed fixes locally.
- **Cite**: answers cite local knowledge as `[kn:<doc>#<n>]`.

Every design request runs a 7-step protocol: Clarify, Validate, Research, Audit, Calibrate, Generate, Red Team.

## Who does the thinking

| You use | Who answers | What leaves your machine |
|---|---|---|
| The Claude plugin (Claude Code, Cowork) | Claude, calling kube-noob's tools | What you share with Claude, as in any chat; kube-noob sends nothing |
| OpenShift Lightspeed or another MCP client | That client's model | Whatever that client sends its model; kube-noob sends nothing |
| The CLI | kube-noob's rules, no model | Nothing |
| `kube-noob ask` (optional) | A model you configure: Anthropic or a local one | Your question, to that model only |

## Quick start

```bash
brew tap aashishmahajan/kube-noob https://github.com/aashishmahajan/kube-noob
brew trust --formula aashishmahajan/kube-noob/kube-noob
brew install kube-noob
kube-noob demo --list
kube-noob audit -f k8s/ --platform openshift --version 4.22
kube-noob diagnose 'paste events or errors'
kube-noob doctor
kube-noob selftest
```

Short form: `noob`. No Homebrew: `uv tool install kube-noob` or `pipx install kube-noob` (Python 3.11+, not macOS's
built-in 3.9). Errors: [install](https://github.com/aashishmahajan/kube-noob/blob/main/docs/install.md).
Roles, demos: [use cases](https://github.com/aashishmahajan/kube-noob/blob/main/docs/use-cases.md).

## Use with Claude or any MCP client

Claude plugin, in Claude Code (needs [uv](https://docs.astral.sh/uv/)):

```
/plugin marketplace add aashishmahajan/kube-noob
/plugin install kube-noob@kube-noob
```

In claude.ai or the desktop app: **Customize > Plugins > Add > Add marketplace**, `aashishmahajan/kube-noob`.

Any MCP client:

```json
{"mcpServers": {"kube-noob": {"command": "uvx", "args": ["--from", "kube-noob==0.4.0", "kube-noob", "mcp"]}}}
```

Cluster and web tools appear when enabled.

## Run on OpenShift

As a token-protected service, a loopback-only sidecar, or a tool for OpenShift Lightspeed:
[docs/openshift.md](https://github.com/aashishmahajan/kube-noob/blob/main/docs/openshift.md). The chart ships
NetworkPolicies and runs under `restricted-v2`.

## Safe by default

| Setting | Default | Change with |
|---|---|---|
| Web lookups (HTTPS GET, allowlisted docs, text only) | off | `webEnabled: true` / `KUBE_NOOB_WEB_ENABLED=true` |
| Admin offline lock (overrides web, local models only) | off | `offline: true` / `KUBE_NOOB_OFFLINE=1` / chart `config.offline` |
| Live cluster (read-only, no Secrets) | off | `cluster.enabled: true` / `--cluster-enabled` |
| Local learning file (profile, confirmed notes) | on | `learningEnabled: false` |
| Model for `kube-noob ask` only | none | `llm.provider: anthropic` (`kube-noob[ask]`) or `openai-compatible` |

`kube-noob doctor` shows what it can reach. Config never comes from the current directory implicitly. All keys: [kube-noob.example.yaml](https://github.com/aashishmahajan/kube-noob/blob/main/kube-noob.example.yaml).

## Docs

- [Use cases](https://github.com/aashishmahajan/kube-noob/blob/main/docs/use-cases.md) and [learning](https://github.com/aashishmahajan/kube-noob/blob/main/docs/learning.md)
- [Enterprise roadmap](https://github.com/aashishmahajan/kube-noob/blob/main/docs/roadmap.md)
- [Architecture](https://github.com/aashishmahajan/kube-noob/blob/main/docs/architecture.md)
- [Training](https://github.com/aashishmahajan/kube-noob/blob/main/docs/training.md)
- [Operations](https://github.com/aashishmahajan/kube-noob/blob/main/docs/operations.md)
- [Guidance traceability](https://github.com/aashishmahajan/kube-noob/blob/main/docs/guidance.md) and [release readiness](https://github.com/aashishmahajan/kube-noob/blob/main/docs/release-readiness.md)
- [Privacy](https://github.com/aashishmahajan/kube-noob/blob/main/PRIVACY.md), [security policy](https://github.com/aashishmahajan/kube-noob/blob/main/SECURITY.md) and [contributing](https://github.com/aashishmahajan/kube-noob/blob/main/CONTRIBUTING.md)

## Credits

Credited sources: [THIRD_PARTY_NOTICES.md](https://github.com/aashishmahajan/kube-noob/blob/main/THIRD_PARTY_NOTICES.md). Kubernetes, OpenShift, Helm,
ROSA, RHACS and StackRox are trademarks of their owners; kube-noob is independent and not endorsed by them.
Licensed under [Apache-2.0](https://github.com/aashishmahajan/kube-noob/blob/main/LICENSE).
