# Observability K8S Investigation

Investigate Kubernetes workload, node, and control-plane issues using OTel telemetry...

- Repository: https://github.com/elastic/agent-skills (603 stars)
- Category: DevOps
- License: Apache-2.0
- Last updated: 2026-10-29
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add elastic/agent-skills --skill observability-k8s-investigation -g -a claude-code -y`
Codex: `npx skills add elastic/agent-skills --skill observability-k8s-investigation -g -a codex -y`
Cursor: `npx skills add elastic/agent-skills --skill observability-k8s-investigation -g -a cursor -y`
Gemini CLI: `npx skills add elastic/agent-skills --skill observability-k8s-investigation -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add elastic/agent-skills`

## Description

Investigate Kubernetes workload, node, and control-plane issues using OTel telemetry (EDOT). Use when diagnosing pod failures (CrashLoopBackOff, OOMKilled, Error), node pressure, resource exhaustion, image pull failures, admission rejections, autoscaling anomalies, or correlating K8s state with application signals. OTel ingest path only, the legacy ECS Kubernetes integration shape is out of scope.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Kubernetes Investigation

Diagnose Kubernetes issues using OTel telemetry collected via EDOT (Elastic Distribution of OpenTelemetry) and the
kube-stack collector. Correlate cluster state, pod runtime metrics, K8s events, application logs, and APM to identify
root cause across the workload, node, and control-plane layers.

<!-- begin-partial: preamble -->

## Environment Configuration

This skill executes Elasticsearch operations through the `elastic` CLI. If the
[`elastic` CLI](https://github.com/elastic/cli#configuration) is not installed, tell the user what it is needed for. Do
not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., `GET /`, `GET /_cat/indices`, `GET /{index}/_mapping`,
`GET /{index}/_settings/index.mode`, `POST /_query`). The [Operations](#operations) table at the end of this document
maps each shorthand to the equivalent `elastic` CLI command, always use the CLI rather than calling the HTTP API
directly.

<!-- end-partial: preamble -->

### Analysis without cluster access

The CLI check above gates _querying the cluster_, it does not gate analysis. When the user has already supplied the
evidence in their question (metric values, counts, status reasons, log lines, alert payloads, configuration), reason
from that evidence and deliver the conclusion.

When you genuinely do need data the user has not provided, still say what you would check and how, name the specific
query, index, and field that would settle the question, and then ask for CLI setup. An answer that names the check is
useful without a cluster; one that only asks for setup is not.

The rest: https://github.com/elastic/agent-skills/blob/HEAD/plugins/observability/skills/k8s-investigation/SKILL.md