bug: list_certs tool fails with "name 'timezone' is not defined" when certificates are present

[anthony-spruyt]

Summary

After upgrading docker.io/rohitghumare64/kubectl-mcp-server:latest to digest sha256:c60ac16... (the one following the PR #78 rename), the list_certs tool (formerly
certs_list_tool) raises NameError: name 'timezone' is not defined whenever the target namespace contains at least one cert-manager Certificate.

Reproduction

list_certs()                          # cluster-wide -> error
list_certs(namespace="cert-manager")  # 0 certs in ns -> OK (total: 0)
list_certs(namespace="traefik")       # 1 cert in ns  -> error

Exact error message returned to the MCP client:

Error calling tool 'list_certs': name 'timezone' is not defined

Expected Behavior

Return the list of Certificates with status, same as when the namespace is empty:

{ "context": "current", "total": N, "expiring_soon": M, "certificates": [...] }

Likely Cause

The empty-list path works, so the exception is raised while iterating certificates — almost certainly in the expiry / expiring_soon computation (e.g.
datetime.now(timezone.utc) or datetime.fromisoformat(...).replace(tzinfo=timezone.utc)). Looks like a missing from datetime import timezone import introduced in the PR
#78 rename refactor.

Related tools (list_cert_issuers, list_cert_requests) work correctly, so the regression is scoped to list_certs only.

Environment

• Image: docker.io/rohitghumare64/kubectl-mcp-server@sha256:c60ac16... (alias :latest, also tags 14f9c13 / main)
• Previous digest sha256:6a3a59b... was not affected (the _tool-suffixed certs_list_tool worked).
• Kubernetes: v1.35.x on Talos Linux
• cert-manager installed, Certificate CRD present, 26 certs across namespaces

Workaround

Use list_custom_resources with group=cert-manager.io, version=v1, resource=certificates — no status parsing but lists the objects.