Add run-aware logs for jobs and workflows

Author: nadaverell

docs/mcp.md

@@ -194,7 +194,7 @@ Add to `~/.gemini/settings.json`:
 | `get_events` | Recent Kubernetes Warning events, deduplicated and sorted by recency. Filter by resource kind/name to scope. | `namespace` (optional), `limit` (optional, default 20, max 100), `kind` (optional), `name` (optional) |
 | `get_changes` | Recent meaningful changes from the Kubernetes cluster timeline plus native Helm release deployment/operation history (`source: helm`). Use to investigate what changed before an incident, including failed upgrades, rollbacks, and current Helm revisions. If the response includes `sourcesErrored`, treat it as partial data for those sources. Use `get_helm_release include=history,operations` for the full Helm revision trail. | `namespace` (optional), `kind` (optional), `name` (optional), `since` (optional, e.g. `1h`, `30m`; default `1h`), `limit` (optional, default 20, max 50) |
 | `get_pod_logs` | Filtered pod logs prioritizing errors/warnings, with secret redaction. Set `grep` for server-side filtering. | `namespace` (required), `name` (required), `container` (optional), `tail_lines` (optional, default 200), `grep` (optional) |
-| `get_workload_logs` | Aggregated, AI-filtered logs from all pods of a workload (Deployment, StatefulSet, DaemonSet) | `kind` (required), `namespace` (required), `name` (required), `container` (optional), `tail_lines` (optional, default 100 per pod), `grep` (optional) |
+| `get_workload_logs` | Aggregated, AI-filtered logs from all pods of a workload (Deployment, StatefulSet, DaemonSet, Job, Argo Workflow) | `kind` (required), `namespace` (required), `name` (required), `container` (optional), `tail_lines` (optional, default 100 per pod), `grep` (optional) |
 | `get_cluster_audit` | Static config posture — best-practice findings (Security / Reliability / Efficiency) with remediation. INDEPENDENT of operational health; for "what's broken right now?" use `issues`. | `namespace` (optional), `category` (optional), `severity` (optional) |
 | `list_packages` | Installed packages (Helm releases, label-managed workloads, CRDs, Argo Applications, Flux HelmReleases + Kustomizations) with source provenance, versions, and health, in one call. Response includes `sourceLegend` for the stable source codes. | `namespace` (optional), `source` (optional: `H`/`helm`, `L`/`labels`, `C`/`crds`, `A`/`argocd`, `F`/`fluxcd`), `chart` (optional substring) |
 | `list_helm_releases` | List Helm releases with status, resource health, storage namespace, Flux ownership, current `lastOperation`, and a capped `operations` trail when Helm history indicates failed upgrades, rollback-after-failure, rollbacks, or stuck pending operations. Use this first for Helm deployment debugging. | `namespace` (optional) |

internal/k8s/workload.go

@@ -1,6 +1,7 @@
 package k8s
 
 import (
+	"context"
 	"fmt"
 
 	corev1 "k8s.io/api/core/v1"
@@ -45,6 +46,28 @@ func GetWorkloadSelector(cache *ResourceCache, kind, namespace, name string) (*m
 		}
 		return ds.Spec.Selector, nil
 
+	case "job", "jobs":
+		lister := cache.Jobs()
+		if lister == nil {
+			return nil, fmt.Errorf("insufficient permissions to list jobs")
+		}
+		job, err := lister.Jobs(namespace).Get(name)
+		if err != nil {
+			return nil, fmt.Errorf("job %s/%s not found: %w", namespace, name, err)
+		}
+		if job.Spec.Selector == nil {
+			return nil, fmt.Errorf("job %s/%s has no pod selector", namespace, name)
+		}
+		return job.Spec.Selector, nil
+
+	case "workflow", "workflows":
+		if _, err := cache.GetDynamicWithGroup(context.Background(), "Workflow", namespace, name, "argoproj.io"); err != nil {
+			return nil, fmt.Errorf("workflow %s/%s not found: %w", namespace, name, err)
+		}
+		return &metav1.LabelSelector{
+			MatchLabels: map[string]string{"workflows.argoproj.io/workflow": name},
+		}, nil
+
 	default:
 		return nil, fmt.Errorf("unsupported workload kind: %s", kind)
 	}

internal/mcp/tools.go

@@ -450,7 +450,7 @@ func registerTools(server *mcp.Server) {
 	mcp.AddTool(server, &mcp.Tool{
 		Name: "get_workload_logs",
 		Description: "Get aggregated logs from all pods of a workload (Deployment, StatefulSet, " +
-			"or DaemonSet). Logs are collected from all matching pods concurrently, then " +
+			"DaemonSet, Job, or Argo Workflow). Logs are collected from all matching pods concurrently, then " +
 			"server-side filtered to errors, warnings, panics, and stack traces using " +
 			"deterministic regex patterns and deduplicated. Set grep for additional " +
 			"server-side filtering before that summary stage, like `kubectl logs | grep PATTERN`. " +

internal/mcp/tools_filter_test.go

@@ -699,6 +699,12 @@ func TestNormalizeWorkloadLogsKind_DefaultsToDeployment(t *testing.T) {
 	if got := normalizeWorkloadLogsKind("statefulset"); got != "statefulsets" {
 		t.Fatalf("statefulset workload-log kind = %q, want statefulsets", got)
 	}
+	if got := normalizeWorkloadLogsKind("job"); got != "jobs" {
+		t.Fatalf("job workload-log kind = %q, want jobs", got)
+	}
+	if got := normalizeWorkloadLogsKind("Workflow"); got != "workflows" {
+		t.Fatalf("Workflow workload-log kind = %q, want workflows", got)
+	}
 }
 
 func TestParseLogsSince(t *testing.T) {

internal/mcp/tools_workloads.go

@@ -36,7 +36,7 @@ type manageCronJobInput struct {
 }
 
 type getWorkloadLogsInput struct {
-	Kind      string `json:"kind,omitempty" jsonschema:"workload kind: deployment, statefulset, or daemonset. Defaults to deployment when omitted."`
+	Kind      string `json:"kind,omitempty" jsonschema:"workload kind: deployment, statefulset, daemonset, job, or workflow. Defaults to deployment when omitted."`
 	Namespace string `json:"namespace" jsonschema:"workload namespace"`
 	Name      string `json:"name" jsonschema:"workload name"`
 	Container string `json:"container,omitempty" jsonschema:"specific container name, defaults to all containers"`
@@ -175,7 +175,7 @@ func handleManageCronJob(ctx context.Context, req *mcp.CallToolRequest, input ma
 func handleGetWorkloadLogs(ctx context.Context, req *mcp.CallToolRequest, input getWorkloadLogsInput) (*mcp.CallToolResult, any, error) {
 	kind := normalizeWorkloadLogsKind(input.Kind)
 	if kind == "" {
-		return nil, nil, fmt.Errorf("invalid kind %q: must be deployment, statefulset, or daemonset", input.Kind)
+		return nil, nil, fmt.Errorf("invalid kind %q: must be deployment, statefulset, daemonset, job, or workflow", input.Kind)
 	}
 
 	if !checkNamespaceAccess(ctx, input.Namespace) {
@@ -568,5 +568,12 @@ func normalizeWorkloadLogsKind(kind string) string {
 	if strings.TrimSpace(kind) == "" {
 		return "deployments"
 	}
-	return normalizeWorkloadKind(kind)
+	switch strings.ToLower(kind) {
+	case "job", "jobs":
+		return "jobs"
+	case "workflow", "workflows":
+		return "workflows"
+	default:
+		return normalizeWorkloadKind(kind)
+	}
 }

internal/server/server.go

@@ -406,6 +406,7 @@ func (s *Server) setupRoutes() {
 
 			// Workload logs (non-streaming)
 			r.Get("/workloads/{kind}/{namespace}/{name}/logs", s.handleWorkloadLogs)
+			r.Get("/workloads/{kind}/{namespace}/{name}/runs", s.handleWorkloadRuns)
 			r.Get("/workloads/{kind}/{namespace}/{name}/pods", s.handleWorkloadPods)
 
 			// Helm routes