feat: k8s write tools

[cavramoniu-ionos]

Summary

Adds Managed Kubernetes write tools to the MCP server, off by default behind IONOS_MCP_TOOL_SCOPE. Also moves the 8 existing k8s read tools onto the scope-gated registration path so they carry readOnlyHint annotations.

Adds

• Cluster: create_k8s_cluster, update_k8s_cluster, delete_k8s_cluster
• Node pool: create_k8s_nodepool, update_k8s_nodepool, delete_k8s_nodepool
• Node: recreate_k8s_node, delete_k8s_node
• New recreate_ action verb — a POST classified destructive, since it discards the node
• Every create/delete is two-phase confirmed; tool counts go 118 read-only / 165 with write / 195 with destructive

PUT carry-forward

Both k8s update endpoints are PUT, not PATCH, so the API replaces the resource's properties. Both update tools read the resource first and send back whatever the caller omitted — without it, an unrelated change sends nodeCount: 0 and drains the pool, or drops a cluster's api_subnet_allow_list and exposes its Kubernetes API server.

API behaviours found by live testing

• Node pool name is immutable (Attribute is immutable, therefore not allowed in update requests) — removed as a parameter and never sent
• A pool with no autoscaler reads back as autoScaling {0,0}, which the API rejects on write — no longer carried forward
• An autoscaler cannot be removed: 422 on zero bounds, silently ignored when omitted. Rejected up front rather than reported as a success that changed nothing
• delete_k8s_node is not a reliable replace: the node goes first, and an active autoscaler can hold the pool at the smaller size (observed 2 nodes → 1). Use recreate_k8s_node instead
• Deleting a node below the autoscaler minimum is refused as "last node can not be deleted" even with nodes left — the preview now checks and explains
• Node pool taints is x-internal in the spec, so it is not exposed, but existing taints are still carried forward

Validation

Enums and shapes validated against the CloudAPI spec (storage type, availability zone, weekday, RAM multiples, autoscaler bounds, public-IP spare rule). cpu_family flagged deprecated in favour of server_type; private-cluster fields flagged prerelease.

Testing

• Unit, in-memory protocol and binary e2e suites green; golangci-lint 0 issues
• Carry-forward guards mutation-tested — reverting each one makes its test fail
• Exercised end to end against a live account, which is where the six behaviours above came from

[Copilot]

Pull request overview

Adds scope-gated Managed Kubernetes write operations with confirmation flows, validation, PUT carry-forward handling, documentation, and tests.

Changes:

• Adds cluster, node-pool, and node write tools.
• Adds validation, asynchronous-operation guidance, and destructive-action classification.
• Expands integration tests and Kubernetes documentation.

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 14 comments.

Show a summary per file

File	Description
main.go	Wires scoped Kubernetes registration.
tools/scope.go	Classifies recreate_ as destructive.
tools/inputs.go	Defines Kubernetes write inputs.
tools/k8s/async.go	Adds asynchronous-operation notices.
tools/k8s/cluster.go	Annotates cluster read tools.
tools/k8s/cluster_write.go	Implements cluster writes.
tools/k8s/node.go	Annotates node read tools.
tools/k8s/node_write.go	Implements node recreation and deletion.
tools/k8s/nodepool.go	Annotates node-pool read tools.
tools/k8s/nodepool_write.go	Implements node-pool writes and PUT carry-forward.
tools/k8s/register.go	Registers read and write tools.
tools/k8s/validate.go	Adds Kubernetes input validation.
tools/k8s/versions.go	Annotates version read tools.
test/setup_test.go	Shares confirmation state in tests.
test/dynamic_test.go	Updates dynamic registration.
test/k8s_test.go	Tests read-only annotations.
test/k8s_write_test.go	Tests write behavior and safeguards.
README.md	Documents Kubernetes write support.
CHANGELOG.md	Records the new feature.
CLAUDE.md	Adds implementation guidance.
docs/k8s/cluster.md	Documents cluster writes.
docs/k8s/node.md	Documents node actions.
docs/k8s/nodepool.md	Documents node-pool writes.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.