ocm-mcp-server - end-to-end test report

Verdict: 🟢 ALL GREEN · generated 2026-07-29 01:34:45 · local kind fleet via podman, Open Cluster Management hub

Passed	Expected-unavailable	Failed	Total steps
81	0	0	84

Reproduce locally with ./hack/e2e-local.sh - one command stands up a real multi-cluster fleet on kind, drives every tool and prompt, breaks a workload and fixes it through the approval gate, then tears the fleet down.

What this end-to-end test does #

One command stands up a real multi-cluster Open Cluster Management fleet on kind, then drives the MCP server through every tool and prompt: it reads the fleet freely, but forces every change through policy checks and a human-approved token. It then deliberately breaks a workload and shows the agent diagnose and fix it, before tearing the fleet down. Green means the whole loop worked.

🧰 Install & verify tools - podman, kind, kubectl, clusteradm, helm
☸️ Bootstrap a real fleet - 1 hub + N spoke clusters, OCM, Kyverno, policies
✨ Enrich & seed fixtures - add-ons, policies, ManifestWorks - so every tool has real data
🔍 Investigate (read tools) - inventory, health, placement, work, add-ons - free, no gate
🛡️ Make a change, gated - propose → Kyverno + guardrails → human token → apply (a bad token is refused)
💬 Prompts & audit - reusable runbooks and an append-only audit trail
💥 Break something - inject a failing rollout (ImagePullBackOff)
🩺 Diagnose - health + events pinpoint the bad image
🔧 Fix, through the gate - propose the pinned image, approve, apply
✅ Verify recovery - re-read health until the workload is healthy again
🧹 Clean up - delete only the clusters this run created

1. Dependencies #

✅ `OK` podman #

Required tool for the local fleet.

$ podman --version

already installed: podman version 6.0.2

✅ `OK` kind #

Required tool for the local fleet.

$ kind version

already installed: kind v0.32.0 go1.26.3 darwin/arm64

✅ `OK` kubectl #

Required tool for the local fleet.

$ kubectl version --client=true -o yaml 2>/dev/null | grep gitVersion | head -1

already installed:   gitVersion: v1.34.1

✅ `OK` helm #

Required tool for the local fleet.

$ helm version --short

already installed: v4.1.1+g5caf004

✅ `OK` clusteradm #

Required tool for the local fleet.

$ clusteradm version | head -1

already installed: clusteradm	version	:v1.3.1-0-g90bdc31

✅ `OK` oc #

Required tool for the local fleet.

$ oc version --client 2>/dev/null | head -1

already installed: Client Version: 4.18.0-202504282205.p0.geb9bc9b.assembly.stream.el9-eb9bc9b

2. Python package #

✅ `OK` pip install -e . #

Install the MCP server and its ocm-mcp CLI into an isolated virtualenv.

$ pip install -e .

ocm-mcp-server 0.2.2

3. Container engine #

✅ `OK` podman running #

kind needs a container runtime; here it is Podman (Docker is not required).

$ podman info

podman version 6.0.2

4. Bootstrap fleet #

✅ `OK` bootstrap.sh #

Stand up a real OCM hub with spokes so every tool talks to genuine clusters, not mocks.

$ CONTAINER_ENGINE=podman SPOKES=2 ./hack/bootstrap.sh --no-jaeger


[1;36m==> Deploying the demo app to all spokes (namespace 'shop')[0m
namespace/shop created
deployment.apps/payments created
service/payments created
namespace/shop created
deployment.apps/payments created
service/payments created

[1;36m==> Done. Configure your MCP client environment:[0m

  export OCM_MCP_HUB_CONTEXT=kind-hub
  export OCM_MCP_SPOKE_CONTEXTS=cluster1=kind-cluster1,cluster2=kind-cluster2
  export OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318   # if Jaeger enabled

  # then register the server with your MCP client, e.g. for Claude Code:
  #   see examples/claude-code.mcp.json

Verify the fleet:
  kubectl --context kind-hub get managedclusters

✅ `OK` managed clusters #

Proof the spokes are registered and Available on the hub.

$ kubectl --context kind-hub get managedclusters

NAME       HUB ACCEPTED   MANAGED CLUSTER URLS                  JOINED   AVAILABLE   AGE
cluster1   true           https://cluster1-control-plane:6443   True     True        106s
cluster2   true           https://cluster2-control-plane:6443   True     True        77s

4b. Enrich fleet #

✅ `OK` add-on, feature gate, and API fixtures #

Install the governance policy add-on, turn on ManifestWorkReplicaSet, and add minimal CRDs plus labelled sample objects for the ACM (ManagedClusterInfo) and HyperShift (HostedCluster/NodePool) APIs - so the add-on, policy, rollout, ACM, and HyperShift tools all return real objects. On a real hub those come from ACM/MCE or HyperShift; on kind they are clearly-labelled e2e fixtures.

$ clusteradm install/enable hub-addon; kubectl patch clustermanager; kubectl apply CRDs + samples

enrichment: governance-policy-framework(enabled) ManifestWorkReplicaSet(enabled) acm+hypershift-fixtures

4c. Setup fixtures - create the objects the read tools will report on #

✅ `OK` Placement + ClusterSetBinding #

Bind the 'global' cluster set into a namespace and add a Placement that selects every cluster - so the placement tools have a real decision to show.

$ kubectl apply Placement + ManagedClusterSetBinding

binding=created, placement=created

✅ `OK` seed ManifestWork (gated) #

Deploy a marker ManifestWork via propose+approve+apply so the work tools report on something real.

$ propose_manifestwork -> apply_manifestwork

proposal_id=f167cb1929d542e9a746b3f06a90dda4
{
  "status": "applied",
  "cluster": "cluster1",
  "manifestwork": "e2e-seed",
  "note": "Verify rollout with get_cluster_health / get_manifestwork. To undo, c

✅ `OK` ManifestWorkReplicaSet #

A single template fanned across every placement-selected cluster - so list_manifestworkreplicasets shows a rollout.

$ kubectl apply ManifestWorkReplicaSet

result=created

✅ `OK` governance Policy #

A sample inform Policy so the policy tools report on a real object.

$ kubectl apply Policy

result=created

5. Read tools (safe, no gate) - how an agent investigates a fleet #

✅ `OK` list_clusters #

The fleet roster: every managed cluster, its version and health.

$ tool: list_clusters

[
  {
    "name": "cluster1",
    "labels": {
      "cluster.open-cluster-management.io/clusterset": "default",
      "feature.open-cluster-management.io/addon-governance-policy-framework": "unreachable"
    },
    "available": "True",
    "joined": "True",
    "kubernetes_version": "v1.30.4",
    "capacity": {
      "cpu": "4",
      "memory": "8099492Ki"
    }
  },
  {
    "name": "cluster2",
    "labels": {
      "cluster.open-cluster-management.io/clusterset": "default",
      "feature.open-cluster-management.io/addon-governance-policy-framework": "unreachable"
    },
    "available": "True",
    "joined": "True",
    "kubernetes_version": "v1.30.4",
    "capacity": {
      "cpu": "4",
      "memory": "8099492Ki"
    }
  }
]

✅ `OK` get_cluster(cluster1) #

Zoom into one cluster: acceptance, taints, capacity, claims.

$ tool: get_cluster

{
  "name": "cluster1",
  "labels": {
    "cluster.open-cluster-management.io/clusterset": "default",
    "feature.open-cluster-management.io/addon-governance-policy-framework": "unreachable"
  },
  "hub_accepts_client": true,
  "taints": [],
  "conditions": {
    "HubAcceptedManagedCluster": "True",
    "ManagedClusterJoined": "True",
    "ManagedClusterConditionAvailable": "True",
    "ManagedClusterConditionClockSynced": "True"
  },
  "kubernetes_version": "v1.30.4",
  "capacity": {
    "cpu": "4",
    "ephemeral-storage": "104266732Ki",
    "hugepages-1Gi": "0",
    "hugepages-2Mi": "0",
    "hugepages-32Mi": "0",
    "hugepages-64Ki": "0",
    "memory": "8099492Ki",
    "pods": "110"
  },
  "allocatable": {
    "cpu": "4",
    "ephemeral-storage": "104266732Ki",
    "hugepages-1Gi": "0",
    "hugepages-2Mi": "0",
    "hugepages-32Mi": "0",
    "hugepages-64Ki": "0",
    "memory": "8099492Ki",
    "pods": "110"
  },
  "cluster_claims": {}
}

✅ `OK` list_cluster_sets #

Groupings of clusters used for placement.

$ tool: list_cluster_sets

[
  {
    "name": "default",
    "selector_type": "ExclusiveClusterSetLabel",
    "conditions": {
      "ClusterSetEmpty": "False"
    },
    "members": [
      "cluster1",
      "cluster2"
    ]
  },
  {
    "name": "global",
    "selector_type": "LabelSelector",
    "conditions": {
      "ClusterSetEmpty": "False"
    },
    "members": []
  }
]

✅ `OK` list_cluster_set_bindings #

Which cluster sets a namespace may schedule to.

$ tool: list_cluster_set_bindings

[
  {
    "namespace": "default",
    "name": "global",
    "cluster_set": "global",
    "conditions": {
      "Bound": "True"
    }
  }
]

✅ `OK` list_cluster_claims #

Facts each cluster self-reports (id, platform, version).

$ tool: list_cluster_claims

[
  {
    "cluster": "cluster1",
    "claims": {}
  },
  {
    "cluster": "cluster2",
    "claims": {}
  }
]

✅ `OK` get_cluster_health(cluster1) #

The on-call view: unhealthy pods and degraded deployments.

$ tool: get_cluster_health

{
  "cluster": "cluster1",
  "hub_conditions": {
    "HubAcceptedManagedCluster": "True",
    "ManagedClusterJoined": "True",
    "ManagedClusterConditionAvailable": "True",
    "ManagedClusterConditionClockSynced": "True"
  },
  "unhealthy_pods": [],
  "degraded_deployments": [
    {
      "namespace": "shop",
      "name": "payments",
      "ready": "0/2"
    }
  ],
  "spoke_view": "ok"
}

✅ `OK` get_fleet_health() #

The whole-fleet sweep in one call: hub conditions for every cluster plus a fanned-out spoke pod/deployment scan - no per-cluster looping needed.

$ tool: get_fleet_health

{
  "fleet": {
    "total": 2,
    "available": 2,
    "unavailable": 0,
    "spoke_checked": 2,
    "with_issues": 2
  },
  "clusters": [
    {
      "cluster": "cluster1",
      "available": "True",
      "hub_conditions": {
        "HubAcceptedManagedCluster": "True",
        "ManagedClusterJoined": "True",
        "ManagedClusterConditionAvailable": "True",
        "ManagedClusterConditionClockSynced": "True"
      },
      "unhealthy_pods": [],
      "degraded_deployments": [
        {
          "namespace": "shop",
          "name": "payments",
          "ready": "0/2"
        }
      ],
      "spoke_view": "ok"
    },
    {
      "cluster": "cluster2",
      "available": "True",
      "hub_conditions": {
        "HubAcceptedManagedCluster": "True",
        "ManagedClusterJoined": "True",
        "ManagedClusterConditionAvailable": "True",
        "ManagedClusterConditionClockSynced": "True"
      },
      "unhealthy_pods": [
        {
          "namespace": "shop",
... (19 more lines)

✅ `OK` query_events(cluster1) #

Recent Kubernetes events - the 'why' behind failures.

$ tool: query_events

[
  {
    "namespace": "shop",
    "type": "Normal",
    "reason": "Pulled",
    "object": "Pod/payments-5555cb47bc-kswhv",
    "count": 1,
    "message": "Successfully pulled image \"registry.k8s.io/e2e-test-images/agnhost:2.47\" in 251ms (17.193s including waiting). Image size: 50637101 bytes."
  },
  {
    "namespace": "shop",
    "type": "Normal",
    "reason": "Created",
    "object": "Pod/payments-5555cb47bc-kswhv",
    "count": 1,
    "message": "Created container payments"
  },
  {
    "namespace": "shop",
    "type": "Normal",
    "reason": "Started",
    "object": "Pod/payments-5555cb47bc-kswhv",
    "count": 1,
    "message": "Started container payments"
  },
  {
    "namespace": "shop",
    "type": "Normal",
    "reason": "Pulled",
    "object": "Pod/payments-5555cb47bc-zkb8b",
    "count": 1,
    "message": "Successfully pulled image \"registry.k8s.io/e2e-test-images/agnhost:2.47\" in 16.953s (16.953s including waiting). Image size: 50637101 bytes."
  },
  {
    "namespace": "shop",
    "type": "Normal",
    "reason": "Created",
    "object": "Pod/payments-5555cb47bc-zkb8b",
    "count": 1,
    "message": "Created container payments"
... (13 more lines)

✅ `OK` list_manifestworks(cluster1) #

What the hub is currently delivering to this cluster.

$ tool: list_manifestworks

[
  {
    "name": "demo-mwrshhx5b",
    "applied": "True",
    "available": "True",
    "resources": [
      "ConfigMap/e2e-seed (shop)"
    ]
  },
  {
    "name": "e2e-seed",
    "applied": "True",
    "available": "True",
    "resources": [
      "ConfigMap/e2e-seed (shop)"
    ]
  }
]

✅ `OK` list_manifestworkreplicasets #

Fleet-wide rollouts (a template fanned across clusters).

$ tool: list_manifestworkreplicasets

[
  {
    "namespace": "default",
    "name": "demo-mwrs",
    "summary": {
      "applied": 2,
      "available": 2,
      "total": 2
    },
    "conditions": {
      "PlacementVerified": "True",
      "PlacementRolledOut": "False",
      "ManifestworkApplied": "True"
    }
  }
]

✅ `OK` list_cluster_management_addons #

Fleet-level add-on definitions.

$ tool: list_cluster_management_addons

[
  {
    "name": "config-policy-controller",
    "install_strategy": "Manual",
    "conditions": {}
  },
  {
    "name": "governance-policy-framework",
    "install_strategy": "Manual",
    "conditions": {}
  }
]

✅ `OK` get_addon_health #

Per-cluster add-on health across the fleet.

$ tool: get_addon_health

[
  {
    "cluster": "cluster1",
    "addon": "governance-policy-framework",
    "available": "Unknown",
    "degraded": "False",
    "progressing": "False"
  },
  {
    "cluster": "cluster2",
    "addon": "governance-policy-framework",
    "available": "Unknown",
    "degraded": "False",
    "progressing": "False"
  }
]

✅ `OK` list_addons_for_cluster(cluster1) #

Every add-on installed on one cluster, with health.

$ tool: list_addons_for_cluster

[
  {
    "addon": "governance-policy-framework",
    "install_namespace": "open-cluster-management-agent-addon",
    "available": "Unknown",
    "degraded": "False"
  }
]

✅ `OK` list_pending_csrs #

Clusters waiting to be admitted to the hub.

$ tool: list_pending_csrs

No pending CSRs - every cluster is already admitted (a healthy fleet).

✅ `OK` list_placements #

Placements and how many clusters each selects.

$ tool: list_placements

[
  {
    "namespace": "default",
    "name": "demo-all",
    "cluster_sets": [
      "global"
    ],
    "number_of_clusters": null,
    "selected": 2,
    "conditions": {
      "PlacementMisconfigured": "False",
      "PlacementSatisfied": "True"
    }
  }
]

✅ `OK` get_placement_decision(demo-all) #

Exactly which clusters a Placement chose.

$ tool: get_placement_decision

{
  "placement": "demo-all",
  "namespace": "default",
  "selected_clusters": [
    "cluster1",
    "cluster2"
  ],
  "count": 2
}

✅ `OK` list_policies #

Governance Policies and per-cluster compliance.

$ tool: list_policies

[
  {
    "namespace": "default",
    "name": "require-cm",
    "remediation": "inform",
    "compliant": null,
    "per_cluster": {}
  }
]

✅ `OK` list_policy_violations #

Only the NonCompliant / Pending policy-cluster pairs.

$ tool: list_policy_violations

No violations - evaluated policies are compliant (or evaluation is in progress).

✅ `OK` get_cluster_info(cluster1) #

Extended inventory (OpenShift version, nodes) - ACM only.

$ tool: get_cluster_info

{
  "cluster": "cluster1",
  "console_url": "https://console-openshift-console.apps.cluster1.example.com",
  "kube_vendor": "OpenShift",
  "cloud_vendor": "BareMetal",
  "openshift_version": "4.16.7",
  "node_count": 1,
  "nodes": [
    {
      "name": "cluster1-control-plane",
      "capacity": {
        "cpu": "8",
        "memory": "16Gi"
      },
      "labels": {
        "node-role.kubernetes.io/control-plane": ""
      }
    }
  ],
  "conditions": {
    "ManagedClusterInfoSynced": "True"
  }
}

✅ `OK` list_hosted_clusters #

HyperShift hosted control planes - when the hub hosts them.

$ tool: list_hosted_clusters

[
  {
    "name": "demo-hcp",
    "namespace": "clusters",
    "version": "4.16.7",
    "version_state": "Completed",
    "conditions": {
      "Available": "True"
    }
  }
]

✅ `OK` list_node_pools #

HyperShift worker node pools - when the hub hosts HCPs.

$ tool: list_node_pools

[
  {
    "name": "demo-hcp-workers",
    "namespace": "clusters",
    "cluster": "demo-hcp",
    "desired_replicas": 2,
    "current_replicas": 2,
    "conditions": {
      "Ready": "True"
    }
  }
]

✅ `OK` list_resources(managedclusters) #

Generic allow-listed reader over any OCM type.

$ tool: list_resources

[
  {
    "name": "cluster1",
    "labels": {
      "cluster.open-cluster-management.io/clusterset": "default",
      "feature.open-cluster-management.io/addon-governance-policy-framework": "unreachable"
    },
    "conditions": {
      "HubAcceptedManagedCluster": "True",
      "ManagedClusterJoined": "True",
      "ManagedClusterConditionAvailable": "True",
      "ManagedClusterConditionClockSynced": "True"
    }
  },
  {
    "name": "cluster2",
    "labels": {
      "cluster.open-cluster-management.io/clusterset": "default",
      "feature.open-cluster-management.io/addon-governance-policy-framework": "unreachable"
    },
    "conditions": {
      "HubAcceptedManagedCluster": "True",
      "ManagedClusterJoined": "True",
      "ManagedClusterConditionAvailable": "True",
      "ManagedClusterConditionClockSynced": "True"
    }
  }
]

✅ `OK` get_resource(managedclusters/cluster1) #

Generic get of one allow-listed OCM object.

$ tool: get_resource

{
  "apiVersion": "cluster.open-cluster-management.io/v1",
  "kind": "ManagedCluster",
  "metadata": {
    "creationTimestamp": "2026-07-28T20:01:37Z",
    "finalizers": [
      "cluster.open-cluster-management.io/resource-cleanup",
      "cluster.open-cluster-management.io/api-resource-cleanup"
    ],
    "generation": 4,
    "labels": {
      "cluster.open-cluster-management.io/clusterset": "default",
      "feature.open-cluster-management.io/addon-governance-policy-framework": "unreachable"
    },
    "managedFields": [
      {
        "apiVersion": "cluster.open-cluster-management.io/v1",
        "fieldsType": "FieldsV1",
        "fieldsV1": {
          "f:spec": {
            "f:hubAcceptsClient": {}
          }
        },
        "manager": "clusteradm",
        "operation": "Update",
        "time": "2026-07-28T20:02:14Z"
      },
      {
        "apiVersion": "cluster.open-cluster-management.io/v1",
        "fieldsType": "FieldsV1",
        "fieldsV1": {
          "f:status": {
            ".": {},
            "f:allocatable": {
              ".": {},
              "f:cpu": {},
              "f:ephemeral-storage": {},
              "f:hugepages-1Gi": {},
              "f:hugepages-2Mi": {},
              "f:hugepages-32Mi": {},
... (7 more lines)

✅ `OK` list_addon_placement_scores(cluster1) #

Per-cluster placement scores add-ons publish.

$ tool: list_addon_placement_scores

No AddOnPlacementScores - no score-publishing add-on runs on this fleet.

✅ `OK` get_pod_logs(cluster1) #

Container logs from a spoke pod, via the hub-known read context.

$ tool: get_pod_logs

{
  "namespace": "shop",
  "pod": "payments-5555cb47bc-kswhv",
  "log_tail": "b'I0728 20:03:40.596840       1 log.go:245] Started HTTP server on port 8080\\nI0728 20:03:40.597016       1 log.go:245] Started UDP server on port  8081\\n'"
}

✅ `OK` get_hosted_cluster(demo-hcp) #

One HyperShift hosted control plane in detail.

$ tool: get_hosted_cluster

{
  "name": "demo-hcp",
  "namespace": "clusters",
  "version": "4.16.7",
  "version_state": "Completed",
  "conditions": {
    "Available": "True"
  },
  "node_pools": [
    {
      "name": "demo-hcp-workers",
      "namespace": "clusters",
      "cluster": "demo-hcp",
      "desired_replicas": 2,
      "current_replicas": 2,
      "conditions": {
        "Ready": "True"
      }
    }
  ]
}

7. Gated write flow - propose, prove the gate rejects a bad token, then apply #

✅ `OK` propose_manifestwork #

The agent PROPOSES a change. It must pass static guardrails and a Kyverno dry-run first; nothing is applied yet.

$ tool: propose_manifestwork

proposal_id=833e5c116f2649548b188ad3a41b7808
status=pending_approval

✅ `PASS` apply with a BAD token #

Prove the gate holds: apply with an invalid token must be refused by the server, not applied.

$ tool: apply_manifestwork(bad token)

REJECTED: Malformed approval token.

✅ `OK` ocm-mcp approve (human) #

A human on a trusted terminal mints an approval token: an Ed25519 signature binding the exact content and operation. The server holds only the public key, so it can verify a token but can never mint one - and neither can the agent.

$ ocm-mcp approve 833e5c116f2649548b188ad3a41b7808

token minted (...baEUVSYYnqDw)

✅ `OK` apply_manifestwork(token) #

With a valid token, the server verifies it and delivers the change as an OCM ManifestWork.

$ tool: apply_manifestwork

{
  "status": "applied",
  "cluster": "cluster1",
  "manifestwork": "e2e-demo",
  "note": "Verify rollout with get_cluster_health / get_manifestwork. To undo, call propose_rollback then apply the rollback with a fresh approval."
}

✅ `PASS` get_manifestwork (verify) #

Confirm the hub actually applied it on the spoke.

$ tool: get_manifestwork

{
  "cluster": "cluster1",
  "name": "e2e-demo",
  "conditions": {
    "Applied": "True",
    "Available": "True"
  },
  "resources": [
    {
      "resource": "ConfigMap/ocm-mcp-e2e",
      "namespace": "shop",
      "conditions": {
        "Applied": "True",
        "Available": "True",
        "StatusFeedbackSynced": "True"
      },
      "status_feedback": {}
    }
  ]
}

7b. Gated rollback - undoing an applied change needs its own approval #

✅ `OK` propose_rollback #

The agent proposes UNDOING the applied change. This creates a distinct proposal bound to the exact ManifestWork name and UID - an old apply token can never delete a workload.

$ tool: propose_rollback

{
  "rollback_proposal_id": "cd14dac0c4af4a708591c37410772285",
  "status": "pending_approval",
  "next_step": "Ask the human operator to run: ocm-mcp approve cd14dac0c4af4a708591c37410772285 and give you the token, then call rollback_manifestwork(cd14dac0c4af4a708591c37410772285, <token>)."
}

✅ `PASS` rollback with an APPLY token #

Prove operation binding: a token minted for 'apply' must be refused for a rollback.

$ tool: rollback_manifestwork(apply-scoped token)

REJECTED: This token authorizes 'apply', not 'rollback'.

✅ `OK` rollback_manifestwork(token) #

With a rollback-scoped token, the server removes the ManifestWork it created.

$ tool: rollback_manifestwork

{
  "status": "rolled_back",
  "cluster": "cluster1",
  "manifestwork": "e2e-demo"
}

✅ `PASS` verify rollback #

The e2e-demo ManifestWork no longer exists on the hub.

$ tool: get_manifestwork(cluster1, e2e-demo)

ManifestWork removed - rollback confirmed.

8. Gated lifecycle action - cordon a cluster out of scheduling, then undo #

✅ `OK` propose_cluster_action(cordon) #

Propose adding a NoSelect taint so Placements stop scheduling here - still gated by approval.

$ tool: propose_cluster_action

{
  "proposal_id": "86920d0f61874d6dba0942573185e477",
  "status": "pending_approval",
  "action": "cordon",
  "next_step": "Ask the human operator to run: ocm-mcp approve 86920d0f61874d6dba0942573185e477 and provide you the approval token, then call apply_cluster_action."
}

✅ `OK` apply_cluster_action(cordon) #

Applied after approval; the taint now keeps new work off this cluster.

$ tool: apply_cluster_action

taints=[{"effect": "NoSelect", "key": "ocm-mcp-server.io/cordoned", "timeAdded": "2026-07-28T20:03:50Z", "value": "true"}]

✅ `OK` uncordon (restore) #

Remove the taint so the cluster is schedulable again.

$ tool: apply_cluster_action(uncordon)

taints_after=[]

✅ `OK` set_label (gated) #

Stamp a fleet label through the same propose/approve gate - labels drive Placements, so they are write-gated too.

$ tool: apply_cluster_action(set_label)

{
  "cluster": "cluster1",
  "action": "set_label",
  "status": "applied"
}

✅ `OK` accept (gated, idempotent) #

Re-assert hubAcceptsClient on an already-accepted cluster - exercises the accept path without changing fleet state.

$ tool: apply_cluster_action(accept)

{
  "cluster": "cluster1",
  "action": "accept",
  "status": "applied",
  "approved_csrs": []
}

✅ `OK` enable_addon (gated) #

Create a ManagedClusterAddOn through the gate.

$ tool: apply_cluster_action(enable_addon)

{
  "cluster": "cluster1",
  "action": "enable_addon",
  "status": "applied",
  "addon": "e2e-demo-addon"
}

✅ `OK` disable_addon (gated, cleanup) #

Delete the same ManagedClusterAddOn through the gate - leaving the fleet exactly as we found it.

$ tool: apply_cluster_action(disable_addon)

{
  "cluster": "cluster1",
  "action": "disable_addon",
  "status": "applied",
  "addon": "e2e-demo-addon"
}