Download skills/whizard-auditing/SKILL.md from the publisher, or copy the path and open the repository. PlugMCP lists the skill and does not host the file.
Where does whizard-auditing live?
The publisher keeps it at https://github.com/kubesphere/kubesphere.
Which agents can use whizard-auditing?
Claude, Cursor, and Codex can read a SKILL.md you add from the publisher's repository.
Use when working with WizTelemetry Auditing extension for KubeSphere, including installation, configuration, and audit query API
name: whizard-auditing
description: Use when working with WizTelemetry Auditing extension for KubeSphere, including installation, configuration, and audit query API
WizTelemetry Auditing
Overview
WizTelemetry Auditing is an extension component in the KubeSphere Observability Platform for Kubernetes and KubeSphere audit event collection, processing, and storage.
When to Use
Installing or configuring the WizTelemetry Auditing extension
Understanding audit event collection architecture
Using the audit query API to query audit events
Components
Component
Description
Default Enabled
kube-auditing
Kubernetes audit event collection and export
true
Dependencies
WizTelemetry Platform Service (whizard-telemetry): Required
WizTelemetry Data Pipeline (vector): Required
Installation
Prerequisites
REQUIRED: Complete all steps in order before generating InstallPlan.
Step 1: Get Available Clusters and Confirm Target
⚠️ CRITICAL: DO NOT proceed until target clusters are determined.
Step 1.1: Get available clusters
kubectl get clusters -o jsonpath='{.items[*].metadata.name}'
Step 1.2: Determine target clusters
If user explicitly specified target clusters in the request → Use those clusters directly, proceed to Step 2
If user did NOT specify target clusters → Ask user to confirm which clusters to deploy to, then proceed to Step 2
Ask user (if not specified):
Available clusters: host, dev
Which clusters do you want to deploy WizTelemetry Auditing to?
Step 2: Get Latest Version (if not provided by user)
Note: OpenSearch sink configuration (endpoints, auth) is provided by the vector extension. Make sure vector is installed and configured with OpenSearch before installing auditing.
curl -X GET "http://whizard-telemetry-apiserver.extension-whizard-telemetry.svc:80/kapis/logging.kubesphere.io/v1alpha2/auditing?operation=query&sort=desc&size=10&cluster=host" \
-H "X-Remote-User: admin"
Query Parameters:
Parameter
Type
Default
Description
operation
string
query
Operation type: query/statistics/histogram/export
workspace_filter
string
Comma-separated list of workspaces
workspace_search
string
Fuzzy match workspace names
objectref_namespace_filter
string
Comma-separated list of namespaces (ObjectRef.Namespace)
objectref_namespace_search
string
Fuzzy match namespace names
objectref_name_filter
string
Comma-separated list of object names
objectref_name_search
string
Fuzzy match object names
level_filter
string
Audit level: Metadata/Request/RequestResponse
verb_filter
string
Comma-separated list of verbs (create, update, delete, etc.)
user_filter
string
Comma-separated list of users
user_search
string
Fuzzy match username
group_search
string
Fuzzy match user groups
source_ip_search
string
Fuzzy match source IPs
objectref_resource_filter
string
Comma-separated list of resources
objectref_subresource_filter
string
Comma-separated list of subresources
response_code_filter
string
Comma-separated list of response codes
response_status_filter
string
Comma-separated list of response statuses
start_time
string
Start time (seconds since epoch)
end_time
string
End time (seconds since epoch)
interval
string
15m
Time interval for histogram
sort
string
desc
Sort order: asc/desc
from
int
0
Offset
size
int
10
Number of results
cluster
string
host
Cluster name
Extension Operations
Check Extension Status
kubectl get installplan whizard-auditing
kubectl get extensionversions -l kubesphere.io/extension-ref=whizard-auditing
Uninstall Extension
Uninstall from all clusters:
kubectl delete installplan whizard-auditing
Uninstall from specific cluster:
To remove WizTelemetry Auditing from a specific cluster, update the InstallPlan by removing that cluster from clusterScheduling.placement.clusters:
apiVersion: kubesphere.io/v1alpha1
kind: InstallPlan
metadata:
name: whizard-auditing
spec:
extension:
name: whizard-auditing
version: <VERSION>
enabled: true
upgradeStrategy: Manual
clusterScheduling:
placement:
clusters:
- <REMAINING_CLUSTERS> # Remove the cluster you want to uninstall from
How do I install whizard-auditing?
Download skills/whizard-auditing/SKILL.md from the publisher, or copy the path and open the repository. PlugMCP lists the skill and does not host the file.
Where does whizard-auditing live?
The publisher keeps it at https://github.com/kubesphere/kubesphere.
Which agents can use whizard-auditing?
Claude, Cursor, and Codex can read a SKILL.md you add from the publisher's repository.