kubectl config use-context runs as an init_cmd before you’re handed the prompt, so you’re never one kubectl apply away from hitting the wrong cluster because you forgot to switch. The dev shell is unannotated and opens freely; the prod shell requires explicit approval and prints a banner — the same pattern as the AWS account-switching example, applied to cluster access instead of cloud credentials.
version: v1
shells:
k8s-dev:
description: "Kubernetes shell for the development cluster"
agent:
risk_level: low
env:
K8S_CONTEXT:
type: string
default: "dev-cluster"
K8S_NAMESPACE:
type: string
default: "default"
init_cmds:
- kubectl config use-context $K8S_CONTEXT
- kubectl config set-context --current --namespace=$K8S_NAMESPACE
- kubectl cluster-info
k8s-prod:
description: "Kubernetes shell for the production cluster"
agent:
risk_level: high
requires_approval: true
confirmation: "You are about to access the PRODUCTION Kubernetes cluster. Continue?"
env:
K8S_CONTEXT:
type: string
default: "prod-cluster"
K8S_NAMESPACE:
type: string
default: "production"
init_cmds:
- kubectl config use-context $K8S_CONTEXT
- kubectl config set-context --current --namespace=$K8S_NAMESPACE
- echo "PRODUCTION KUBERNETES CLUSTER — use with caution"
- kubectl cluster-info
Run it:
meriadoc shell k8s-dev