discovery-controller

A guide for fold-discovery, a controller that finds labeled Kubernetes Services and turns them into a list of upstream services for the gateway. Kubernetes is a system for running and managing containerized applications.

In plain words
What is it for?
Use it when changing the discovery controller, Kubernetes service mapping, gateway discovery, or related documentation and allowlists.
Why use it?
It helps preserve the security boundary around service-discovery data and avoids adding unnecessary Kubernetes dependencies.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/fold-run/fold/discovery-controller
Any agent
npx skills add fold-run/fold --skill discovery-controller
Clone the repo
git clone --depth 1 https://github.com/fold-run/fold

Made for: Claude Code, Codex.

Per session 66 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,286 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00066 $0.01286
Opus 5 $0.00033 $0.00643
Sonnet 5 $0.00013 $0.00257
Haiku 4.5 $0.00007 $0.00129

Measured 2d ago against content hash 3daec6be2b31, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

discovery-controller scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/discovery-controller/SKILL.md · 107 lines

How it starts

The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.

The Kubernetes discovery controller

fold-discovery lists Services matching a label selector on an interval, maps them to upstream entries via annotations, validates them with fold's own config package, and serves {"upstreams": [...]} for the gateway's discovery.url to poll.

Linux-only (goreleaser builds it for linux alone) — it runs in a cluster, listing Services with the pod's service account.

The constraint that shapes the whole package

Poll-to-poll, no client-go, no informers. fold polls the producer; the producer polls the Kubernetes list API with the pod's service-account token and plain HTTP. That is the entire Kubernetes client.

This keeps fold's module free of the Kubernetes dependency tree, and it is load-bearing rather than incidental: go.mod has 14 direct dependencies and pulling in client-go would multiply that, in a binary operators run at the edge of their network. Do not add client-go, informers, or a controller-runtime dependency to make something more elegant. If a change seems to need watch semantics, it needs a shorter interval.

The trust boundary is the reason for every allowlist flag

A Service annotation is a lower-trust input than the config document. Anyone who can create a Service in a watched namespace can propose an upstream. Every flag below exists to bound what that person can propose, and each defaults to the safe end:

Flag Default What it stops
--allow-auth-strategies none A Service choosing how the gateway authenticates to it
--allow-secret-refs none A Service naming an env var whose value it wants sent
--allow-credential-hosts unrestricted A credentialed Service pointing at an attacker's host
--reserved-ids empty A Service claiming the id or namespace of a static upstream
--allow-unprefixed-ids off (prefixing on) Cross-namespace id collisions; single-tenant clusters only
--min-health-interval-ms 1000 A Service asking for a probe loop that hammers itself
--bearer-env none An unauthenticated reader of the discovery document

Read the full file on GitHub · 107 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 107 lines · 66 tokens per session scan A 3daec6be2b31

Subscribe to this mod's changes

discovery-controller is a skill published in the GitHub repository fold-run/fold (1 stars, last pushed 2d ago), licensed Apache-2.0. It adds 66 tokens to every session and 1,286 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

nginx-to-higress-migration

Migrate from ingress-nginx to Higress in Kubernetes environments. Use when (1) analyzing existing ingress-nginx setup (2) reading nginx Ingress resources and ConfigMaps (3) installing Higress via helm with proper ingressClass (4) identifying unsupported nginx annotations (5) generating WASM plugins for nginx…

higress-group/higress · 99 tokens

helm-update

Apply helm chart updates for Bifrost. Detects config.schema.json changes since the last helm release, applies user-requested changes, updates values.yaml / values.schema.json / helpers.tpl, bumps Chart.yaml version, updates helm README (Latest Version + Upcoming section), creates a docs MDX changelog, and updates…

maximhq/bifrost · 97 tokens

plano-deployment-security

Apply Plano deployment and production security practices. Use for Docker networking, state storage choices, readiness checks, and environment-based secret handling.

katanemo/plano · 32 tokens

ecspresso

ECS deployment tool - deploy, manage, and troubleshoot ECS services.

kayac/ecspresso · 17 tokens

pvetui-cli

Use when querying or managing a Proxmox VE cluster via the pvetui CLI — listing nodes, guests, and tasks; creating and migrating VMs and LXC containers; managing storage content, downloading templates and OCI images, restoring backups, and installing Proxmox Community Scripts when the plugin is enabled. Requires…

devnullvoid/pvetui · 77 tokens

osx-tuning

Tune macOS resource limits and sysctls for best performance with Go development, Docker/OrbStack, and Linux VMs. Use this skill whenever the user asks to "tune macOS", "raise file descriptor limits", "fix ulimit", "optimize for Docker/Go/VM performance", "increase maxfiles/maxproc/somaxconn", or reports…

dimetron/pi-go · 132 tokens