Managing Kubernetes & Helm Administration Directly from Your AI Host

Managing modern cloud infrastructure typically requires typing endless kubectl commands, switching contexts, and digging through verbose YAML manifests. By connecting an agent to Kubernetes via MCP, you can troubleshoot production outages, examine cluster deployments, and rollback Helm charts using natural language conversation.

Prerequisites

1. ▸kubectl and helm CLIs installed on the machine running the MCP server.
2. ▸A configured ~/.kube/config file with access to your cluster.
3. ▸Proper Role-Based Access Control (RBAC) permissions set up for the user authenticated in your kubeconfig.

Safe Kubectl Access Schema

We define strict read-only parameters for logs and status, while requiring multi-factor auth or confirmations for write actions. Here is an example tool definition for safely fetching logs:

{
  "name": "get_pod_logs",
  "description": "Fetch stderr/stdout logs from a specific pod inside a namespace.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "podName": { "type": "string" },
      "namespace": { "type": "string", "default": "default" },
      "lines": { "type": "number", "default": 100 }
    },
    "required": ["podName"]
  }
}

Local Configuration Setup

Add the following configuration into your Claude Desktop or MCP client config:

{
  "mcpServers": {
    "kubernetes": {
      "command": "npx",
      "args": ["-y", "mcp-server-kubernetes"],
      "env": {
        "KUBECONFIG": "C:/Users/yourusername/.kube/config"
      }
    }
  }
}

Sample Workflows

• ▸Triage Incident: "Look at the pods in the 'billing' namespace. If any pod is failing or crash-looping, fetch its logs and describe the deployment errors."
• ▸Helm Status Check: "List all installed Helm charts in the 'production' namespace. Is there any mismatch between release versions?"
• ▸YAML Validation: "Read the deployment.yaml file on my local disk and compare its spec against the live deployment currently running in the cluster."

Best Practices

• ▸Namespace Isolation: Do not give the AI agent cluster-admin privileges. Create a ServiceAccount bounded to a specific namespace (e.g., staging) so it cannot accidentally alter core system components like kube-system.
• ▸Read-Only Contexts: Create a separate kubeconfig context that maps to a ClusterRole with strictly get, list, and watch verbs. Block create, update, and delete.

Troubleshooting

• ▸Timeout on Large Logs: Fetching logs from a heavily trafficked pod might return MBs of text and timeout the JSON-RPC connection. Always enforce the lines or --tail=100 parameter in your tool implementation.
• ▸Unauthorized Errors: Check your active kube context using kubectl config current-context. The MCP server runs under the identity of that active context unless explicitly overridden.