Use dedicated kubeconfigs or service accounts for agent workflows.
MCP SERVER SECURITY GUIDE
Kubernetes MCP Server Security Guide
Treat cluster-connected MCP servers as privileged operational access, not a generic chatbot integration.
A Kubernetes MCP server may inherit kubeconfig context, service-account permissions, namespace visibility, Helm access, and cluster mutation capabilities. The impact can reach workloads, secrets, deployments, network policy, and production availability.
SEARCH INTENT / BUYER CONTEXT
What enterprise teams are trying to evaluate
Searchers are evaluating whether AI assistants can inspect or operate Kubernetes clusters without risking production mutations.
GOVERNANCE PATTERN
Recommended control model
Use dedicated service accounts, namespace-scoped RBAC, non-destructive mode, command allowlists, and full tool-call audit. Keep model calls routed through Agent Access Manager so provider credentials and LLM usage remain separate from cluster credentials.
CONTROL CHECKLIST
Controls to validate before production use
Bind read-only roles by namespace and deny secret read by default.
Enable non-destructive mode where available for diagnostic assistants.
Block exec, delete, patch, apply, and Helm mutation unless a human approval path exists.
Record cluster, namespace, resource kind, resource name, tool arguments, actor, model route, and outcome.
IMPLEMENTATION NOTES
Operational review points
Never run cluster MCP servers with a human administrator kubeconfig.
Separate production, staging, and development clusters into different MCP server registrations.
Export Kubernetes audit logs and MCP tool logs into the same investigation workflow.
FAQ
Kubernetes MCP server questions
Can an MCP server modify Kubernetes resources?
That depends on the server implementation and kubeconfig or service-account permissions. Enterprises should assume mutation is possible unless RBAC and server-level tool configuration prove otherwise.
What is the safest starting pattern?
Start with namespace-scoped read-only access, disable destructive tools, and require approval for any workflow that can patch, delete, exec, or deploy.
ENTERPRISE MCP REVIEW
Map Kubernetes MCP access to your gateway, provider keys, and audit requirements.
Review source-system credentials, MCP tool scope, LLM provider routing, virtual keys, guardrails, and investigation evidence with your security and platform teams.
Request enterprise review →Security, platform, AppSec, and architecture teams