k8s-mcp-server MCP — Сценарии использования, Установка & Живое демо

Зачем использовать

Ключевые функции

Bundled CLIs: kubectl, helm, istioctl, argocd
Piping with jq/grep/sed for structured output
Two safety modes: restrictive (default) and permissive
Runs as non-root in a container — mount kubeconfig read-only
Configurable command timeout via K8S_MCP_TIMEOUT

Живое демо

Как выглядит на практике

k8s.replay ▶ готово

0/0

Установка

Выберите клиент

~/Library/Application Support/Claude/claude_desktop_config.json · Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "k8s": {
      "command": "uvx",
      "args": [
        "k8s-mcp-server"
      ],
      "_inferred": true
    }
  }
}

Откройте Claude Desktop → Settings → Developer → Edit Config. Перезапустите после сохранения.

~/.cursor/mcp.json · .cursor/mcp.json

{
  "mcpServers": {
    "k8s": {
      "command": "uvx",
      "args": [
        "k8s-mcp-server"
      ],
      "_inferred": true
    }
  }
}

Cursor использует ту же схему mcpServers, что и Claude Desktop. Конфиг проекта приоритетнее глобального.

VS Code → Cline → MCP Servers → Edit

{
  "mcpServers": {
    "k8s": {
      "command": "uvx",
      "args": [
        "k8s-mcp-server"
      ],
      "_inferred": true
    }
  }
}

Щёлкните значок MCP Servers на боковой панели Cline, затем "Edit Configuration".

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "k8s": {
      "command": "uvx",
      "args": [
        "k8s-mcp-server"
      ],
      "_inferred": true
    }
  }
}

Тот же формат, что и Claude Desktop. Перезапустите Windsurf для применения.

~/.continue/config.json

{
  "mcpServers": [
    {
      "name": "k8s",
      "command": "uvx",
      "args": [
        "k8s-mcp-server"
      ]
    }
  ]
}

Continue использует массив объектов серверов, а не map.

~/.config/zed/settings.json

{
  "context_servers": {
    "k8s": {
      "command": {
        "path": "uvx",
        "args": [
          "k8s-mcp-server"
        ]
      }
    }
  }
}

Добавьте в context_servers. Zed перезагружается автоматически.

claude mcp add k8s -- uvx k8s-mcp-server

Однострочная команда. Проверить: claude mcp list. Удалить: claude mcp remove.

Сценарии использования

Реальные сценарии: k8s-mcp-server

Morning cluster health check via chat

👤 SRE, platform engineers ⏱ ~5 min intermediate

Когда использовать: Daily, before stand-up — anything red? Any pods crashlooping?

Предварительные требования

kubeconfig on host — Usually ~/.kube/config

Поток

Start the MCP container

Start k8s-mcp-server via Docker mounting ~/.kube read-only.✓ Скопировано

→ Container up
Run the checks

Across all namespaces, list pods not in Running state, nodes not Ready, and recent (last 1h) events of type Warning.✓ Скопировано

→ Three-part health report
Triage

For each crashlooping pod, get last 50 log lines and propose most likely cause.✓ Скопировано

→ Log excerpts + diagnoses

Итог: 5-minute daily cluster pulse check.

Подводные камни

Running kubectl get events cluster-wide floods context — Always filter by time and type

Debug a failed Helm release

👤 Devs shipping Helm charts ⏱ ~15 min intermediate

Когда использовать: helm upgrade failed and you want to know why without copying error messages back and forth.

Поток

Get history

helm history my-app -n production. What changed between v4 (working) and v5 (failed)?✓ Скопировано

→ Version diff
Diff templates

Render the template for v5 with current values and compare against v4. Highlight differences.✓ Скопировано

→ Diff of rendered manifests
Roll back if needed

Roll back to v4. Confirm all pods become Ready.✓ Скопировано

→ Rollback + health check

Итог: Fast recovery with understanding, not just luck.

Подводные камни

Rolling back without capturing the failure first means you can't fix forward — Always save helm get all v5 to a file before rolling back

Сочетать с: filesystem

Audit Argo CD apps for drift

👤 GitOps practitioners ⏱ ~20 min advanced

Когда использовать: You suspect someone kubectl'd something into prod that Argo CD doesn't know about.

Поток

List out-of-sync apps

argocd app list --output json. Filter to apps where sync status isn't Synced.✓ Скопировано

→ Out-of-sync list
Diff each

For each drifted app, run argocd app diff and summarize what's different from Git.✓ Скопировано

→ Per-app diff summary

Итог: Clear picture of manual drift to reconcile.

Комбинации

Сочетайте с другими MCP — эффект x10

k8s + github

When an app is broken in cluster, open GitHub issue with pod logs

If any pod in 'payments' namespace is crashlooping, fetch logs and open a GitHub issue with them attached.✓ Скопировано

Инструменты

Что предоставляет этот MCP

Инструмент	Входные данные	Когда вызывать	Стоимость
kubectl	command: str (full kubectl args)	General cluster ops	free
helm	command: str	Release management	free
istioctl	command: str	Service mesh ops	free
argocd	command: str	GitOps ops (requires argocd login in container)	free

Стоимость и лимиты

Во что обходится

Квота API: None
Токенов на вызов: kubectl get -o yaml can be huge; prefer -o json | jq to trim
Деньги: Free, MIT
Совет: Always use -o wide or -o jsonpath=... to trim. kubectl get all is a token-bomb.

Безопасность

Права, секреты, радиус поражения

Минимальные скоупы: Kubeconfig scoped to a least-privilege ServiceAccount

Хранение учётных данных: Mount ~/.kube read-only into the container

Исходящий трафик: Traffic to your cluster API server only

Никогда не давайте: cluster-admin ServiceAccount to the kubeconfig used by the MCP

Default mode is restrictive — whitelists commands. Permissive mode allows anything. Don't switch to permissive unless you trust the prompt chain.
Always review delete, scale --replicas=0, drain, and apply commands before confirming.

Устранение неполадок

Частые ошибки и исправления

The connection to the server localhost:8080 was refused

kubeconfig not mounted or KUBECONFIG env var wrong in the container.

Проверить: docker exec ... kubectl config view

Command blocked in restrictive mode

Either craft a narrower command, or explicitly opt into permissive mode for that session.

Timeout on long-running command

Raise K8S_MCP_TIMEOUT. For truly long ops, run async via a Job and poll.

Альтернативы

k8s-mcp-server в сравнении

Альтернатива	Когда использовать	Компромисс
Direct kubectl via ssh-manager	You prefer running kubectl on a jump host	Less structured; no command validation
Kagent / AIOps SaaS MCPs	You want managed service rather than self-hosted	Costs money; less control

Ещё

Ресурсы

📖 Читать официальный README на GitHub

🐙 Открытые задачи

🔍 Все 400+ MCP-серверов и Skills