kubectl-mcp-server MCP — Сценарии использования, Установка & Живое демо

Зачем использовать

Ключевые функции

253 tools covering pods, deployments, services, RBAC, networking
Ecosystem coverage: Helm, Flux, ArgoCD, Cert-Manager, Velero, KEDA, Istio
Cost optimization: detects over-provisioned resources, saves recommendations
OAuth 2.1 mode for secured multi-tenant SRE platforms

Живое демо

Как выглядит на практике

kubectl.replay ▶ готово

0/0

Установка

Выберите клиент

~/Library/Application Support/Claude/claude_desktop_config.json · Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "kubectl": {
      "command": "uvx",
      "args": [
        "kubectl-mcp-server"
      ],
      "_inferred": true
    }
  }
}

Откройте Claude Desktop → Settings → Developer → Edit Config. Перезапустите после сохранения.

~/.cursor/mcp.json · .cursor/mcp.json

{
  "mcpServers": {
    "kubectl": {
      "command": "uvx",
      "args": [
        "kubectl-mcp-server"
      ],
      "_inferred": true
    }
  }
}

Cursor использует ту же схему mcpServers, что и Claude Desktop. Конфиг проекта приоритетнее глобального.

VS Code → Cline → MCP Servers → Edit

{
  "mcpServers": {
    "kubectl": {
      "command": "uvx",
      "args": [
        "kubectl-mcp-server"
      ],
      "_inferred": true
    }
  }
}

Щёлкните значок MCP Servers на боковой панели Cline, затем "Edit Configuration".

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "kubectl": {
      "command": "uvx",
      "args": [
        "kubectl-mcp-server"
      ],
      "_inferred": true
    }
  }
}

Тот же формат, что и Claude Desktop. Перезапустите Windsurf для применения.

~/.continue/config.json

{
  "mcpServers": [
    {
      "name": "kubectl",
      "command": "uvx",
      "args": [
        "kubectl-mcp-server"
      ]
    }
  ]
}

Continue использует массив объектов серверов, а не map.

~/.config/zed/settings.json

{
  "context_servers": {
    "kubectl": {
      "command": {
        "path": "uvx",
        "args": [
          "kubectl-mcp-server"
        ]
      }
    }
  }
}

Добавьте в context_servers. Zed перезагружается автоматически.

claude mcp add kubectl -- uvx kubectl-mcp-server

Однострочная команда. Проверить: claude mcp list. Удалить: claude mcp remove.

Сценарии использования

Реальные сценарии: kubectl-mcp-server

Triage a CrashLoopBackOff pod in 60 seconds

👤 On-call SREs ⏱ ~10 min intermediate

Когда использовать: Alerts fire; you want to see logs, events, and resource usage before digging in kubectl manually.

Предварительные требования

kubectl configured with cluster access — kubectl config get-contexts should list your cluster

Поток

Identify crashing pods

List pods in namespace X with restart count > 5. Show pod name, container, and last exit reason.✓ Скопировано

→ Narrowed list
Pull logs + events

For pod Y, get last 100 lines of logs and the related events. Highlight any error keywords.✓ Скопировано

→ Likely root cause
Check resource pressure

Show CPU/memory limits vs actual for the pod. OOM killed?✓ Скопировано

→ Resource verdict

Итог: A focused hypothesis in a minute, not ten kubectl commands.

Подводные камни

Wrong cluster context — Always specify --context in your prompt; the default can bite you across prod/staging

Сочетать с: prometheus

Find over-provisioned workloads to trim your cluster bill

👤 FinOps, platform engineers ⏱ ~40 min advanced

Когда использовать: Quarterly cost reviews — you want data-driven scale-down candidates.

Поток

Run the cost analysis

Use the cost-optimization tools to find deployments where request/limit is 3x actual over the last 30 days.✓ Скопировано

→ Ranked list of over-provisioned workloads
Estimate savings

For the top 10, estimate $ saved per month if right-sized. Group by team.✓ Скопировано

→ Per-team savings table
File PRs with suggested manifests

Generate updated manifests for the top 5 and file PRs in the appropriate repos.✓ Скопировано

→ PRs opened with proposed diffs

Итог: Visible cost wins backed by metrics, with follow-through via PRs.

Сочетать с: github · prometheus

Upgrade a Helm release safely with Claude

👤 Platform engineers ⏱ ~20 min advanced

Когда использовать: Routine Helm upgrades shouldn't require 20 minutes of ceremony.

Поток

Diff new vs current

For release X, show diff between values.yaml and the new chart version.✓ Скопировано

→ Value/template diff
Dry-run

Run helm upgrade --dry-run with the new chart. Report any rendered template issues.✓ Скопировано

→ Clean dry-run or actionable errors
Upgrade with rollback ready

Apply the upgrade. Immediately after, verify rollout status and keep the previous revision ready for rollback.✓ Скопировано

→ Deployed successfully with rollback instructions

Итог: Lower-risk Helm ops with a rollback path explicit from the start.

Audit RBAC for overly-permissive roles

👤 Security engineers ⏱ ~30 min advanced

Когда использовать: Pre-certification or after noticing a suspicious role.

Поток

List wildcard roles

Find ClusterRoles or Roles with '*' in resources or verbs. Group by namespace.✓ Скопировано

→ Wildcard RBAC list
Map to subjects

For each, who's bound to it? List ServiceAccounts/Users/Groups.✓ Скопировано

→ Subject-role matrix
Suggest minimal replacements

For the top 5 riskiest, suggest minimum required verbs based on actual usage (audit logs).✓ Скопировано

→ Concrete tightening proposals

Итог: Tightened RBAC with defensible diffs.

Комбинации

Сочетайте с другими MCP — эффект x10

kubectl + prometheus

Cross-reference pod state with Prometheus metrics

For pod X, show kubectl describe output alongside its last 24h CPU/memory from Prometheus.✓ Скопировано

kubectl + github

RBAC audit → PRs that tighten YAML manifests

For each finding in the RBAC audit, open a PR against the infra repo with a minimized Role YAML.✓ Скопировано

Инструменты

Что предоставляет этот MCP

Инструмент	Входные данные	Когда вызывать	Стоимость
kubectl_get	resource, namespace?, label_selector?	List anything	1 API call
kubectl_describe	resource, name, namespace?	Deep detail on a single object	1 API call
pod_logs	pod, container?, tail?, namespace?	Debug	1 API call
pod_events	pod, namespace?	Why did this happen?	1 API call
helm_list	namespace?	Overview Helm releases	helm cmd
helm_upgrade	release, chart, values?, dry_run?	Deploy	helm cmd
cost_optimize	namespace?, period?	FinOps sweeps	metrics API
rbac_audit		Security review	several API calls

Стоимость и лимиты

Во что обходится

Квота API: Limited by your cluster's API server capacity
Токенов на вызов: kubectl output can be large — describe/get-wide especially
Деньги: Free MCP; cluster costs are yours
Совет: Prefer label_selector and field selectors over listing everything; avoid --output=wide in prompts

Безопасность

Права, секреты, радиус поражения

Минимальные скоупы: cluster read-only unless you need writes

Хранение учётных данных: Standard KUBECONFIG; MCP doesn't store creds separately

Исходящий трафик: Your K8s API server only

Никогда не давайте: cluster-admin to the MCP context unless absolutely necessary

Устранение неполадок

Частые ошибки и исправления

Unauthorized / forbidden

KUBECONFIG context lacks permissions. Check kubectl auth can-i for the specific verb/resource

Проверить: kubectl auth can-i get pods --namespace X

Context confusion between clusters

Always set or pass --context explicitly; a wrong context on prod is a bad day

Проверить: kubectl config current-context

Helm upgrade fails mid-way

Use helm rollback <release> <prev-rev>; always capture prev revision before upgrading

Альтернативы

kubectl-mcp-server в сравнении

Альтернатива	Когда использовать	Компромисс
k8s-mcp-server (official-ish, smaller)	You only need basic kubectl and worry about the 253-tool surface noise	Fewer ecosystem tools (no Helm/Flux)
Direct kubectl in a shell	You're deep in a terminal session already	No agent loop

Ещё

Ресурсы

📖 Читать официальный README на GitHub

🐙 Открытые задачи

🔍 Все 400+ MCP-серверов и Skills