kubectl-mcp-server

The k8s-deploy skill provides a comprehensive set of tools for managing Kubernetes workloads. It supports standard deployment workflows (manifests, Helm), scaling, rolling updates, and advanced progressive delivery strategies like Canary and Blue-Green releases using Argo Rollouts or Flagger.

When to use this skill

Use this skill when performing operations such as:

• Deployments/Releases: Creating new workloads or pushing new versions to production.
• Updates/Upgrades: Updating container images or upgrading existing deployments.
• Scaling: Increasing or decreasing replica counts.
• Traffic Management: Implementing canary releases or traffic shifting.

The k8s-policy skill allows for managing security policies, validating resources, and auditing compliance in Kubernetes using Kyverno and Gatekeeper (OPA).

When to use this skill

• When you need to enforce security policies or validate resources.
• When you mention keywords like Kyverno, Gatekeeper, OPA, policy, compliance, require labels, or block privileged.

Priority Rules for Policy Management

1. Detect policy engine first: Use kyverno_detect_tool or gatekeeper_detect_tool to identify which engine is running.
2. Use Audit mode before Enforce: When configuring validationFailureAction, prefer auditing before enforcing.
3. Check policy reports: Use kyverno_clusterpolicyreports_list_tool to find violations.
4. Review constraint templates: Use gatekeeper_constrainttemplates_list_tool to inspect Gatekeeper logic.

The k8s-core skill provides tools for managing fundamental Kubernetes objects including Pods, Namespaces, ConfigMaps, Secrets, Nodes, and Events. It is designed for listing, inspecting, creating, or deleting these resources.

Best Practices and Priority Rules

When using these tools, follow these operational rules:

• Namespace Verification: Always check if a namespace exists using get_namespaces before performing operations within it.
• Secret Security: Never expose Secrets in plain text. Handle the output of get_secret with extreme care.
• Filtering: Use the label_selector parameter to filter resources efficiently.
• Post-Change Validation: Check for recent events using get_events after making changes to resources to ensure successful application.

The k8s-kubevirt skill provides 13 tools for managing virtual machines (VMs) on Kubernetes clusters. It is designed for creating, managing, or troubleshooting VMs, handling operations like starting/stopping, live migration, and managing the VM lifecycle.

Key concepts include:

• VirtualMachine (VM): The high-level definition of the VM.
• VirtualMachineInstance (VMI): Represents a running instance of a VM.
• Instance Types: Predefined configurations for CPU, memory, and GPU allocation.
• Data Volumes: Persistent disks used by VMs.

The k8s-cilium skill provides 8 tools for managing eBPF-based networking in Kubernetes. It is designed for managing network policies, observing traffic flows, and troubleshooting connectivity using Cilium and Hubble.

When to use this skill:

• When working with keywords like Cilium, Hubble, eBPF, network policy, flow, network security, traffic flow, dropped packets, or connectivity.
• For operations involving network policy management, traffic observation, or L7 filtering.

The k8s-diagnostics skill is designed for observability tasks including cluster health assessments, environment comparisons, and resource analysis. It is most effective when you need to perform capacity planning, check usage metrics, or identify differences between environments (e.g., staging vs. production).

When to use this skill:

• When asking about "metrics", "health checks", "capacity", or "usage".
• When performing operations like cluster health assessment or environment comparison.
• When investigating the "difference between" two namespaces or clusters.

The k8s-incident skill provides runbooks and diagnostic workflows for common Kubernetes outages, pod failures, node issues, network problems, and emergency responses. It is designed to be used when users report terms like "incident", "outage", "emergency", "down", or "not working".

Priority Rules for Incident Response

1. Check control plane first (CRITICAL): Use get_pods(namespace="kube-system").
2. Assess node health (CRITICAL): Use get_nodes.
3. Gather events before changes (HIGH): Use get_events.
4. Document timeline (HIGH): Manual notes.
5. Rollback if safe (MEDIUM): Use rollback_deployment.

The k8s-storage skill provides tools for managing Kubernetes storage resources, including Persistent Volume Claims (PVCs), Storage Classes, Persistent Volumes (PVs), and Volume Snapshots. Use these tools when provisioning storage, mounting volumes, expanding storage, or troubleshooting storage-related issues.

Trigger Keywords:

• "PVC", "PV", "storage class", "volume", "disk", "storage"
• "persist", "data", "backup storage", "volume claim"

RBAC Permissions

The default RBAC configuration (rbac.yaml) grants read-only access to most Kubernetes resources. To enable write operations (such as apply, delete, or scale), you must manually modify rbac.yaml to include the necessary permissions.

Security Best Practices

1. Non-destructive mode: To prevent accidental changes, add the --disable-destructive flag to the deployment arguments.
2. Network Policies: Implement NetworkPolicies to restrict access to the server.
3. Secrets: Note that secrets are masked in the server output by default.

AnalysisTemplates allow you to automate validation during a rollout. A success-rate template typically uses a Prometheus provider to query metrics (like HTTP 2xx rates) and compares the result against a successCondition (e.g., result[0] >= 0.95).

apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: success-rate
spec:
  metrics:
  - name: success-rate
    interval: 30s
    count: 5
    successCondition: result[0] >= 0.95
    provider:
      prometheus:
        address: http://prometheus:9090
        query: |
          sum(rate(http_requests_total{status=~"2.*",app="{{args.app}}"}[5m])) /
          sum(rate(http_requests_total{app="{{args.app}}"}[5m]))

Almost all kubectl-mcp-server tools support a context parameter. This allows you to target a specific cluster without globally switching your active context, which is critical for preventing accidental operations in production environments.

Priority Rule: Always specify the context parameter when performing operations on production clusters.

# Target a specific cluster for a pod lookup
get_pods(namespace="default", context="production-cluster")

# Target a different cluster
get_pods(namespace="default", context="staging-cluster")