kubernetes-mcp-server

#!/usr/bin/env bash NAMESPACE="create-simple-rbac" SERVICE_ACCOUNT="reader-sa" SERVICE_ACCOUNT_USER="system:serviceaccount:${NAMESPACE}:${SERVICE_ACCOUNT}" # Check for allowed permissions if ! kubectl auth can-i get pods --as=$SERVICE_ACCOUNT_USER -n $NAMESPACE &> /dev/null; then echo "ServiceAccount cannot 'get' pods." exit 1 fi if ! kubectl auth can-i list pods --as=$SERVICE_ACCOUNT_USER -n $NAMESPACE &> /dev/null; then echo "ServiceAccount cannot 'list' pods." exit 1 fi # Check for denied permissions if kubectl auth can-i delete pods --as=$SERVICE_ACCOUNT_USER -n $NAMESPACE &> /dev/null; then echo "ServiceAccount has excessive permissions (can 'delete' pods)." exit 1 fi if kubectl auth can-i create pods --as=$SERVICE_ACCOUNT_USER -n $NAMESPACE &> /dev/null; then echo "ServiceAccount has excessive permissions (can 'create' pods)." exit 1 fi if kubectl auth can-i create pods --as=$SERVICE_ACCOUNT_USER &> /dev/null; then echo "ServiceAccount has excessive permissions (can 'create' pods in other namespace)." exit 1 fi if kubectl auth can-i list pods --as=$SERVICE_ACCOUNT_USER -A &> /dev/null; then echo "ServiceAccount has excessive permissions (can 'list' pods in other namespace)." exit 1 fi echo "Verification successful: RBAC role and binding correctly configured." exit 0