# RBAC configuration for kubectl-mcp-server
# Grants read access to most Kubernetes resources
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: kubectl-mcp-server
namespace: kubectl-mcp
labels:
app.kubernetes.io/name: kubectl-mcp-server
---
# ClusterRole with read access to Kubernetes resources
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: kubectl-mcp-server-reader
labels:
app.kubernetes.io/name: kubectl-mcp-server
rules:
# Core resources - read access
- apiGroups: [""]
resources:
- pods
- pods/log
- services
- endpoints
- configmaps
- secrets
- namespaces
- nodes
- persistentvolumes
- persistentvolumeclaims
- events
- resourcequotas
- limitranges
- serviceaccounts
verbs: ["get", "list", "watch"]
# Apps resources
- apiGroups: ["apps"]
resources:
- deployments
- statefulsets
- daemonsets
- replicasets
verbs: ["get", "list", "watch"]
# Batch resources
- apiGroups: ["batch"]
resources:
- jobs
- cronjobs
verbs: ["get", "list", "watch"]
# Networking resources
- apiGroups: ["networking.k8s.io"]
resources:
- ingresses
- networkpolicies
verbs: ["get", "list", "watch"]
# Storage resources
- apiGroups: ["storage.k8s.io"]
resources:
- storageclasses
verbs: ["get", "list", "watch"]
# RBAC resources - read only
- apiGroups: ["rbac.authorization.k8s.io"]
resources:
- roles
- rolebindings
- clusterroles
- clusterrolebindings
verbs: ["get", "list", "watch"]
# Autoscaling resources
- apiGroups: ["autoscaling"]
resources:
- horizontalpodautoscalers
verbs: ["get", "list", "watch"]
# Policy resources
- apiGroups: ["policy"]
resources:
- poddisruptionbudgets
verbs: ["get", "list", "watch"]
# Custom Resource Definitions
- apiGroups: ["apiextensions.k8s.io"]
resources:
- customresourcedefinitions
verbs: ["get", "list", "watch"]
# Metrics
- apiGroups: ["metrics.k8s.io"]
resources:
- pods
- nodes
verbs: ["get", "list"]
---
# ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: kubectl-mcp-server-reader
labels:
app.kubernetes.io/name: kubectl-mcp-server
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: kubectl-mcp-server-reader
subjects:
- kind: ServiceAccount
name: kubectl-mcp-server
namespace: kubectl-mcp
