MCP Server Kubernetes

⚠️ SECURITY CONCERN: OVER-PERMISSIVE RBAC ⚠️

Issue

The default RBAC configuration grants cluster-admin level permissions, including:

• Full access to all secrets
• Ability to create/delete pods in any namespace
• Access to service accounts

Risk

If an AI assistant is compromised or manipulated, it could:

1. Exfiltrate secrets (API keys, passwords)
2. Deploy malicious containers
3. Disrupt cluster operations

Recommendation

1. Create a restricted ServiceAccount
2. Use namespace-scoped roles
3. Deny access to secrets by default
4. Enable audit logging

Current Status

Maintainers have been notified but have not updated default configuration.