Explain an unhealthy workload
Ask AI to combine pod status, deployment conditions and events. Enable the log tool when a bounded container log is needed to explain a failure.
Cloud & infrastructure · MCP integration
Give AI cluster context. Review the changes.
Let an AI client inspect Kubernetes workloads, events and permitted pod logs through one MCP endpoint. GateRook connects with a token or kubeconfig, applies namespace policies and separates reads from changes. Enabled rollout restarts and manifest applies wait for your approval.
Connection in GateRook
stage-k8s
Kubernetes
stage / QA- Sign in with
- kubeconfig-file
- kubeconfig file
- ~/.kube/config
- Context
- stage
- Default namespace
- default
The route
Your AI requests a tool. GateRook checks the endpoint policy, resolves credentials locally, and calls the configured service.
Understand the request flowAsk your AI
Show the pods for the API service in the stage cluster.
k8s_get · arguments
{
"connection": "stage-k8s",
"kind": "pods",
"namespace": "default",
"labelSelector": "app=api",
"limit": 10
}Example result
{
"mode": "list",
"connection": "stage-k8s",
"kind": "pods",
"namespace": "default",
"columns": [
"Name",
"Ready",
"Status",
"Restarts"
],
"rows": [
{
"name": "api-6c87f9d4c7-r7k2m",
"namespace": "default",
"cells": [
"api-6c87f9d4c7-r7k2m",
"1/1",
"Running",
0
]
}
],
"cursor": null,
"truncated": false
}Sample configuration and output, not a live connection. Replace example values with your environment. Tool names here are connector names; the endpoint may expose a connection-specific name.
Put context to work
What you can do with Kubernetes and AI
Review a restart
Have AI identify a deployment and request a rollout restart. GateRook shows the target and exact action; execution waits for your decision.
Inspect a manifest change
When apply is enabled, review the server dry-run diff before approving. The proposed manifest and affected objects stay visible instead of relying on an AI summary.
From service to MCP
How to connect Kubernetes
GateRook must be running on a computer that can reach your service. Open Connections, choose Add connection, and select Kubernetes. Give the connection a name and environment.
New to GateRook? Start with the full setup guide.Choose a cluster identity
Prepare a kubeconfig context or API token with Kubernetes RBAC access to the resources you want AI to inspect. For the token method, provide the HTTPS API server and its CA certificate when it is not trusted by the OS.
Add and test the connection
Add Kubernetes as stage-k8s in the stage environment. Select the authentication method, context and default namespace, then run Test connection. For a kubeconfig file, review the cluster GateRook will pin.
Review credential plugins
If the kubeconfig invokes an external credential command, explicitly allow and review that command. It runs on this computer with your user permissions. A changed command or cluster must be trusted again.
Choose reads and permitted changes
Set namespace and resource restrictions in Policies. Start with k8s_get. Enable pod logs separately if required; expose restart or apply only for the workflows you intend to review.
Choose the endpoint and tool modes
Add the tested connection to an endpoint. In Tools & policies, enable only the tools needed for the task. Start with Read only where supported; use Approval for any selected mutation and leave other tools Off. A connection alone does not grant an AI client access.
Connect your AI and verify the first call
In Clients, choose your AI app and endpoint, review the connection details, and connect. Try this guide’s example in Playground before asking your AI. Open Activity to inspect the tool, target, decision and returned result. The getting started guide covers this shared flow.
Connection settings
Configure Kubernetes in GateRook
These are example values for the connection form. Enter credentials into GateRook’s secret fields, not into an AI prompt. Requirements and alternatives are noted per field.
| Setting | Example | How to use it |
|---|---|---|
Sign in with | kubeconfig-file | Use a local kubeconfig file, paste kubeconfig into a protected field, or supply an HTTPS API server and token. |
kubeconfig file | ~/.kube/config | This path is read on the computer running GateRook. |
Context | stage | Choose the intended context explicitly; Test connection verifies the target cluster. |
Default namespace | default | Calls use this namespace unless another permitted namespace is requested. |
Run the credential command from kubeconfig | false | Enable only if your kubeconfig needs an exec credential plugin. Review the command during connection testing before allowing it. |
Know what you expose
Kubernetes tools and access boundaries
The connector determines what is possible. Endpoint modes and connection policies determine what a particular AI client may use.
| Tool | Purpose | Access behavior |
|---|---|---|
k8s_get | List resources or inspect one object with its events and rollout state. Supports selectors, pagination and allowed namespaces. Kubernetes Secret values are masked. | Read only |
k8s_logs | Read a bounded tail of one container log by pod name or deployment/name. Enable it explicitly when log access is needed. | Off by default |
k8s_rollout_restart | Restart a deployment, statefulset or daemonset after approval. Defaults to Approval outside prod and Off in prod. | Approval / Off in prod |
k8s_apply | Apply up to twenty YAML or JSON objects after reviewing the exact diff from the API server dry run. It must be enabled explicitly. | Off by default |
Before you enable access
- Kubernetes RBAC and gateway policies both apply. Exposing a tool does not give the cluster identity additional permissions.
- Pod logs are off by default. Logs may contain application data, so enable the tool only for the namespaces and workloads you intend to share with the AI client.
- Manifest apply and rollout restart require approval when enabled. Rollout restart defaults to Off in prod; apply defaults to Off everywhere.
- A pinned kubeconfig target changing stops calls until the connection is tested and trusted again. Skipping TLS verification is forbidden for prod connections.
GateRook stores local connection secrets encrypted and resolves them for connectors. Allowed tool results are returned to your AI client and may be processed by its provider. Scope the data you expose as well as the actions you allow.
Practical answers
Kubernetes connection questions
Use Test connection to isolate service access problems. Use Playground and Activity to inspect endpoint permissions and tool calls.
Can I use an existing kubeconfig?
Yes. Select a kubeconfig file and context, or paste kubeconfig into its protected field. A local file is checked during Test connection and its cluster identity is pinned.
Will AI be able to run arbitrary kubectl commands?
This connector exposes four specific MCP tools, not a general kubectl shell. The endpoint modes, namespace policy and cluster RBAC determine what those tools may do.
How are Kubernetes changes approved?
A rollout restart shows the exact target. Manifest apply shows the diff returned by the API server dry run. Enabled changes execute only after approval; a denied or unanswered request does not run.
Keep exploring
Connect the rest of your stack
AWS
Connect Claude, Codex or Cursor to AWS through GateRook. Inspect resources and CloudWatch metrics with scoped regions, local credentials and read-only MCP tools.
Google Cloud
Use AI with Google Cloud through GateRook MCP tools. Search Cloud Asset inventory, inspect supported resources live and query Cloud Monitoring with scoped credentials.
SSH
Use SSH from AI through GateRook MCP runbooks. Connect with keys, passwords or Vault SSH CA, verify host keys, and approve commands that change your servers.
Your infrastructure, on your terms
Bring Kubernetes into the conversation.
Start with one connection. Choose what your AI can do.