mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-07-10 17:10:53 +00:00
04d7b04c19
The MCP server minted a hub SA token once at startup and reused it for the life of the process, so a long-running server 401'd silently after the ~1h token TTL. - utils/http: the hub round-tripper now sources the SA token via a func() string per request (static constructors preserved), so a renewing source keeps long-lived clients authenticated. - kubernetes: add HubTokenRenewer — re-mints the kubeshark-cli token before expiry (using the TokenRequest expiry, 5m margin), concurrency-safe. - mcp proxy mode: use the renewer so the token auto-renews. - mcp --url mode: cannot mint (no kube access) — accept an explicit --token / KUBESHARK_HUB_TOKEN, and on 401 surface a clear 'token expired/invalid, re-mint and restart' message instead of an opaque API error. console is intentionally untouched (non-functional pending the Connect-RPC re-point); it gets renewal when that migration lands.
128 lines
4.1 KiB
Go
128 lines
4.1 KiB
Go
package cmd
|
|
|
|
import (
|
|
"github.com/kubeshark/kubeshark/config"
|
|
"github.com/spf13/cobra"
|
|
)
|
|
|
|
var mcpURL string
|
|
var mcpKubeconfig string
|
|
var mcpListTools bool
|
|
var mcpConfig bool
|
|
var mcpAllowDestructive bool
|
|
var mcpToken string
|
|
|
|
var mcpCmd = &cobra.Command{
|
|
Use: "mcp",
|
|
Short: "Run MCP (Model Context Protocol) server for AI assistant integration",
|
|
Long: `Run an MCP server over stdio that exposes Kubeshark's L7 API visibility
|
|
to AI assistants like Claude Desktop.
|
|
|
|
TOOLS PROVIDED:
|
|
|
|
Cluster Management (work without Kubeshark running):
|
|
- check_kubeshark_status: Check if Kubeshark is running in the cluster
|
|
- start_kubeshark: Start Kubeshark to capture traffic
|
|
- stop_kubeshark: Stop Kubeshark and clean up resources
|
|
|
|
Traffic Analysis (require Kubeshark running):
|
|
- list_workloads: Discover pods, services, namespaces, and nodes with L7 traffic
|
|
- list_api_calls: Query L7 API transactions (HTTP, gRPC, etc.)
|
|
- get_api_call: Get detailed information about a specific API call
|
|
- get_api_stats: Get aggregated API statistics
|
|
|
|
CONFIGURATION:
|
|
|
|
To use with Claude Desktop, add to your claude_desktop_config.json
|
|
(typically at ~/Library/Application Support/Claude/claude_desktop_config.json):
|
|
|
|
{
|
|
"mcpServers": {
|
|
"kubeshark": {
|
|
"command": "/path/to/kubeshark",
|
|
"args": ["mcp", "--kubeconfig", "/Users/YOUR_USERNAME/.kube/config"]
|
|
}
|
|
}
|
|
}
|
|
|
|
DIRECT URL MODE:
|
|
|
|
If Kubeshark is already running and accessible via URL (e.g., exposed via ingress),
|
|
you can connect directly without needing kubectl/kubeconfig:
|
|
|
|
{
|
|
"mcpServers": {
|
|
"kubeshark": {
|
|
"command": "/path/to/kubeshark",
|
|
"args": ["mcp", "--url", "https://kubeshark.example.com"]
|
|
}
|
|
}
|
|
}
|
|
|
|
In URL mode, destructive tools (start/stop) are disabled since Kubeshark is
|
|
managed externally. The check_kubeshark_status tool remains available to confirm connectivity.
|
|
|
|
DESTRUCTIVE OPERATIONS:
|
|
|
|
By default, destructive operations (start_kubeshark, stop_kubeshark) are disabled
|
|
to prevent accidental cluster modifications. To enable them, use --allow-destructive:
|
|
|
|
{
|
|
"mcpServers": {
|
|
"kubeshark": {
|
|
"command": "/path/to/kubeshark",
|
|
"args": ["mcp", "--allow-destructive", "--kubeconfig", "/path/to/.kube/config"]
|
|
}
|
|
}
|
|
}
|
|
|
|
CUSTOM SETTINGS:
|
|
|
|
To use custom settings when starting Kubeshark, use the --set flag:
|
|
|
|
{
|
|
"mcpServers": {
|
|
"kubeshark": {
|
|
"command": "/path/to/kubeshark",
|
|
"args": ["mcp", "--set", "tap.docker.tag=v52.3"],
|
|
...
|
|
}
|
|
}
|
|
}
|
|
|
|
Multiple --set flags can be used for different settings.`,
|
|
RunE: func(cmd *cobra.Command, args []string) error {
|
|
// Handle --mcp-config flag
|
|
if mcpConfig {
|
|
printMCPConfig(mcpURL, mcpKubeconfig)
|
|
return nil
|
|
}
|
|
|
|
// Set kubeconfig path if provided
|
|
if mcpKubeconfig != "" {
|
|
config.Config.Kube.ConfigPathStr = mcpKubeconfig
|
|
}
|
|
|
|
// Handle --list-tools flag
|
|
if mcpListTools {
|
|
listMCPTools(mcpURL)
|
|
return nil
|
|
}
|
|
|
|
setFlags, _ := cmd.Flags().GetStringSlice(config.SetCommandName)
|
|
runMCPWithConfig(setFlags, mcpURL, mcpAllowDestructive)
|
|
return nil
|
|
},
|
|
}
|
|
|
|
func init() {
|
|
rootCmd.AddCommand(mcpCmd)
|
|
|
|
mcpCmd.Flags().StringVar(&mcpURL, "url", "", "Direct URL to Kubeshark (e.g., https://kubeshark.example.com). When set, connects directly without kubectl/proxy and disables start/stop tools.")
|
|
mcpCmd.Flags().StringVar(&mcpToken, "token", "", "ServiceAccount/bearer token for a gated Hub in --url mode (e.g. from 'kubectl create token kubeshark-cli --audience kubeshark-hub'); also read from KUBESHARK_HUB_TOKEN. Ignored without --url, where the token is minted and auto-renewed from kube access.")
|
|
mcpCmd.Flags().StringVar(&mcpKubeconfig, "kubeconfig", "", "Path to kubeconfig file (e.g., /Users/me/.kube/config)")
|
|
mcpCmd.Flags().BoolVar(&mcpListTools, "list-tools", false, "List available MCP tools and exit")
|
|
mcpCmd.Flags().BoolVar(&mcpConfig, "mcp-config", false, "Print MCP client configuration JSON and exit")
|
|
mcpCmd.Flags().BoolVar(&mcpAllowDestructive, "allow-destructive", false, "Enable destructive operations (start_kubeshark, stop_kubeshark). Without this flag, only read-only traffic analysis tools are available.")
|
|
}
|