GoogleCloudPlatform/kubectl-ai

kubectl-ai

kubectl-ai acts as an intelligent interface, translating user intent into precise Kubernetes operations, making Kubernetes management more accessible and efficient.

Table of Contents

• Quick Start
  • Installation
  • Usage
• Configuration
• Tools
• Docker Quick Start
• MCP Client Mode
• Extras
• MCP Server Mode
• Start Contributing
• Learning Resources

Quick Start

First, ensure that kubectl is installed and configured.

Installation

Quick Install (Linux & MacOS only)

curl -sSL https://raw.githubusercontent.com/GoogleCloudPlatform/kubectl-ai/main/install.sh | bash

tar -zxvf kubectl-ai_Darwin_arm64.tar.gz
chmod a+x kubectl-ai
sudo mv kubectl-ai /usr/local/bin/

kubectl krew install ai

  environment.systemPackages = with pkgs; [
    kubectl-ai
  ];

nix-shell -p kubectl-ai

Usage

kubectl-ai supports AI models from gemini, vertexai, azopenai, openai, grok, bedrock and local LLM providers such as ollama and llama.cpp.

Using Gemini (Default)

Set your Gemini API key as an environment variable. If you don't have a key, get one from Google AI Studio.

export GEMINI_API_KEY=your_api_key_here
kubectl-ai

# Use different gemini model
kubectl-ai --model gemini-2.5-pro-exp-03-25

# Use 2.5 flash (faster) model
kubectl-ai --quiet --model gemini-2.5-flash-preview-04-17 "check logs for nginx app in hello namespace"

# assuming ollama is already running and you have pulled one of the gemma models
# ollama pull gemma3:12b-it-qat

# if your ollama server is at remote, use OLLAMA_HOST variable to specify the host
# export OLLAMA_HOST=http://192.168.1.3:11434/

# enable-tool-use-shim because models require special prompting to enable tool calling
kubectl-ai --llm-provider ollama --model gemma3:12b-it-qat --enable-tool-use-shim

# you can use `models` command to discover the locally available models
>> models

export GROK_API_KEY=your_xai_api_key_here
kubectl-ai --llm-provider=grok --model=grok-3-beta

# Configure AWS credentials using AWS SSO
aws sso login --profile your-profile-name
# Or use other AWS credential methods (IAM roles, environment variables, etc.)

# Use Claude 4 Sonnet (default)
kubectl-ai --llm-provider=bedrock --model=us.anthropic.claude-sonnet-4-20250514-v1:0

# Use Claude 3.7 Sonnet
kubectl-ai --llm-provider=bedrock --model=us.anthropic.claude-3-7-sonnet-20250219-v1:0

# Override model via environment variable
export BEDROCK_MODEL=us.anthropic.claude-sonnet-4-20250514-v1:0
kubectl-ai --llm-provider=bedrock

export AZURE_OPENAI_API_KEY=your_azure_openai_api_key_here
export AZURE_OPENAI_ENDPOINT=https://your_azure_openai_endpoint_here
kubectl-ai --llm-provider=azopenai --model=your_azure_openai_deployment_name_here
# or
az login
kubectl-ai --llm-provider=openai://your_azure_openai_endpoint_here --model=your_azure_openai_deployment_name_here

export OPENAI_API_KEY=your_openai_api_key_here
kubectl-ai --llm-provider=openai --model=gpt-4.1

export OPENAI_API_KEY=your_openai_api_key_here
export OPENAI_ENDPOINT=https://dashscope.aliyuncs.com/compatible-mode/v1
kubectl-ai --llm-provider=openai --model=qwen-plus

Run interactively:

kubectl-ai

The interactive mode allows you to have a chat with kubectl-ai, asking multiple questions in sequence while maintaining context from previous interactions. Simply type your queries and press Enter to receive responses. To exit the interactive shell, type exit or press Ctrl+C.

Or, run with a task as input:

kubectl-ai --quiet "fetch logs for nginx app in hello namespace"

Combine it with other unix commands:

kubectl-ai < query.txt
# OR
echo "list pods in the default namespace" | kubectl-ai

You can even combine a positional argument with stdin input. The positional argument will be used as a prefix to the stdin content:

cat error.log | kubectl-ai "explain the error"

We also support persistence between runs with an opt-in. This lets you save a session to the local filesystem, and resume it to maintain previous context. It even works between different interfaces!

kubectl-ai --new-session # start a new session
kubectl-ai --list-sessions # list all saved sessions
kubectl-ai --resume-session 20250807-510872 # resume session 20250807-510872
kubectl-ai --delete-session 20250807-510872 # delete session 20250807-510872

Configuration

You can also configure kubectl-ai using a YAML configuration file at ~/.config/kubectl-ai/config.yaml:

mkdir -p ~/.config/kubectl-ai/
cat <<EOF > ~/.config/kubectl-ai/config.yaml
model: gemini-2.5-flash-preview-04-17
llmProvider: gemini
toolConfigPaths: ~/.config/kubectl-ai/tools.yaml
EOF

Verify your configuration:

kubectl-ai --quiet model

# LLM provider configuration
llmProvider: "gemini"               # Default LLM provider
model: "gemini-2.5-pro-preview-06-05" # Default model
skipVerifySSL: false              # Skip SSL verification for LLM API calls

# Tool and permission settings
toolConfigPaths: ["~/.config/kubectl-ai/tools.yaml"]  # Custom tools configuration paths
skipPermissions: false             # Skip confirmation for resource-modifying commands
enableToolUseShim: false        # Enable tool use shim for certain models

# MCP configuration
mcpServer: false                  # Run in MCP server mode
mcpClient: false                  # Enable MCP client mode
externalTools: false             # Discover external MCP tools (requires mcp-server)

# Runtime settings
maxIterations: 20                 # Maximum iterations for the agent
quiet: false                       # Run in non-interactive mode
removeWorkdir: false             # Remove temporary working directory after execution

# Kubernetes configuration
kubeconfig: "~/.kube/config"      # Path to kubeconfig file

# UI configuration
uiType: "terminal"                # UI mode: "terminal" or "web"
uiListenAddress: "localhost:8888" # Address for HTML UI server

# Prompt configuration
promptTemplateFilePath: ""      # Custom prompt template file
extraPromptPaths: []            # Additional prompt template paths

# Debug and trace settings
tracePath: "/tmp/kubectl-ai-trace.txt" # Path to trace file

All these settings can be configured through either:

1. Command line flags (e.g., --model=gemini-2.5-pro)
2. Configuration file (~/.config/kubectl-ai/config.yaml)
3. Environment variables (e.g., GEMINI_API_KEY)

Command line flags take precedence over configuration file settings.

Tools

kubectl-ai leverages LLMs to suggest and execute Kubernetes operations using a set of powerful tools. It comes with built-in tools like kubectl and bash.

You can also extend its capabilities by defining your own custom tools. By default, kubectl-ai looks for your tool configurations in ~/.config/kubectl-ai/tools.yaml.

To specify tools configuration files or directories containing tools configuration files, use:

./kubectl-ai --custom-tools-config=<path-to-tools-directory> "your prompt here"

For further details on how to configure your own tools, go here.

Docker Quick Start

This project provides a Docker image that gives you a standalone environment for running kubectl-ai, including against a GKE cluster.

Running the container against GKE

Step 1: Build the Image

Clone the repository and build the image with the following command

git clone https://github.com/GoogleCloudPlatform/kubectl-ai.git
cd kubectl-ai
docker build -t kubectl-ai:latest -f images/kubectl-ai/Dockerfile .

Step 2: Connect to Your GKE Cluster

Set up application default credentials and connect to your GKE cluster.

gcloud auth application-default login # If in a gcloud shell this is not necessary
gcloud container clusters get-credentials <cluster-name> --zone <zone>

Step 3: Run the kubectl-ai container

Below is a sample command that can be used to launch the container with a locally hosted web-ui. Be sure to replace the placeholder values with your specific Google Cloud project ID and location. Note you do not need to mount the gcloud config directory if you're on a cloudshell machine.

docker run --rm -it -p 8080:8080 -v ~/.kube:/root/.kube -v ~/.config/gcloud:/root/.config/gcloud -e GOOGLE_CLOUD_LOCATION=us-central1 -e GOOGLE_CLOUD_PROJECT=my-gcp-project kubectl-ai:latest --llm-provider vertexai --ui-listen-address 0.0.0.0:8080 --ui-type web

For more info about running from the container image see CONTAINER.md

MCP Client Mode

Note: MCP Client Mode is available in kubectl-ai version v0.0.12 and onwards.

kubectl-ai can connect to external MCP Servers to access additional tools in addition to built-in tools.

Quick Start with MCP Client

Enable MCP client mode:

kubectl-ai --mcp-client

MCP Client Configuration

Create or edit ~/.config/kubectl-ai/mcp.yaml to customize MCP servers:

servers:
  # Local MCP server (stdio-based)
  # sequential-thinking: Advanced reasoning and step-by-step analysis
  - name: sequential-thinking
    command: npx
    args:
      - -y
      - "@modelcontextprotocol/server-sequential-thinking"
  
  # Remote MCP server (HTTP-based)
  - name: cloudflare-documentation
    url: https://docs.mcp.cloudflare.com/mcp
    
  # Optional: Remote MCP server with authentication
  - name: custom-api
    url: https://api.example.com/mcp
    auth:
      type: "bearer"
      token: "${MCP_TOKEN}"

The system automatically:

• Converts parameter names (snake_case → camelCase)
• Handles type conversion (strings → numbers/booleans when appropriate)
• Provides fallback behavior for unknown servers

No additional setup required - just use the --mcp-client flag and the AI will have access to all configured MCP tools.

📖 For detailed configuration options, troubleshooting, and advanced features for MCP Client mode, see the MCP Client Documentation.

📖 For multi-server orchestration and security automation examples, see the MCP Client Integration Guide.

Extras

You can use the following special keywords for specific actions:

• model: Display the currently selected model.
• models: List all available models.
• tools: List all available tools.
• version: Display the kubectl-ai version.
• reset: Clear the conversational context.
• clear: Clear the terminal screen.
• exit or quit: Terminate the interactive shell (Ctrl+C also works).

Invoking as kubectl plugin

You can also run kubectl ai. kubectl finds any executable file in your PATH whose name begins with kubectl- as a plugin.

MCP Server Mode

kubectl-ai can act as an MCP server that exposes kubectl tools to other MCP clients (like Claude, Cursor, or VS Code). The server can run in two modes:

Basic MCP Server (Built-in tools only)

Expose only kubectl-ai's native Kubernetes tools:

kubectl-ai --mcp-server

Enhanced MCP Server (With external tool discovery)

Additionally discover and expose tools from other MCP servers as a unified interface:

kubectl-ai --mcp-server --external-tools

This creates a powerful tool aggregation hub where kubectl-ai acts as both:

• MCP Server: Exposing kubectl tools to clients
• MCP Client: Consuming tools from other MCP servers

To serve clients over HTTP using the streamable transport, run:

kubectl-ai --mcp-server --mcp-server-mode streamable-http --http-port 9080

This starts an MCP endpoint at http://localhost:9080/mcp.

The enhanced mode provides AI clients with access to both Kubernetes operations and general-purpose tools (filesystem, web search, databases, etc.) through a single MCP endpoint.

Authenticating the HTTP Endpoint (OAuth 2.1)

The streamable-http endpoint is unauthenticated by default — anyone who can reach the port can run kubectl and bash. For non-localhost use, turn the server into an OAuth 2.1 Resource Server that requires a Bearer access token (verified locally against an authorization server's JWKS, e.g. AuthGate):

kubectl-ai --mcp-server --mcp-server-mode streamable-http --http-port 9080 \
  --mcp-auth-issuer https://authgate.corp \
  --mcp-auth-audience https://kubectl-ai.corp/mcp

--mcp-auth-audience is this server's resource identifier; the JWT's aud claim must match it, which binds each token to this MCP server and prevents tokens issued for other services (same authorization server) from being replayed here. It is required once --mcp-auth-issuer is set — see Why the audience (aud) matters.

Authentication is opt-in: without --mcp-auth-issuer the endpoint behaves exactly as before. See the MCP Server Documentation for details.

📖 For detailed configuration, examples, and troubleshooting, see the MCP Server Documentation.

Start Contributing

We welcome contributions to kubectl-ai from the community. Take a look at our contribution guide to get started.

Learning Resources

Talks and Presentations

• From Natural Language to K8s Operations: The MCP Architecture and Practice of kubectl-ai - A comprehensive presentation covering the architecture and practical usage of kubectl-ai with MCP (Model Context Protocol).

Note: This is not an officially supported Google product. This project is not eligible for the Google Open Source Software Vulnerability Rewards Program.