Governed AI agent access to real infrastructure
Connect Claude Code to a real Kubernetes cluster through a read-only MCP server, lock it down with least-privilege RBAC, and put it to work diagnosing a live incident — all while proving, step by step, that the agent can investigate but never mutate your infrastructure.
Before You Start
AI coding agents can now read cluster state, tail logs, and diagnose failures on real infrastructure — not just write code. That raises one question every DevOps team has to answer: what exactly can the agent do, and how do you prove it can't do more?
This track answers it hands-on, starting with Kubernetes:
The Model Context Protocol (MCP) gives your agent a fixed set of tools — if a "delete pod" tool doesn't exist on the server, no prompt can invoke it.
A namespace-scoped, least-privilege ServiceAccount means the agent's credential is denied at the Kubernetes API level too — defense in depth, not just a policy.
Every lesson ends the same way: attempt a write with the agent's real credential and watch it get a 403 Forbidden.
By the end, you'll have a pattern for governed agent access you can extend to every system your agents touch.
2 modules • 0 open
Build a read-only Kubernetes MCP server, connect Claude Code to it, and prove the agent can investigate your cluster but cannot change it — no mutating tool exists, and the same credential is denied on a direct write.
Go deep on the identity behind a read-only Kubernetes MCP server. Prove least privilege across two independent dimensions — WHAT the agent may do (verbs and subresources) and WHERE it may do it (namespace scope) — close the exec/attach/port-forward escalation paths, and harden the ServiceAccount token and kubeconfig you built in Lesson 1.
Put the read-only MCP lab to work. Diagnose the crashing pod from Lesson 1 entirely through Claude Code — reading pods, events, and logs — separate the CrashLoopBackOff symptom from its real root cause, and prove the agent can fully explain the failure while being unable to change anything. Then fix it yourself and confirm the repair through the agent, read-only.