mcp-server-kubernetes 3.3.0 → 3.5.0

package/dist/index.d.ts

@@ -393,6 +393,17 @@ declare const allTools: ({
         };
         readonly required: readonly ["operation"];
     };
+} | {
+    readonly name: "kubectl_reconnect";
+    readonly description: "Reconnect to the Kubernetes API server by recreating all API clients. Use this after cluster upgrades (e.g., EKS control plane upgrades that rotate ENIs/IPs) to force fresh DNS resolution and new TCP connections.";
+    readonly annotations: {
+        readonly readOnlyHint: false;
+    };
+    readonly inputSchema: {
+        readonly type: "object";
+        readonly properties: {};
+        readonly required: readonly [];
+    };
 } | {
     readonly name: "kubectl_get";
     readonly description: "Get or list Kubernetes resources by resource type, name, and optionally namespace";

package/dist/index.js

@@ -18,6 +18,7 @@ import { startSSEServer } from "./utils/sse.js";
 import { startPortForward, PortForwardSchema, stopPortForward, StopPortForwardSchema, } from "./tools/port_forward.js";
 import { kubectlScale, kubectlScaleSchema } from "./tools/kubectl-scale.js";
 import { kubectlContext, kubectlContextSchema, } from "./tools/kubectl-context.js";
+import { kubectlReconnect, kubectlReconnectSchema, } from "./tools/kubectl-reconnect.js";
 import { kubectlGet, kubectlGetSchema } from "./tools/kubectl-get.js";
 import { kubectlDescribe, kubectlDescribeSchema, } from "./tools/kubectl-describe.js";
 import { kubectlApply, kubectlApplySchema } from "./tools/kubectl-apply.js";
@@ -41,6 +42,7 @@ const readonlyTools = [
     kubectlDescribeSchema,
     kubectlLogsSchema,
     kubectlContextSchema,
+    kubectlReconnectSchema,
     explainResourceSchema,
     listApiResourcesSchema,
     pingSchema,
@@ -69,6 +71,7 @@ const allTools = [
     kubectlRolloutSchema,
     // Kubernetes context management
     kubectlContextSchema,
+    kubectlReconnectSchema,
     // Special operations that aren't covered by simple kubectl commands
     explainResourceSchema,
     // Helm operations
@@ -129,6 +132,9 @@ server.setRequestHandler(CallToolRequestSchema, withTelemetry(async (request) =>
         if (name === "kubectl_context") {
             return await kubectlContext(k8sManager, input);
         }
+        if (name === "kubectl_reconnect") {
+            return await kubectlReconnect(k8sManager);
+        }
         if (name === "kubectl_get") {
             return await kubectlGet(k8sManager, input);
         }

package/dist/tools/kubectl-reconnect.d.ts

@@ -0,0 +1,19 @@
+import { KubernetesManager } from "../types.js";
+export declare const kubectlReconnectSchema: {
+    readonly name: "kubectl_reconnect";
+    readonly description: "Reconnect to the Kubernetes API server by recreating all API clients. Use this after cluster upgrades (e.g., EKS control plane upgrades that rotate ENIs/IPs) to force fresh DNS resolution and new TCP connections.";
+    readonly annotations: {
+        readonly readOnlyHint: false;
+    };
+    readonly inputSchema: {
+        readonly type: "object";
+        readonly properties: {};
+        readonly required: readonly [];
+    };
+};
+export declare function kubectlReconnect(k8sManager: KubernetesManager): Promise<{
+    content: {
+        type: string;
+        text: string;
+    }[];
+}>;

package/dist/tools/kubectl-reconnect.js

@@ -0,0 +1,32 @@
+import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
+export const kubectlReconnectSchema = {
+    name: "kubectl_reconnect",
+    description: "Reconnect to the Kubernetes API server by recreating all API clients. Use this after cluster upgrades (e.g., EKS control plane upgrades that rotate ENIs/IPs) to force fresh DNS resolution and new TCP connections.",
+    annotations: {
+        readOnlyHint: false,
+    },
+    inputSchema: {
+        type: "object",
+        properties: {},
+        required: [],
+    },
+};
+export async function kubectlReconnect(k8sManager) {
+    try {
+        k8sManager.refreshApiClients();
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify({
+                        success: true,
+                        message: "API clients refreshed. DNS will be re-resolved on the next request.",
+                    }, null, 2),
+                },
+            ],
+        };
+    }
+    catch (error) {
+        throw new McpError(ErrorCode.InternalError, `Failed to reconnect: ${error.message}`);
+    }
+}

package/dist/tools/port_forward.js

@@ -1,9 +1,8 @@
 import { spawn } from "child_process";
 // Use spawn instead of exec because port-forward is a long-running process
-async function executeKubectlCommandAsync(command) {
+async function executePortForward(args) {
     return new Promise((resolve, reject) => {
-        const [cmd, ...args] = command.split(" ");
-        const process = spawn(cmd, args);
+        const process = spawn("kubectl", args);
         let output = "";
         let errorOutput = "";
         process.stdout.on("data", (data) => {
@@ -54,13 +53,14 @@ export const PortForwardSchema = {
     },
 };
 export async function startPortForward(k8sManager, input) {
-    let command = `kubectl port-forward`;
+    const args = ["port-forward"];
     if (input.namespace) {
-        command += ` -n ${input.namespace}`;
+        args.push("-n", input.namespace);
     }
-    command += ` ${input.resourceType}/${input.resourceName} ${input.localPort}:${input.targetPort}`;
+    args.push(`${input.resourceType}/${input.resourceName}`);
+    args.push(`${input.localPort}:${input.targetPort}`);
     try {
-        const result = await executeKubectlCommandAsync(command);
+        const result = await executePortForward(args);
         // Track the port-forward process
         k8sManager.trackPortForward({
             id: `${input.resourceType}-${input.resourceName}-${input.localPort}`,

package/dist/utils/auth.js

@@ -1,3 +1,15 @@
+import { timingSafeEqual } from "crypto";
+/** Constant-time string comparison that prevents timing attacks (CWE-208). */
+function timingSafeCompare(a, b) {
+    const bufA = Buffer.from(a);
+    const bufB = Buffer.from(b);
+    if (bufA.length !== bufB.length) {
+        // Compare against itself to keep constant time, then return false
+        timingSafeEqual(bufA, bufA);
+        return false;
+    }
+    return timingSafeEqual(bufA, bufB);
+}
 /**
  * Authentication middleware for MCP HTTP transports.
  *
@@ -31,7 +43,19 @@ export function createAuthMiddleware() {
             });
             return;
         }
-        if (providedToken !== authToken) {
+        // Reject array-valued headers (e.g. duplicate X-MCP-AUTH)
+        if (Array.isArray(providedToken)) {
+            res.status(401).json({
+                jsonrpc: "2.0",
+                error: {
+                    code: -32001,
+                    message: "Unauthorized: Only single X-MCP-AUTH header is allowed",
+                },
+                id: null,
+            });
+            return;
+        }
+        if (!timingSafeCompare(providedToken, authToken)) {
             res.status(403).json({
                 jsonrpc: "2.0",
                 error: {

package/dist/utils/kubernetes-manager.d.ts

@@ -51,6 +51,7 @@ export declare class KubernetesManager {
      *
      * @param contextName
      */
+    refreshApiClients(): void;
     setCurrentContext(contextName: string): void;
     cleanup(): Promise<void>;
     trackResource(kind: string, name: string, namespace: string): void;

package/dist/utils/kubernetes-manager.js

@@ -186,6 +186,11 @@ export class KubernetesManager {
      *
      * @param contextName
      */
+    refreshApiClients() {
+        this.k8sApi = this.kc.makeApiClient(k8s.CoreV1Api);
+        this.k8sAppsApi = this.kc.makeApiClient(k8s.AppsV1Api);
+        this.k8sBatchApi = this.kc.makeApiClient(k8s.BatchV1Api);
+    }
     setCurrentContext(contextName) {
         // Get all available contexts
         const contexts = this.kc.getContexts();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-server-kubernetes",
-  "version": "3.3.0",
+  "version": "3.5.0",
   "description": "MCP server for interacting with Kubernetes clusters via kubectl",
   "license": "MIT",
   "type": "module",
@@ -47,7 +47,7 @@
     "@opentelemetry/semantic-conventions": "^1.39.0",
     "express": "4.21.2",
     "js-yaml": "4.1.1",
-    "yaml": "2.7.0",
+    "yaml": "2.8.3",
     "zod": "3.25.76"
   },
   "devDependencies": {