Can the assistant read my Secrets?

No. A Secret is listed by name, type and age only; its data is never read into an answer. A ConfigMap shows the names of its keys, not their values. To keep Secrets from being listed at all, give the ServiceAccount no right on them.

What can it change in the cluster?

Scaling a deployment or statefulset and restarting a rollout, which can be undone and are allowed by default, and deleting a pod, which waits for your approval by default. exec, attach, port-forward, applying manifests and editing other fields are never offered. Whatever the ServiceAccount’s Role does not allow is refused by the cluster itself.

Does GitHub Copilot see the password or key for Kubernetes?

No. The key for Kubernetes is pasted into Flowplane once and kept sealed there. GitHub Copilot only gets a Flowplane sign-in for you, which you can revoke in the console.

Can GitHub Copilot change things in Kubernetes without asking?

Some changes are allowed by default and 1 of 3 wait for your approval; the list above marks which. Your workspace’s rules decide, per tool.

Connect GitHub Copilot to Kubernetes

GitHub Copilot reaches Kubernetes through one Flowplane address. You add Kubernetes once in Flowplane, add that address to GitHub Copilot, and sign in. Look at your Kubernetes cluster’s workloads, events and pod logs, check rollouts, and scale, restart or delete a pod.

Connect Kubernetes →Set up your assistant

Tools: 5 read · 3 change
Sign-in: One shared key
Approval, by default: 1 of 3 changes ask first
MCP server: Flowplane’s tools

1
Add Kubernetes in Flowplane
In the Flowplane console, add Kubernetes, type the API server’s address (the server line of your kubeconfig), paste the ServiceAccount token and, if the cluster has its own certificate authority, its CA certificate. A cluster behind a firewall connects through a tunnel.
The cluster is reached with the token of a ServiceAccount you make, bound to a Role with only the rights you want assistants to have. The workspace pastes it once; the assistant reads and changes only what that account may. Flowplane keeps it sealed; the assistant never sees it.
Connect Kubernetes →
2
Add Flowplane to GitHub Copilot
Your address is shown in the Flowplane console; it looks like
https://mcp.flowplane.eu/<your-label>
1. In VS Code, open the command palette and run MCP: Add Server. Choose HTTP (HTTP or Server-Sent Events) and paste https://mcp.flowplane.eu/<your-label> (or add the block below to .vscode/mcp.json).
2. Choose Authenticate, then sign in to Flowplane and allow VS Code.
3. In Copilot Chat, switch to Agent mode.
```
{
  "servers": {
    "flowplane": { "type": "http", "url": "https://mcp.flowplane.eu/<your-label>" }
  }
}
```
Steps checked against the vendor’s documentation (Microsoft)
3
Ask GitHub Copilot
- “Which pods in the production namespace are not running?”
- “Show the last 100 lines of the api pod’s log.”
- “Has the rollout of the web deployment finished?”
- “Scale the worker deployment in staging to 3 replicas.”
- “What warning events were there in the payments namespace?”

What it can do

What GitHub Copilot can do in Kubernetes

For teams that run their own Kubernetes cluster. Through Flowplane an AI assistant can list namespaces and the pods, deployments, statefulsets, services, ingresses, jobs, nodes and events in them, look at one object, read a pod’s log and check whether a rollout has finished. It can scale a deployment or statefulset and restart a rollout; deleting a pod waits for your approval by default.

Reads5

List namespacesThe cluster's namespaceslist_namespaces
List workloads and morePods, deployments, services, jobs, nodes, eventslist_resources
Look at one objectA summary, or the whole objectget_resource
Read a pod's logThe last lines of a container's logget_logs
Check a rolloutWhether a deployment has finished rolling outrollout_status

Changes3

Scale a workloadSet how many replicas a workload runsscale
Restart a rolloutReplace its pods one by onerestart_rollout
Delete a podasks firstIts controller usually makes a new onedelete_pod

FAQ

Questions

Can the assistant read my Secrets?: No. A Secret is listed by name, type and age only; its data is never read into an answer. A ConfigMap shows the names of its keys, not their values. To keep Secrets from being listed at all, give the ServiceAccount no right on them.
What can it change in the cluster?: Scaling a deployment or statefulset and restarting a rollout, which can be undone and are allowed by default, and deleting a pod, which waits for your approval by default. exec, attach, port-forward, applying manifests and editing other fields are never offered. Whatever the ServiceAccount’s Role does not allow is refused by the cluster itself.
Does GitHub Copilot see the password or key for Kubernetes?: No. The key for Kubernetes is pasted into Flowplane once and kept sealed there. GitHub Copilot only gets a Flowplane sign-in for you, which you can revoke in the console.
Can GitHub Copilot change things in Kubernetes without asking?: Some changes are allowed by default and 1 of 3 wait for your approval; the list above marks which. Your workspace’s rules decide, per tool.

Your assistant

Other assistants with Kubernetes

Everything about Kubernetes and Flowplane →

Flowplane is not affiliated with or endorsed by Kubernetes’s maker; the name and logo only identify the app. Pricing

Let your AI work with your data. Safely, from today.

Free for yourself, set up in a minute. For your team or company, we’re happy to help you get started.

Start free →Book a call

Add Kubernetes in Flowplane

Add Flowplane to GitHub Copilot

Ask GitHub Copilot