What this integration enables
- Pod inspection — agents read pod status, restart counts, resource utilization, and readiness state for affected services
- Deployment state — agents check current replica counts, rollout status, and recent rollout history
- Cluster events — agents query Kubernetes events correlated with incident timing to surface scheduling failures, OOM kills, and node pressure
- Container logs — agents retrieve container logs from affected pods for the incident time window
- Remediation actions — with explicit HITL approval, the resolution specialist can restart deployments, adjust replica counts, or trigger rollouts (always gated by Human-in-the-Loop, regardless of control mode)
Prerequisites
- A Kubernetes cluster
- The
k8s-mcpserver running inside your cluster or accessible from sureops with an appropriate kubeconfig or service account token
Setup
1
Stand up k8s-mcp
Deploy
k8s-mcp inside your cluster (recommended) or on infrastructure with access to your cluster’s API server. If you’re using the sureops demo environment, k8s-mcp is already provisioned in-cluster — you can skip this step.For your own cluster, the sureops MCP setup guide provides a Helm chart for deploying k8s-mcp with a scoped service account. The service account needs read access to pods, deployments, events, and logs, plus optional exec/scale permissions for remediation.2
Enter MCP endpoint and token
In sureops, go to Settings → Integrations and click Connect next to Kubernetes.Fill in:
- Kubernetes MCP Endpoint — the URL of your running
k8s-mcpserver (e.g.https://k8s-mcp.internal.company.com/mcp) - MCP Connection Token — the bearer token used to authenticate sureops to your
k8s-mcpdeployment
Required credentials
Scoping k8s-mcp permissions
The level of access you grantk8s-mcp determines what sureops agents can do:
Grant only the permissions you want sureops to have. Read-only access (the first four rows) is sufficient for diagnosis-only use. Resolution actions require the additional scale and delete permissions.