Most “AI + Kubernetes” demos hand the model a terminal where
kubectl already works. That is convenient - and it means the agent can
list secrets, patch Deployments, or delete a namespace the moment a prompt goes wrong.
KubeSpade takes the opposite default: the AI process is useful, but it is not silently
equivalent to you at a trusted shell.
The problem with “just run kubectl”
If KUBECONFIG (or the default ~/.kube/config) is available to
the agent, every tool that shells out inherits full cluster credentials. Prompt injection,
a bad suggestion you tab-complete, or a runaway script is then a production write away.
“Be careful” is not a control plane.
Empty KUBECONFIG on purpose
When KubeSpade starts your chosen CLI, it points KUBECONFIG at an empty
file inside an ephemeral workspace. The agent’s shell is not wired to your live contexts.
Plain kubectl get pods from that PTY should fail closed - not fall through
to your day-to-day config.
That is deliberate. We still want the model to reason about your connected clusters - just not by owning the same credentials the GUI uses for normal browsing.
Cluster access is MCP-only
Connected profiles in the app are exposed as KubeSpade MCP tools
(list, get, describe, logs, and mutating operations). The agent talks to the cluster
through those tools, not through a kubeconfig sitting in the process environment.
Reads run freely. The model never needs your file path to ~/.kube/config
for that path.
Product surface for the same story: In-app AI on Desktop.
Writes need Approve
Apply and delete do not execute when the model asks. They open an Approve dialog in KubeSpade. You see the intended change and confirm or dismiss. The AI CLI may skip its own “run this tool?” prompts for our MCP server; the human gate stays in the app.
What this is not
- Not a hosted KubeSpade model or a cloud proxy for your API server.
- Not a claim that every agent is harmless - you still choose which CLI to install and trust.
- Not “AI instead of kubectl.” Day-to-day work stays in the GUI; AI is optional.
Why it matters for Lens-exit buyers
If you left Lens for a local client, you probably care that credentials stay on the machine and that the vendor is not in the path. Optional AI should not punch a hole through that story. Empty kubeconfig + MCP + Approve is the architecture we ship so the feature can stay second in the pitch - after no account / credentials on device.
Try it
Install Desktop, connect a cluster, install Claude / Gemini / Codex / Copilot / Cursor on PATH, open the AI sidebar. Ask a read question first; attempt a write and you should hit Approve.