feat: add field-level redaction for sensitive resource values

Add a redacted_resources configuration section that allows AI agents to
see Kubernetes resource metadata while having sensitive field values
replaced with opaque or HMAC-hashed placeholders.

Redaction is applied in the kubernetes wrapper layer (Core struct) so
that all tool handlers benefit automatically. An exported
RedactResource/RedactResourceList helper is available for toolsets
that bypass the wrapper.

Configuration uses a separate [[redacted_resources]] TOML section with
fields and mode parameters, cleanly separated from denied_resources.

Signed-off-by: Yury Sokov <me@yurzs.dev>

Author: Yurzs

README.md

@@ -222,11 +222,19 @@ log_level = 2
 read_only = true
 toolsets = ["core", "config", "helm", "kubevirt"]
 
-# Deny access to sensitive resources
+# Deny access to sensitive resources (fully blocked)
 [[denied_resources]]
+group = "rbac.authorization.k8s.io"
+version = "v1"
+kind = "ClusterRole"
+
+# Allow Secrets but redact their values (keys and metadata remain visible)
+[[redacted_resources]]
 group = ""
 version = "v1"
 kind = "Secret"
+fields = ["data.*", "stringData.*"]
+mode = "hashed"
 
 [telemetry]
 endpoint = "http://localhost:4317"
@@ -238,6 +246,7 @@ For comprehensive TOML configuration documentation, including:
 - Drop-in configuration files for modular settings
 - Dynamic configuration reload via SIGHUP
 - Denied resources for restricting access to sensitive resource types
+- Redacted resources for field-level redaction of sensitive values
 - Server instructions for MCP Tool Search
 - [Custom MCP prompts](docs/prompts.md)
 - OAuth/OIDC authentication for HTTP mode ([Keycloak](docs/KEYCLOAK_OIDC_SETUP.md), [Microsoft Entra ID](docs/ENTRA_ID_SETUP.md))

claude-config.toml

@@ -0,0 +1,29 @@
+read_only = true
+log_level = 0
+
+# Block Secrets entirely
+[[denied_resources]]
+group = ""
+version = "v1"
+kind = "Secret"
+
+# Block RBAC
+[[denied_resources]]
+group = "rbac.authorization.k8s.io"
+version = "v1"
+kind = "ClusterRole"
+
+[[denied_resources]]
+group = "rbac.authorization.k8s.io"
+version = "v1"
+kind = "ClusterRoleBinding"
+
+[[denied_resources]]
+group = "rbac.authorization.k8s.io"
+version = "v1"
+kind = "Role"
+
+[[denied_resources]]
+group = "rbac.authorization.k8s.io"
+version = "v1"
+kind = "RoleBinding"

docs/configuration.md

@@ -410,6 +410,68 @@ version = "v1"
 kind = "ClusterRoleBinding"
 ```
 
+### Redacted Resources
+
+Instead of fully denying a resource, you can allow access but redact sensitive fields. This is useful for resources like Secrets where the agent needs to see metadata (name, namespace, keys, type, ownership) but should not see actual values.
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `redacted_resources` | array | `[]` | List of resources with field-level redaction. |
+
+Each entry in `redacted_resources` supports the following fields:
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `group` | string | required | API group (e.g. `""` for core, `"apps"` for apps/v1) |
+| `version` | string | required | API version (e.g. `"v1"`) |
+| `kind` | string | required | Resource kind (e.g. `"Secret"`) |
+| `fields` | array | required | Dot-separated field paths to redact |
+| `mode` | string | `"opaque"` | How to redact values: `"opaque"` or `"hashed"` |
+
+**Example — redact Secret values while keeping metadata and key names visible:**
+```toml
+[[redacted_resources]]
+group = ""
+version = "v1"
+kind = "Secret"
+fields = ["data.*", "stringData.*"]
+mode = "hashed"
+```
+
+**Path syntax:**
+
+Fields are specified as dot-separated paths with `*` wildcard support. The wildcard adapts to the type it encounters — it iterates keys in a map and items in an array.
+
+| Path | Behavior |
+|------|----------|
+| `data.*` | Redact all values in a map (keys remain visible) |
+| `spec.credentials` | Redact a single field |
+| `spec.template.spec.containers.*.env.*.value` | Traverse arrays and maps to reach nested fields |
+
+**Redaction modes:**
+
+- `opaque` (default): replaces values with `[REDACTED]`
+- `hashed`: replaces values with `[REDACTED:gen_<id>:<hash>]`
+
+Hashed mode uses HMAC-SHA256 with a random salt generated once at server startup. This allows the agent to detect when two different resources reference the same value (e.g. two services using the same connection string) without exposing the actual content. The salt is never persisted and changes on restart. A generation ID is included so consumers can detect when the salt changed and know that hashes from different generations are not comparable.
+
+**More examples:**
+```toml
+# ConfigMap with sensitive data
+[[redacted_resources]]
+group = ""
+version = "v1"
+kind = "ConfigMap"
+fields = ["data.*"]
+
+# CRD with embedded credentials
+[[redacted_resources]]
+group = "db.example.com"
+version = "v1"
+kind = "DatabaseConnection"
+fields = ["spec.credentials.*", "spec.connectionString"]
+```
+
 ### Server Instructions
 
 Provide hints to MCP clients (like Claude Code) about when to use this server's tools. Useful for clients that support **MCP Tool Search**.

pkg/api/config.go

@@ -58,11 +58,28 @@ type GroupVersionKind struct {
 	Kind    string `json:"kind,omitempty" toml:"kind,omitempty"`
 }
 
+// RedactedResource defines a resource type whose specific fields should be redacted
+// rather than having the entire resource denied. This allows agents to see resource
+// metadata while sensitive field values are replaced with redaction markers.
+type RedactedResource struct {
+	Group   string   `json:"group" toml:"group"`
+	Version string   `json:"version" toml:"version"`
+	Kind    string   `json:"kind" toml:"kind"`
+	Fields  []string `json:"fields" toml:"fields"`
+	Mode    string   `json:"mode,omitempty" toml:"mode,omitempty"`
+}
+
 type DeniedResourcesProvider interface {
 	// GetDeniedResources returns a list of GroupVersionKinds that are denied.
 	GetDeniedResources() []GroupVersionKind
 }
 
+// RedactedResourcesProvider provides access to resources that should have specific fields redacted.
+type RedactedResourcesProvider interface {
+	// GetRedactedResources returns the list of resources with field-level redaction configured.
+	GetRedactedResources() []RedactedResource
+}
+
 type StsConfigProvider interface {
 	GetStsClientId() string
 	GetStsClientSecret() string
@@ -96,6 +113,7 @@ type BaseConfig interface {
 	ClusterProvider
 	ConfirmationRulesProvider
 	DeniedResourcesProvider
+	RedactedResourcesProvider
 	ExtendedConfigProvider
 	StsConfigProvider
 	ValidationEnabledProvider

pkg/config/config.go

@@ -15,6 +15,7 @@ import (
 	"github.com/BurntSushi/toml"
 	"github.com/containers/kubernetes-mcp-server/pkg/api"
 	"github.com/containers/kubernetes-mcp-server/pkg/output"
+	"github.com/containers/kubernetes-mcp-server/pkg/redaction"
 	"github.com/containers/kubernetes-mcp-server/pkg/tokenexchange"
 	"github.com/containers/kubernetes-mcp-server/pkg/toolsets"
 	"k8s.io/klog/v2"
@@ -32,7 +33,8 @@ type ToolOverride struct {
 // StaticConfig is the configuration for the server.
 // It allows to configure server specific settings and tools to be enabled or disabled.
 type StaticConfig struct {
-	DeniedResources []api.GroupVersionKind `toml:"denied_resources"`
+	DeniedResources   []api.GroupVersionKind `toml:"denied_resources"`
+	RedactedResources []api.RedactedResource `toml:"redacted_resources"`
 
 	LogLevel   int    `toml:"log_level,omitzero"`
 	LogFile    string `toml:"log_file,omitempty"`
@@ -382,6 +384,10 @@ func (c *StaticConfig) GetDeniedResources() []api.GroupVersionKind {
 	return c.DeniedResources
 }
 
+func (c *StaticConfig) GetRedactedResources() []api.RedactedResource {
+	return c.RedactedResources
+}
+
 func (c *StaticConfig) GetKubeConfigPath() string {
 	return c.KubeConfig
 }
@@ -550,6 +556,44 @@ func (c *StaticConfig) Validate() error {
 	if err := c.HTTP.Validate(); err != nil {
 		return err
 	}
+	if err := c.validateRedactedResources(); err != nil {
+		return err
+	}
+	return nil
+}
+
+// validateRedactedResources validates the redacted_resources configuration:
+//   - version must be set
+//   - kind must be set (cannot redact fields on an entire group/version)
+//   - fields must not be empty and must contain valid dot-separated paths
+//   - mode must be "opaque", "hashed", or empty (defaults to opaque)
+func (c *StaticConfig) validateRedactedResources() error {
+	for i, rr := range c.RedactedResources {
+		if rr.Version == "" {
+			return fmt.Errorf("redacted_resources[%d]: version must be set", i)
+		}
+		if rr.Kind == "" {
+			return fmt.Errorf("redacted_resources[%d]: kind must be set", i)
+		}
+		if len(rr.Fields) == 0 {
+			return fmt.Errorf("redacted_resources[%d]: fields must not be empty", i)
+		}
+		for j, field := range rr.Fields {
+			if field == "" {
+				return fmt.Errorf("redacted_resources[%d]: fields[%d] must not be empty", i, j)
+			}
+			segments := strings.Split(field, ".")
+			for _, seg := range segments {
+				if seg == "" {
+					return fmt.Errorf("redacted_resources[%d]: fields[%d] %q contains empty path segment", i, j, field)
+				}
+			}
+		}
+		mode := rr.Mode
+		if mode != "" && mode != redaction.RedactionModeOpaque && mode != redaction.RedactionModeHashed {
+			return fmt.Errorf("redacted_resources[%d]: invalid mode %q, must be %q or %q", i, mode, redaction.RedactionModeOpaque, redaction.RedactionModeHashed)
+		}
+	}
 	return nil
 }
 

pkg/config/validate_test.go

@@ -639,6 +639,151 @@ func (s *ValidateSuite) TestClusterAuthMode() {
 	})
 }
 
+func (s *ValidateSuite) TestRedactedResources() {
+	s.Run("missing version is rejected", func() {
+		cfg := s.validConfig()
+		cfg.RedactedResources = []api.RedactedResource{
+			{
+				Group:  "",
+				Kind:   "Secret",
+				Fields: []string{"data.*"},
+			},
+		}
+		err := cfg.Validate()
+		s.Require().Error(err)
+		s.Contains(err.Error(), "version must be set")
+	})
+
+	s.Run("missing kind is rejected", func() {
+		cfg := s.validConfig()
+		cfg.RedactedResources = []api.RedactedResource{
+			{
+				Group:   "",
+				Version: "v1",
+				Fields:  []string{"data.*"},
+			},
+		}
+		err := cfg.Validate()
+		s.Require().Error(err)
+		s.Contains(err.Error(), "kind must be set")
+	})
+
+	s.Run("empty fields is rejected", func() {
+		cfg := s.validConfig()
+		cfg.RedactedResources = []api.RedactedResource{
+			{
+				Group:   "",
+				Version: "v1",
+				Kind:    "Secret",
+			},
+		}
+		err := cfg.Validate()
+		s.Require().Error(err)
+		s.Contains(err.Error(), "fields must not be empty")
+	})
+
+	s.Run("empty field path is rejected", func() {
+		cfg := s.validConfig()
+		cfg.RedactedResources = []api.RedactedResource{
+			{
+				Group:   "",
+				Version: "v1",
+				Kind:    "Secret",
+				Fields:  []string{""},
+			},
+		}
+		err := cfg.Validate()
+		s.Require().Error(err)
+		s.Contains(err.Error(), "fields[0] must not be empty")
+	})
+
+	s.Run("field path with empty segment is rejected", func() {
+		cfg := s.validConfig()
+		cfg.RedactedResources = []api.RedactedResource{
+			{
+				Group:   "",
+				Version: "v1",
+				Kind:    "Secret",
+				Fields:  []string{"data..key"},
+			},
+		}
+		err := cfg.Validate()
+		s.Require().Error(err)
+		s.Contains(err.Error(), "contains empty path segment")
+	})
+
+	s.Run("invalid mode is rejected", func() {
+		cfg := s.validConfig()
+		cfg.RedactedResources = []api.RedactedResource{
+			{
+				Group:   "",
+				Version: "v1",
+				Kind:    "Secret",
+				Fields:  []string{"data.*"},
+				Mode:    "invalid-mode",
+			},
+		}
+		err := cfg.Validate()
+		s.Require().Error(err)
+		s.Contains(err.Error(), "invalid mode")
+		s.Contains(err.Error(), "invalid-mode")
+	})
+
+	s.Run("opaque mode is accepted", func() {
+		cfg := s.validConfig()
+		cfg.RedactedResources = []api.RedactedResource{
+			{
+				Group:   "",
+				Version: "v1",
+				Kind:    "Secret",
+				Fields:  []string{"data.*"},
+				Mode:    "opaque",
+			},
+		}
+		s.NoError(cfg.Validate())
+	})
+
+	s.Run("hashed mode is accepted", func() {
+		cfg := s.validConfig()
+		cfg.RedactedResources = []api.RedactedResource{
+			{
+				Group:   "",
+				Version: "v1",
+				Kind:    "Secret",
+				Fields:  []string{"data.*"},
+				Mode:    "hashed",
+			},
+		}
+		s.NoError(cfg.Validate())
+	})
+
+	s.Run("empty mode defaults to opaque and is accepted", func() {
+		cfg := s.validConfig()
+		cfg.RedactedResources = []api.RedactedResource{
+			{
+				Group:   "",
+				Version: "v1",
+				Kind:    "Secret",
+				Fields:  []string{"data.*"},
+			},
+		}
+		s.NoError(cfg.Validate())
+	})
+
+	s.Run("valid multi-segment field path is accepted", func() {
+		cfg := s.validConfig()
+		cfg.RedactedResources = []api.RedactedResource{
+			{
+				Group:   "apps",
+				Version: "v1",
+				Kind:    "Deployment",
+				Fields:  []string{"spec.template.spec.containers.*.env.*.value"},
+			},
+		}
+		s.NoError(cfg.Validate())
+	})
+}
+
 func TestValidate(t *testing.T) {
 	suite.Run(t, new(ValidateSuite))
 }