flux-operator

The MCP Server operates with high privileges, including `cluster-admin` role, which is necessary for its function as a Flux CD lifecycle manager. It handles sensitive data such as Kubernetes secrets (image pull secrets, Git/OCI credentials) and authentication tokens (OIDC, Bearer). While sensitive data is generally handled via Kubernetes Secrets and environment variables, reducing direct hardcoding, any misconfiguration or vulnerability in the operator itself could lead to exposure. The `ResourceSetInputProvider` integrates with external Git and OCI APIs, expanding the attack surface. The use of Go templates for resource generation in `ResourceSet` might introduce injection risks if not used carefully, though Go's templating is generally robust. License Key Management (LKM) uses standard cryptographic primitives but relies on environment variables for keys, which require secure handling.