Kubernetes

Connect your Kubernetes clusters to enable Kai to analyze workloads, optimize resources, and manage cluster operations. Kubernetes connects via cloud provider auto-discovery (for EKS, GKE, and AKS) or a service-account token with cluster endpoint details for self-managed clusters.

Prerequisites

Install Metrics Server before connecting — it is required for pod and node resource metrics:

kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml

Component	Purpose
Metrics Server	Required for pod and node resource metrics
kube-state-metrics	Enhanced cluster metrics (optional)
Network access	CloudThinker must reach the cluster API server

Supported platforms

Platform	Support
Amazon EKS	All versions
Google GKE	Standard, Autopilot
Azure AKS	All versions
Self-managed	Kubernetes 1.24+
Rancher	RKE, RKE2
OpenShift	4.x

Setup

Via Cloud Provider (Recommended)
Direct Kubeconfig

Auto-discovery from cloud connections

If you’ve already connected AWS, GCP, or Azure, your managed Kubernetes clusters are automatically discovered.

Connect cloud provider

Set up an AWS, GCP, or Azure connection first.

Clusters auto-discovered

EKS, GKE, or AKS clusters appear automatically in CloudThinker. Select which clusters to enable for analysis. CloudThinker shows a Connected status for each enabled cluster.

Manual setup with service account

For self-managed clusters or additional access beyond what the cloud provider connection provides:

Create a namespace (optional)

Create a dedicated namespace:

apiVersion: v1
kind: Namespace
metadata:
  name: cloudthinker

Create a service account

apiVersion: v1
kind: ServiceAccount
metadata:
  name: cloudthinker-readonly
  namespace: cloudthinker

Create a ClusterRole

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cloudthinker-readonly
rules:
- apiGroups: [""]
  resources: ["*"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps", "extensions"]
  resources: ["*"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["autoscaling"]
  resources: ["*"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["metrics.k8s.io"]
  resources: ["pods", "nodes"]
  verbs: ["get", "list"]

Create a ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cloudthinker-readonly
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cloudthinker-readonly
subjects:
- kind: ServiceAccount
  name: cloudthinker-readonly
  namespace: cloudthinker

Create a long-lived token

Starting from Kubernetes 1.24, create a Secret for long-lived tokens:

apiVersion: v1
kind: Secret
metadata:
  name: cloudthinker-readonly-token
  namespace: cloudthinker
  annotations:
    kubernetes.io/service-account.name: cloudthinker-readonly
type: kubernetes.io/service-account-token

Apply with:

kubectl apply -f cloudthinker-token-secret.yaml

Retrieve the token

kubectl get secret cloudthinker-readonly-token -n cloudthinker \
  -o jsonpath='{.data.token}' | base64 --decode

Get cluster info

Get your cluster endpoint:

kubectl cluster-info

Extract the CA certificate:

kubectl get secret cloudthinker-readonly-token -n cloudthinker \
  -o jsonpath='{.data.ca\.crt}' | base64 --decode

Add the connection in CloudThinker

Navigate to Connections → Kubernetes and enter:

Cluster API endpoint
Service account token
CA certificate (for self-signed clusters)

Click Connect. CloudThinker verifies access and shows a Connected status.

Connection details

The kubeconfig format CloudThinker uses for direct connections:

apiVersion: v1
kind: Config
clusters:
- cluster:
    certificate-authority-data: <base64-encoded-ca-cert>
    server: https://your-cluster-endpoint:6443
  name: your-cluster
contexts:
- context:
    cluster: your-cluster
    user: cloudthinker-readonly
  name: cloudthinker-context
current-context: cloudthinker-context
users:
- name: cloudthinker-readonly
  user:
    token: <your-service-account-token>

Required permissions

Minimum (read-only)

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cloudthinker-readonly
rules:
- apiGroups: [""]
  resources: ["pods", "nodes", "services", "namespaces", "events", "configmaps"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
  resources: ["deployments", "replicasets", "statefulsets", "daemonsets"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["autoscaling"]
  resources: ["horizontalpodautoscalers"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["metrics.k8s.io"]
  resources: ["pods", "nodes"]
  verbs: ["get", "list"]

Recommended (full analysis)

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cloudthinker-full-analysis
rules:
- apiGroups: [""]
  resources: ["pods", "nodes", "services", "namespaces", "events", "configmaps", "secrets", "persistentvolumeclaims", "resourcequotas", "limitranges", "replicationcontrollers"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
  resources: ["deployments", "replicasets", "statefulsets", "daemonsets"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["batch"]
  resources: ["jobs", "cronjobs"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses", "networkpolicies"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["autoscaling"]
  resources: ["horizontalpodautoscalers"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["metrics.k8s.io"]
  resources: ["pods", "nodes"]
  verbs: ["get", "list"]

Start with the minimum ClusterRole and expand to the full-analysis role only when you need the broader capability set. Never grant write verbs — get, list, and watch are sufficient for all Kai capabilities.

Agent capabilities

Once connected, Kai can inspect and optimize your cluster.

Capability	Description
Resource analysis	Pod CPU/memory usage, requests vs limits
Node health	Node status, capacity, allocatable resources
Workload optimization	Right-sizing recommendations, HPA tuning
Troubleshooting	CrashLoopBackOff, OOMKilled, pending pods
Security audit	RBAC review, pod security, network policies

Verify the connection

@kai check the cluster connection and list all namespaces and node count

Example prompts

@kai analyze pod resource utilization in the production namespace and #report the top CPU and memory consumers
@kai investigate crash loops in the payment service and #recommend a fix
@kai check node resource pressure across the cluster and #alert if any node is near capacity

Troubleshooting

Cannot connect to cluster

Verify the API server endpoint is accessible from the internet. Check that firewall rules and security groups allow CloudThinker’s IPs. For private clusters, set up VPN or bastion access and confirm the API server certificate is valid.

Unauthorized errors

Verify the service account token is correct. Check that the ClusterRoleBinding is applied and that the token hasn’t expired. Confirm the service account exists in the correct namespace.

No metrics data

Verify Metrics Server is installed by running kubectl top nodes. Check that Metrics Server pods are running and that the metrics.k8s.io API is available.

Missing namespaces

Verify the ClusterRole includes namespace list permission. Check if RBAC restricts access to certain namespaces and confirm the service account binding is cluster-wide.

Security

Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

Read-only access — never grant write verbs to the CloudThinker service account; get, list, and watch are sufficient for all agent capabilities.
Namespace isolation — keep the service account in a dedicated namespace (e.g., cloudthinker) to simplify auditing and revocation.

Kai Agent

Kubernetes-focused optimization agent

AWS Connection

Connect AWS for EKS auto-discovery

Organization

Agents

Automation & Autonomy

Connections

Platform Settings

Security

Billing

Prerequisites

Supported platforms

Setup

Auto-discovery from cloud connections

Manual setup with service account

Connection details

Required permissions

Minimum (read-only)

Recommended (full analysis)

Agent capabilities

Verify the connection

Example prompts

Troubleshooting

Security

Kai Agent

AWS Connection

​Prerequisites

​Supported platforms

​Setup

​Auto-discovery from cloud connections

​Manual setup with service account

​Connection details

​Required permissions

​Minimum (read-only)

​Recommended (full analysis)

​Agent capabilities

​Verify the connection

​Example prompts

​Troubleshooting

​Security

​Related

Kai Agent

AWS Connection

Prerequisites

Supported platforms

Setup

Auto-discovery from cloud connections

Manual setup with service account

Connection details

Required permissions

Minimum (read-only)

Recommended (full analysis)

Agent capabilities

Verify the connection

Example prompts

Troubleshooting

Security

Related